1 Introduction
1.1 Research Questions
1.2 Scope, Related Works, and Contributions

2 Background
2.1 Server-side Web Application and Web API
2.2 Fuzzing

3 Survey Methodology
3.1 Searching Papers
3.2 Manual Filtering of the Collected Papers
3.3 Collection Expansion
3.4 Summary on Publications

4 Web API Fuzzing Overview
4.1 Standard Fuzzing
4.2 Vulnerability-driven Fuzzing

5 Web API Fuzzer Workflow

6 Open Challenges

7 Potential Research Directions
7.1 Fuzzing for Web Client Programming
7.2 Fuzzing Mobile Web Applications
7.3 Generative AI for Web Testing
7.4 Support for Diverse Web Security Vulnerabilities

8 Threats to Validity

9 Conclusion