{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2026,7,8]],"date-time":"2026-07-08T12:22:14Z","timestamp":1783513334534,"version":"3.55.0"},"reference-count":36,"publisher":"Springer Science and Business Media LLC","issue":"2","license":[{"start":{"date-parts":[[2026,5,28]],"date-time":"2026-05-28T00:00:00Z","timestamp":1779926400000},"content-version":"tdm","delay-in-days":0,"URL":"https:\/\/www.springernature.com\/gp\/researchers\/text-and-data-mining"},{"start":{"date-parts":[[2026,5,28]],"date-time":"2026-05-28T00:00:00Z","timestamp":1779926400000},"content-version":"vor","delay-in-days":0,"URL":"https:\/\/www.springernature.com\/gp\/researchers\/text-and-data-mining"}],"content-domain":{"domain":["link.springer.com"],"crossmark-restriction":false},"short-container-title":["Software Qual J"],"published-print":{"date-parts":[[2026,6]]},"DOI":"10.1007\/s11219-026-09763-6","type":"journal-article","created":{"date-parts":[[2026,5,28]],"date-time":"2026-05-28T08:04:34Z","timestamp":1779955474000},"update-policy":"https:\/\/doi.org\/10.1007\/springer_crossmark_policy","source":"Crossref","is-referenced-by-count":0,"title":["SGAFuzzer: Stateful GraphQL API fuzzing"],"prefix":"10.1007","volume":"34","author":[{"given":"Jingge","family":"Sun","sequence":"first","affiliation":[],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"Xiangpu","family":"Song","sequence":"additional","affiliation":[],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"Xiaofeng","family":"Liu","sequence":"additional","affiliation":[],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"Shanqing","family":"Guo","sequence":"additional","affiliation":[],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"Chengyu","family":"Hu","sequence":"additional","affiliation":[],"role":[{"vocabulary":"crossref","role":"author"}]}],"member":"297","published-online":{"date-parts":[[2026,5,28]]},"reference":[{"key":"9763_CR1","unstructured":"Adobe Magento (2025) Magento open source. https:\/\/magento.com\/, accessed: 03 Feb 2025"},{"key":"9763_CR2","unstructured":"Apache Software Foundation (2025) Apache SkyWalking. https:\/\/skywalking.apache.org\/, accessed: 03 Feb 2025"},{"key":"9763_CR3","unstructured":"Apollo GraphQL (2025a) Apollo server schema naming conventions. https:\/\/www.apollographql.com\/docs\/apollo-server\/schema\/schema#naming-conventions, accessed: 08 Mar 2025"},{"key":"9763_CR4","unstructured":"Apollo GraphQL (2025b) Using apollo link to handle dependent queries. https:\/\/www.apollographql.com\/blog\/using-apollo-link-to-handle-dependent-queries, accessed: 03 Feb 2025"},{"key":"9763_CR5","doi-asserted-by":"publisher","unstructured":"Atlidakis, V., Godefroid, P., & Polishchuk, M. (2019). Restler: Stateful REST API fuzzing. In Proceedings of the 2019 IEEE\/ACM 41st International Conference on Software Engineering (ICSE), (pp. 748\u2013758). IEEE\/ACM, Montreal, QC, Canada. https:\/\/doi.org\/10.1109\/ICSE.2019.00083","DOI":"10.1109\/ICSE.2019.00083"},{"key":"9763_CR6","unstructured":"Ba, J., B\u00f6hme, M., Mirzamomen, Z., et\u00a0al. (2022). Stateful greybox fuzzing. In Proceedings of the 31st USENIX Security Symposium, (pp. 3255\u20133272). USENIX Association, Boston, MA, USA, included in the Artifact Appendices to the Proceedings."},{"issue":"1","key":"9763_CR7","doi-asserted-by":"publisher","first-page":"1","DOI":"10.1145\/3609427","volume":"18","author":"A Belhadi","year":"2024","unstructured":"Belhadi, A., Zhang, M., & Arcuri, A. (2024). Random Testing and Evolutionary Testing for Fuzzing GraphQL APIs. ACM Transactions on the Web, 18(1), 1\u201341. https:\/\/doi.org\/10.1145\/3609427","journal-title":"ACM Transactions on the Web"},{"key":"9763_CR8","doi-asserted-by":"publisher","unstructured":"Cha, A., Wittern, E., Baudart, G., et\u00a0al. (2020). A principled approach to GraphQL Query cost analysis. In Proceedings of the 28th ACM Joint Meeting on European Software Engineering Conference and Symposium on the Foundations of Software Engineering (ESEC\/FSE 2020), (pp. 257\u2013268). ACM, Virtual Event, USA. https:\/\/doi.org\/10.1145\/3368089.3409670","DOI":"10.1145\/3368089.3409670"},{"key":"9763_CR9","unstructured":"Du, W., Li, J., Wang, Y., et\u00a0al. (2024). Vulnerability-oriented testing for RESTful APIs. In Proceedings of the 33rd USENIX Security Symposium, (pp. 739\u2013755). USENIX Association, Philadelphia, PA, USA"},{"key":"9763_CR10","unstructured":"EvoMaster research group (2025) Evomaster github repository. https:\/\/github.com\/EMResearch\/EvoMaster, accessed: 03 Feb 2025"},{"key":"9763_CR11","unstructured":"Explosion AI (2025) en_core_web_md: A large english language model. https:\/\/spacy.io\/models\/en#en-core-web-md, accessed: 08 Mar 2025"},{"key":"9763_CR12","unstructured":"Fendoujack (2025) Sgafuzzer. https:\/\/github.com\/fendoujack\/SGAFuzzer, accessed: 10 Mar 2025"},{"key":"9763_CR13","unstructured":"Gartner Research (2025) Gartner research report. https:\/\/www.gartner.com\/doc\/reprints?id=1-2H060YE8&ct=240319&st=sb, accessed: 03 Feb 2025"},{"key":"9763_CR14","unstructured":"GitLab Inc. (2025a) Gitlab. https:\/\/about.gitlab.com, accessed: 03 Feb 2025"},{"key":"9763_CR15","unstructured":"GitLab Inc. (2025b) Gitlab issues. https:\/\/gitlab.com\/gitlab-org\/gitlab\/-\/issues, multiple related issue reports. Accessed: 03 Feb 2025"},{"key":"9763_CR16","unstructured":"GitLab Inc. (2025c) Gitlab merge requests. https:\/\/gitlab.com\/gitlab-org\/gitlab\/-\/merge_requests\/175275, accessed: 03 Feb 2025"},{"key":"9763_CR17","unstructured":"GitLab Inc. (2025d) GraphQL API. https:\/\/docs.gitlab.com\/ee\/api\/graphql\/, accessed: 03 Feb 2025"},{"issue":"1","key":"9763_CR18","doi-asserted-by":"publisher","first-page":"1","DOI":"10.1145\/3617175","volume":"33","author":"A Golmohammadi","year":"2023","unstructured":"Golmohammadi, A., Zhang, M., & Arcuri, A. (2023). Testing RESTful APIs: A survey. ACM Transactions on Software Engineering and Methodology, 33(1), 1\u201341. https:\/\/doi.org\/10.1145\/3617175","journal-title":"ACM Transactions on Software Engineering and Methodology"},{"key":"9763_CR19","unstructured":"GraphQL Foundation (2020) GraphQL foundation. https:\/\/foundation.graphql.org\/, accessed: 03 Feb 2025"},{"key":"9763_CR20","unstructured":"GraphQL Foundation (2025a) GraphQL landscape. https:\/\/landscape.graphql.org\/, accessed: 03 Feb 2025"},{"key":"9763_CR21","unstructured":"GraphQL Foundation (2025b) GraphQL official website. https:\/\/graphql.org\/, accessed: 03 Feb 2025"},{"key":"9763_CR22","unstructured":"GraphQL Project (2025) GraphQL schema learning. https:\/\/graphql.org\/learn\/, accessed: 03 Feb 2025"},{"key":"9763_CR23","doi-asserted-by":"publisher","unstructured":"Hatfield-Dodds, Z., & Dygalo, D. (2022). Deriving semantics-aware fuzzers from web API schemas. In Proceedings of the 2022 IEEE\/ACM 44th International Conference on Software Engineering: Companion (ICSE-Companion), (pp. 345\u2013346). IEEE\/ACM, Pittsburgh, PA, USA. https:\/\/doi.org\/10.1145\/3510454.3528637","DOI":"10.1145\/3510454.3528637"},{"key":"9763_CR24","doi-asserted-by":"publisher","unstructured":"Karlsson, S., \u0106au\u0161evi\u0107, A., & Sundmark, D. (2021). Automatic property-based testing of GraphQL APIs. In Proceedings of the 2021 IEEE\/ACM International Conference on Automation of Software Test (AST), (pp. 1\u201310). IEEE, Madrid, Spain. https:\/\/doi.org\/10.1109\/AST52587.2021.00009","DOI":"10.1109\/AST52587.2021.00009"},{"key":"9763_CR25","unstructured":"Li, Y., Ji, S., Chen, Y., et\u00a0al. (2021). UniFuzz: A holistic and pragmatic metrics-driven platform for evaluating fuzzers. In Proceedings of the 30th USENIX Security Symposium. USENIX Association, Virtual Event, (pp. 2777\u20132794)."},{"key":"9763_CR26","unstructured":"Meneses\u00a0Vargas, D., Fern\u00e1ndez\u00a0Blanco, A., Cota\u00a0Vidaurre, A., et\u00a0al. (2018). Deviation testing: A test case generation technique for GraphQL APIs. In Proceedings of the 11th International Workshop on Smalltalk Technologies (IWST), (pp. 1\u20139). ACM, Cagliari, Italy"},{"key":"9763_CR27","first-page":"1","volume":"27","author":"R Natella","year":"2021","unstructured":"Natella, R. (2021). StateAFL: Greybox fuzzing for stateful network servers. Empirical Software Engineering, 27, 1\u201331.","journal-title":"Empirical Software Engineering"},{"key":"9763_CR28","unstructured":"Saleor Commerce (2025) Saleor ecommerce. https:\/\/saleor.io\/, accessed: 03 Feb 2025"},{"key":"9763_CR29","unstructured":"Schemathesis Project (2025) Stateful testing documentation. https:\/\/schemathesis.readthedocs.io\/en\/stable\/stateful.html, accessed: 03 Feb 2025"},{"key":"9763_CR30","unstructured":"Wikipedia Contributors (2025) Levenshtein distance. https:\/\/en.wikipedia.org\/wiki\/Levenshtein_distance, accessed: 03 Feb 2025"},{"key":"9763_CR31","unstructured":"WPGraphQL Team (2025) WpgraphQL. https:\/\/www.wpgraphql.com\/, accessed: 03 Feb 2025"},{"key":"9763_CR32","doi-asserted-by":"publisher","unstructured":"Wu, H., Xu, L., Niu, X., et\u00a0al. (2022). Combinatorial testing of RESTful APIs. In Proceedings of the ACM\/IEEE International Conference on Software Engineering (ICSE \u201922), (pp. 426\u2013437). ACM\/IEEE, Pittsburgh, PA, USA. https:\/\/doi.org\/10.1145\/3510003.3510161","DOI":"10.1145\/3510003.3510161"},{"key":"9763_CR33","doi-asserted-by":"publisher","unstructured":"Zetterlund, L., Tiwari, D., Monperrus, M., et\u00a0al. (2022). Harvesting production GraphQL queries to detect schema faults. In Proceedings of the 2022 IEEE Conference on Software Testing, Verification and Validation (ICST), (pp. 365\u2013376). IEEE, Liverpool, United Kingdom. https:\/\/doi.org\/10.1109\/ICST53961.2022.00014","DOI":"10.1109\/ICST53961.2022.00014"},{"key":"9763_CR34","unstructured":"Zhao, B., Li, Z., Qin, S., et\u00a0al. (2022). StateFuzz: System Call-based State-aware Linux Driver Fuzzing. In Proceedings of the 31st USENIX Security Symposium, (pp. 3273\u20133289). USENIX Association, Boston, MA, USA, included in the Proceedings."},{"issue":"6","key":"9763_CR35","doi-asserted-by":"publisher","first-page":"5493","DOI":"10.1007\/s00500-023-09306-2","volume":"28","author":"X Zhao","year":"2023","unstructured":"Zhao, X., Qu, H., Xu, J., et al. (2023). A systematic review of fuzzing. Soft Computing, 28(6), 5493\u20135522. https:\/\/doi.org\/10.1007\/s00500-023-09306-2","journal-title":"Soft Computing"},{"key":"9763_CR36","unstructured":"Zwerschke, C. (2022). Graphql-core 3: A python port of GraphQL.js reference implementation. https:\/\/pypi.org\/project\/graphql-core\/, accessed: 26 Feb 2025"}],"container-title":["Software Quality Journal"],"original-title":[],"language":"en","link":[{"URL":"https:\/\/link.springer.com\/content\/pdf\/10.1007\/s11219-026-09763-6.pdf","content-type":"application\/pdf","content-version":"vor","intended-application":"text-mining"},{"URL":"https:\/\/link.springer.com\/article\/10.1007\/s11219-026-09763-6","content-type":"text\/html","content-version":"vor","intended-application":"text-mining"},{"URL":"https:\/\/link.springer.com\/content\/pdf\/10.1007\/s11219-026-09763-6.pdf","content-type":"application\/pdf","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2026,7,8]],"date-time":"2026-07-08T11:54:22Z","timestamp":1783511662000},"score":1,"resource":{"primary":{"URL":"https:\/\/link.springer.com\/10.1007\/s11219-026-09763-6"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2026,5,28]]},"references-count":36,"journal-issue":{"issue":"2","published-print":{"date-parts":[[2026,6]]}},"alternative-id":["9763"],"URL":"https:\/\/doi.org\/10.1007\/s11219-026-09763-6","relation":{"has-preprint":[{"id-type":"doi","id":"10.21203\/rs.3.rs-8078365\/v1","asserted-by":"object"}]},"ISSN":["0963-9314","1573-1367"],"issn-type":[{"value":"0963-9314","type":"print"},{"value":"1573-1367","type":"electronic"}],"subject":[],"published":{"date-parts":[[2026,5,28]]},"assertion":[{"value":"10 November 2025","order":1,"name":"received","label":"Received","group":{"name":"ArticleHistory","label":"Article History"}},{"value":"18 May 2026","order":2,"name":"accepted","label":"Accepted","group":{"name":"ArticleHistory","label":"Article History"}},{"value":"28 May 2026","order":3,"name":"first_online","label":"First Online","group":{"name":"ArticleHistory","label":"Article History"}},{"order":1,"name":"Ethics","group":{"name":"EthicsHeading","label":"Declarations"}},{"value":"The authors declare no competing interests.","order":2,"name":"Ethics","group":{"name":"EthicsHeading","label":"Competing Interests"}}],"article-number":"28"}}