Inferring the types of APIs used in incomplete codes (also referred to as code snippets), e.g., those on Q&A forums, is a prerequisite step required to work with the codes. Existing type inference methods proposed for incomplete Java codes can be primarily categorized as constraint-based or statistics-based. The former relies on a pre-built API knowledge base (KB) and the type constraints in code snippets, which imposes higher requirements on code syntax and thus suffers from low recall due to the syntactic limitation. The latter overcomes the syntactic limitation by learning statistical regularities from a code corpus, however it rarely employs the type constraints in code snippets, which may lead to low precision. In this paper, we propose an effective type inference framework, called iJTyper, for incomplete Java codes by integrating the complementary advantages of constraint- and statistics-based methods. For a code snippet, iJTyper first applies a constraint-based method and augments the code context with the inferred API types. Then, it applies a statistics-based method to the augmented code snippet. The types predicted for APIs are further used to improve the constraint-based method by reducing its pre-built KB. iJTyper iteratively executes both methods and performs the code context augmentation and KB reduction mechanisms until a termination condition is satisfied. The final inference results are produced by combining the results of both methods. We implemented a version of iJTyper by integrating two state-of-the-art methods, SnR and MLMTyper, and evaluated iJTyper on two open-source datasets. Results show that 1) iJTyper achieves the highest average precision/recall1 of 97.3% and 92.5% on both datasets; 2) iJTyper improves the average recall of SnR and MLMTyper by at least 7.3 % and 27.4%, respectively; and 3) iJTyper improves the average precision/recall of the recently popular language model, ChatGPT, by 3.2% and 0.5% on both datasets.

Smart contracts have been increasingly created and deployed with the wide use of blockchain technology. The security and reliability issues of smart contracts draw extensive attention from academia and industry. Most of these issues are caused by developers when they are writing contract codes, such as writing non-standard codes and making unintentional mistakes. Thus, we propose a token-level code recommendation approach, ASCRec, for Solidity language to improve the efficiency of smart contract development and reduce code vulnerabilities. ASCRec first selects bug-free smart contracts via vulnerability detection tools to form a training dataset. Then a transformer-based code recommendation model with token type and text embedding is trained to predict the next token and generate a recommendation list. Finally, the token recommendation list is optimized based on a series of strategies proposed with expert knowledge. We evaluate ASCRec based on real-world smart contracts extracted from 230,548 open source sol files on Etherscan, and compare it with six state-of-the-art baselines. The results show that ASCRec is effective for token recommendation and has the ability to avoid five token-level vulnerabilities of smart contracts.

The rapid expansion of the model context protocol (MCP) ecosystem enables large language model (LLM)-based agents to access a wide range of external tools via a standardized interface. However, identifying appropriate MCP servers for a specific development task remains challenging. Existing studies primarily focus on measuring the MCP ecosystem or optimizing tool invocation mechanisms, while systematic recommendation frameworks and reproducible benchmarks for real-world development tasks remain largely unexplored. To address this limitation, we formulate task-oriented MCP server recommendation as a structured retrieval-and-ranking problem that jointly considers semantic relevance and engineering constraints. We first construct Task2MCP, a task-centered dataset that systematically associates taxonomy-grounded development tasks with curated MCP servers. This dataset provides structured supervision and a reproducible evaluation environment for research on MCP tool recommendations. Building on this dataset, we propose T2MRec, a task-to-MCP server recommendation model. It models semantic relevance and structural compatibility to construct an initial candidate set. Then it improves coverage and ranking quality through centroid-based candidate expansion and constrained LLM-based re-ranking. In addition, we design and implement an interactive MCP server recommendation agent prototype that operates in conversational environments to support dynamic decision-making. The agent assists developers in efficiently evaluating and integrating tools by providing recommended MCP servers together with usage guidelines.

Microservice-based systems often suffer from reliability issues due to their intricate interactions and expanding scale. With the rapid growth of observability techniques, various methods have been proposed to achieve failure diagnosis, including root cause localization and failure type identification, by leveraging diverse monitoring data such as logs, metrics, or traces. However, traditional failure diagnosis methods that use single-modal data can hardly cover all failure scenarios due to the restricted information. Several failure diagnosis methods have been recently proposed to integrate multimodal data based on deep learning. These methods, however, tend to combine modalities indiscriminately and treat them equally in failure diagnosis, ignoring the relationship between specific modalities and different diagnostic tasks. This oversight hinders the effective utilization of the unique advantages offered by each modality. To address the limitation, we propose TVDiag, a multimodal failure diagnosis framework for locating culprit microservice instances and identifying their failure types (e.g., Net-packets Corruption) in microservice-based systems. TVDiag employs task-oriented learning to enhance the potential advantages of each modality and establishes cross-modal associations based on contrastive learning to extract view-invariant failure information. Furthermore, we develop a graph-level data augmentation strategy that randomly inactivates the observability of some normal microservice instances to mitigate the shortage of training data. Experimental results on four datasets show that TVDiag outperforms state-of-the-art methods in multimodal failure diagnosis by at least 20.16% and 3.08% in terms of \(HR@1\) and F1-score, respectively.

Fault injection is a key technique for assessing software reliability, enabling proactive detection of system defects before they manifest in production. However, the increasing complexity of microservice architectures leads to exponential growth in the fault-injection space, rendering traditional random injection inefficient. Recent lineage-driven approaches mitigate this problem through heuristic pruning, but they face two limitations. First, combinatorial-fault discovery remains bottlenecked by general-purpose SAT solvers, which fail to exploit the monotone and low-overlap structure of derived CNF formulas and typically rely on a static upper bound on fault size. Second, existing techniques provide limited post-injection guidance beyond reporting detected faults. To address these challenges, we propose FastFI, a fault-injection-guided framework to enhance the robustness of API call sites in microservice-based systems. FastFI features a DFS-based solver with dynamic fault injection to discover all valid combinatorial faults, and it leverages fault-injection results to identify critical APIs whose call sites should be hardened for robustness. Experiments on four representative microservice benchmarks show that FastFI reduces end-to-end fault-injection time by an average of 76.12% compared to state-of-the-art baselines while maintaining acceptable resource overhead. Moreover, FastFI accurately identifies high-impact APIs and provides actionable guidance for call-site hardening.

Open-source repositories are widely used to improve the productivity and quality of modern software development. However, it is generally not an easy task for developers to find suitable repositories from a large-scale platform, e.g., GitHub. Although GitHub provides a search engine to support repository exploration, the search capability is limited as some important criteria (e.g., the closed ratio of issues) are not supported, and users cannot specify fine-grained preferences on different criteria. To address these limitations, we propose a unified effective repository retrieval model, named UERR. We first define a unified schema that is useful for retrieving repositories by analyzing the metadata of GitHub repositories. Our schema includes 30 attributes grouped into six dimensions, such as functionality, maintenance, and popularity. Based on the schema, we design a query grammar for users to express their fine-grained requirements with personalized preferences and an integrated method to measure the relevance between a repository and a query. In particular, we expand acronyms and split conjoined words by leveraging large language models (LLMs) and design a weighted Ngram based method to measure functional relevance between textual descriptions of repositories and queries. Experiments with 20 diverse queries show that UERR significantly improves the top 1 similar to 20 retrieved repositories by 27.12%-165.87% in terms of the three metrics: Pre@k, MRR@k, and NDCG@k, in comparison with the search engines provided by Elasticsearch and GitHub. The results also validate the superiority of our weighted N-gram based functional relevance measurement method over three representative methods.

Repository-level code generation with Large Language Models (LLMs) remains challenging, primarily due to complex dependencies and limited context windows. Recent approaches adopt retrieval-augmented generation (RAG) and the planning mechanism to reuse potential callee functions in the repository. However, these approaches often suffer from two limitations: lack of test-driven behavioral guidance during planning and overlooking the implementation logic embedded in repository code during reuse. As a result, generated plans may not align with expected behaviors, and retrieved functions may not be effectively reused. In this paper, we propose TICoder, a novel repository-level code generation framework that improves both planning and reuse. TICoder introduces a test-driven iterative planning mechanism that leverages test cases as behavioral specifications to refine implementation steps. Furthermore, TICoder employs an implementation-aware code reuse strategy, which retrieves potential callee functions using a dual-view similarity that captures both functional and implementation aspects. We then identify relevant usage patterns through a dual-stage selection strategy, combining structure-based clustering and perplexity-based filtering. We conduct extensive experiments on widely used repository-level code generation benchmarks with various LLMs. Experimental results demonstrate that TICoder outperforms state-of-the-art (SOTA) methods, achieving an average improvement of 11.52

Context: Technical Q&A platforms, e.g., Stack Overflow (SO), have accumulated tens of millions of programming questions, offering a huge valuable data resource to analyze developers' requirements and advance intelligent software engineering. To help users (including platform owners, question answerers, and software developers) manage, answer, and explore the questions effectively, it is crucial to accurately identify the intents of the questions.Objectives: Existing studies primarily focus on recommending simple tags (e.g., java), paying limited attention to the categorization and recognition of fine-grained intents. This study aims to address this gap by building a comprehensive fine-grained intent taxonomy and developing an automated approach to recognize the intents of programming questions.Methods: We manually annotated 1,536 sampled SO questions to build an intent taxonomy. Then, we propose PQIR, an approach that reformulates the intent recognition task as a multi-class classification problem (since a question may contain multiple intents) using a deep learning architecture. To address the class imbalance problem, we synthesized data for intent categories with insufficient samples by employing a large language model (LLM).Results: Our taxonomy contains 30 intent categories that belong to seven dimensions. Extensive experiments demonstrate that PQIR achieves optimal performance of 0.856, 0.681, and 0.834 on micro-, macro-, and sample-averaged F1 metrics, respectively, significantly outperforming nine representative baselines. The results also verify the effectiveness of our LLM-based data augmentation strategy.Conclusion: The proposed taxonomy and PQIR approach effectively categorize and recognize fine-grained intents in programming questions. LLM-based data augmentation proves to be a viable solution to the class imbalance problem in intent recognition tasks.

Recommending API sequences is crucial in software development, saving developers time and effort. While previous studies primarily focus on accuracy, often recommending popular APIs, they tend to overlook less frequent, or ‘tail,’ APIs. This oversight, often a result of limited historical data, consequently diminishes the diversity of recommender systems. In this paper, we propose DDASR, a framework for recommending API sequences containing both popular and tail APIs. To accurately capture developer intent, we utilize recent Large Language Models for learning query representations. To gain a better understanding of tail APIs, DDASR clusters tail APIs with similar functionality and replaces them with cluster centers to produce a pseudo ground truth. Moreover, a loss function is defined based on learning-to-rank to achieve an equilibrium in accuracy and diversity due to the inherent trade-off between them. To evaluate DDASR, we conduct extensive experiments on Java and Python open-source datasets. Results demonstrate that DDASR significantly achieves the best diversity without sacrificing accuracy. Compared to seven state-of-the-art approaches, DDASR improves accuracy metrics BLEU, ROUGE, MAP, and NDCG and diversity metric coverage by 108.28%, 67.30%, 88.59%, and 45.83%, respectively on the Java dataset, as well as 9.83%, 2.45%, 8.06%, and 8.03%, respectively on the Python dataset.

Due to its powerful capabilities in natural language understanding and content generation, ChatGPT has received widespread attention since its launch in 2022. An increasing number of ChatGPT-related projects (that enhance the capabilities of ChatGPT, develop applications by calling ChatGPT APIs, etc.) are being released on GitHub and have sparked widespread discussions. However, GitHub does not provide a detailed classification of these projects to help users effectively explore interested projects. Additionally, the issues raised by users for these projects cover various aspects, e.g., installation, usage, and updates. It would be valuable to help developers prioritize more urgent issues and improve development efficiency. Unfortunately, there is currently no research focused on understanding the categories and issues of ChatGPT-related projects. To fill this gap, we retrieved 71,244 projects from GitHub using the keyword 'ChatGPT' and selected the top 200 representative projects with the highest numbers of stars as our dataset. By analyzing the project descriptions, we identified three primary categories of ChatGPT-related projects, namely ChatGPT Implementation & Training, ChatGPT Application, ChatGPT Improvement & Extension. We further built a classifier for automatically categorizing projects based on the 200 manually annotated projects. Next, we applied a topic modeling technique to 23,609 issues of those projects and identified ten issue topics, e.g., model reply and interaction interface. We analyzed the popularity, difficulty, and evolution of each issue topic within the three project categories and further proposed a method for recommending solutions for open issues by summarizing the pull requests associated with closed issues. Our main findings are: (1) The increase in the number of projects within the three categories is closely related to the development of ChatGPT; and (2) There are significant differences in the popularity, difficulty, and evolutionary trends of the issue topics across the three project categories. Based on these findings, we finally provided implications for project developers and platform managers on how to better develop and manage ChatGPT-related projects, such as offering more fine-grained tags to categorize projects to facilitate their exploration.

Code snippets are widely used in technical forums to demonstrate solutions to programming problems. They can be leveraged by developers to accelerate problem-solving. However, code snippets often lack concrete types of the APIs used in them, which impedes their understanding and resue. To enhance the description of a code snippet, a number of approaches are proposed to infer the types of APIs. Although existing approaches can achieve good performance, their performance is limited by ignoring other information outside the input code snippet (e.g., the descriptions of similar code snippets) that could potentially improve the performance. In this paper, we propose a novel type inference approach, named CKTyper, by leveraging crowdsourcing knowledge in technical posts. The key idea is to generate a relevant context for a target code snippet from the posts containing similar code snippets and then employ the context to promote the type inference with large language models (e.g., ChatGPT). More specifically, we build a crowdsourcing knowledge base (CKB) by extracting code snippets from a large set of posts and index the CKB using Lucene. An API type dictionary is also built from a set of API libraries. Given a code snippet to be inferred, we first retrieve a list of similar code snippets from the indexed CKB. Then, we generate a crowdsourcing knowledge context (CKC) by extracting and summarizing useful content (e.g., API-related sentences) in the posts that contain the similar code snippets. The CKC is subsequently used to improve the type inference of ChatGPT on the input code snippet. The hallucination of ChatGPT is eliminated by employing the API type dictionary. Evaluation results on two open-source datasets demonstrate the effectiveness and efficiency of CKTyper. CKTyper achieves the optimal precision/recall of 97.80% and 95.54% on both datasets, respectively, significantly outperforming three state-of-the-art baselines and ChatGPT.

Just-in-time defect prediction (JIT-DP) is used to predict the defect-proneness of a commit and just-in-time defect localization (JIT-DL) is used to locate the exact buggy positions (defective lines) in a commit. Recently, various JIT-DP and JIT-DL techniques have been proposed, while most of them use a post-mortem way (e.g., code entropy, attention weight, LIME) to achieve the JIT-DL goal based on the prediction results in JIT-DP. These methods do not utilize the label information of the defective code lines during model building. In this paper, we propose a unified model JIT-Smart, which makes the training process of just-in-time defect prediction and localization tasks a mutually reinforcing multi-task learning process. Specifically, we design a novel defect localization network (DLN), which explicitly introduces the label information of defective code lines for supervised learning in JIT-DL with considering the class imbalance issue. To further investigate the accuracy and cost-effectiveness of JIT-Smart, we compare JIT-Smart with 7 state-of-the-art baselines under 5 commit-level and 5 line-level evaluation metrics in JIT-DP and JIT-DL. The results demonstrate that JIT-Smart is statistically better than all the state-of-the-art baselines in JIT-DP and JIT-DL. In JIT-DP, at the median value, JIT-Smart achieves F1-Score of 0.475, AUC of 0.886, Recall@20%Effort of 0.823, Effort@20%Recall of 0.01 and Popt of 0.942 and improves the baselines by 19.89%-702.74%, 1.23%-31.34%, 9.44%-33.16%, 21.6%-53.82% and 1.94%-34.89%, respectively . In JIT-DL, at the median value, JIT-Smart achieves Top-5 Accuracy of 0.539 and Top-10 Accuracy of 0.396, Recall@20%Effort line of 0.726, Effort@20%Recall line of 0.087 and IFA line of 0.098 and improves the baselines by 101.83%-178.35%, 101.01%-277.31%, 257.88%-404.63%, 71.91%-74.31% and 99.11%-99.41%, respectively. Statistical analysis shows that our JIT-Smart performs more stably than the best-performing model. Besides, JIT-Smart also achieves the best performance compared with the state-of-the-art baselines in cross-project evaluation.

Automated code generation is a powerful technique for software development, which can significantly reduce developers' effort and time for writing code. Recently, OpenAI's large language model ChatGPT has emerged as a powerful tool for generating human-like responses to a wide range of textual inputs (i.e., prompts), including those related to code generation. However, the effectiveness of ChatGPT in code generation is still not well understood. The code generation performance could also be heavily influenced by the choice of prompts, which should be further explored. In this paper, we report an empirical study on ChatGPT's capabilities for two types of code generation tasks, namely text-to-code and code-to-code generation. We investigate different types of prompts by leveraging the chain-of-thought strategy with multi-step optimizations. Our empirical results show that by carefully designing prompts to guide ChatGPT, the code generation performance can be improved substantially. We also analyze the factors that influence the prompt design and provide insights that could guide future research.

To improve software development productivity, developers frequently search for projects on open-source communities such as GitHub. However, it is challenging for users to quickly find suitable projects from numerous results due to the overload of project information. Although many tools have been proposed to rank the relevancy of searched results, manually inspecting them one by one is irreplaceable and time-consuming. To fill this gap, we propose a visual retrieval tool named VisRepo for open-source software projects. Firstly, it mines software project data from four perspectives including topic, technology, usability, and comprehensibility, and connects projects based on the same owners/contributors and similar topics. Then, visualization technique is employed to present complex software data intuitively. VisRepo provides users an interactive retrieval paradigm of Search-Explore-Check-Recommend with in-depth insights and better exploration experience. We evaluate VisRepo on 7w+ open-source JavaScript projects. Experimental results showed that VisRepo outperforms GitHub search engine in terms of time consumption and accuracy, meanwhile enabling a more interactive and useful user experience. Demo Source Code: https://github.com/YUEchn/visrepo Demo Video: https://youtu.be/-fqL8ngSmwQ

Inferring the types of API elements in incomplete code snippets (e.g., those on Q A forums) is a prepositive step required to work with the code snippets. Existing type inference methods can be mainly categorized as constraint-based or statistically-based. The former imposes higher requirements on code syntax and often suffers from low recall due to the syntactic limitation of code snippets. The latter relies on the statistical regularities learned from a training corpus and does not take full advantage of the type constraints in code snippets, which may lead to low precision. In this paper, we propose an iterative type inference framework for Java, called iJTyper, by integrating the strengths of both constraint- and statistically-based methods. For a code snippet, iJTyper first applies a constraint-based method and augments the code context with the inferred types of API elements. iJTyper then applies a statistically-based method to the augmented code snippet. The predicted candidate types of API elements are further used to improve the constraint-based method by reducing its pre-built knowledge base. iJTyper iteratively executes both methods and performs code context augmentation and knowledge base reduction until a termination condition is satisfied. Finally, the final inference results are obtained by combining the results of both methods. We evaluated iJTyper on two open-source datasets. Results show that 1) iJTyper achieves high average precision/recall of 97.31

Microservice-based systems often suffer from reliability issues due to their intricate interactions and expanding scale. With the rapid growth of observability techniques, various methods have been proposed to achieve failure diagnosis, including root cause localization and failure type identification, by leveraging diverse monitoring data such as logs, metrics, or traces. However, traditional failure diagnosis methods that use single-modal data can hardly cover all failure scenarios due to the restricted information. Several failure diagnosis methods have been recently proposed to integrate multimodal data based on deep learning. These methods, however, tend to combine modalities indiscriminately and treat them equally in failure diagnosis, ignoring the relationship between specific modalities and different diagnostic tasks. This oversight hinders the effective utilization of the unique advantages offered by each modality. To address the limitation, we propose TVDiag, a multimodal failure diagnosis framework for locating culprit microservice instances and identifying their failure types (e.g., Net-packets Corruption) in microservice-based systems. TVDiag employs task-oriented learning to enhance the potential advantages of each modality and establishes cross-modal associations based on contrastive learning to extract view-invariant failure information. Furthermore, we develop a graph-level data augmentation strategy that randomly inactivates the observability of some normal microservice instances during training to mitigate the shortage of training data. Experimental results show that TVDiag outperforms state-of-the-art methods in multimodal failure diagnosis, achieving at least a 55.94% higher HR@1 accuracy and over a 4.08% increase in F1-score across two datasets.

Symbolic execution has proven effective for code analytics in smart contracts. However, for smart contracts, existing symbolic tools use multiple-transaction symbolic execution, which differs from traditional symbolic tools and also exacerbates the path explosion problem. In this paper, we first quantitatively analyze the bottleneck of symbolic execution in multiple transactions (TXs), finding the redundancy of the paths of TXs. Based on this finding, we propose LENT-SSE as a new speculation heuristic for Speculative Symbolic Execution of smart contracts, which leverages the executed and near TXs for skipping and recalling the SMT solving of paths. LENT-SSE uses an executed-transaction-based skipping algorithm to reduce the time required for SMT solving by leveraging the redundancy between executed and executing paths. Moreover, LENT-SSE uses a near-transaction-based recalling algorithm to reduce false skipping of the solving paths. Experimental results on the SmartBugs dataset show that LENT-SSE can reduce the total time by 37.4% and the solving time of paths by 65.2% on average without reducing the reported bugs. On the other dataset of 1000 realistic contracts, the total time and solving time are reduced by 38.1% and 54.7%.

With the development of cloud-native technologies, microservice-based software systems face challenges in accurately localizing root causes when failures occur. Additionally, the cloud-edge collaborative environment introduces more difficulties, such as unstable networks and high latency across network segments. Accurately identifying the root cause of microservices in a cloud-edge collaborative environment has thus become an urgent problem. In this paper, we propose MicroCERCL, a novel approach that pinpoints root causes at the kernel and application level in the cloud-edge collaborative environment. Our key insight is that failures propagate through direct invocations and indirect resource-competition dependencies in a cloud-edge collaborative environment characterized by instability and high latency. This will become more complex in the hybrid deployment that simultaneously involves multiple microservice systems. Leveraging this insight, we extract valid contents from kernel-level logs to prioritize localizing the kernel-level root cause. Moreover, we construct a heterogeneous dynamic topology stack and train a graph neural network model to accurately localize the application-level root cause without relying on historical data. Notably, we released the first benchmark hybrid deployment microservice system in a cloud-edge collaborative environment (the largest and most complex within our knowledge). Experiments conducted on the dataset collected from the benchmark show that MicroCERCL can accurately localize the root cause of microservice systems in such environments, significantly outperforming state-of-the-art approaches with an increase of at least 24.1% in top-1 accuracy.

Abstract syntax tree (AST) mapping algorithms are widely used to locate the code changes in a file revision by mapping the AST nodes of the source code before and after the code changes. A recent differential testing of three state-of- the-art AST mapping algorithms, i.e., GumTree, MTDiff, and IJM, reveals that the algorithms generate inaccurate mappings for a considerable number of file revisions. We find that the inaccurate mappings could be caused by the mutual influence: the mappings of lower-level AST nodes (e.g., tokens) have impacts on the mappings of higher-level AST nodes (e.g., statements) and vice versa. This mutual influence issue is rarely considered by existing algorithms. In this paper, we propose an algorithm, called iASTMapper, that iteratively map two ASTs based on the similarities between AST nodes. Given a file revision, we extract three types of AST nodes in different levels of program structures (i.e., tokens, statements, and inner-statements) from the ASTs of the two source code files. We first build mappings of the unchanged statements and inner-statements. Then, we use an iterative method to map the rest of the nodes without mapping. For each of the three types of nodes, we iteratively map the nodes based on their similarities measured using heuristic rules. We further use an iterative mechanism to connect the three iterative mapping processes by considering the mutual influence between the mappings of different types of nodes. Finally, a series of code edit actions are generated from the node mappings to help users understand and locate the code changes during revisions. We conduct experiments to compare iASTMapper with three baselines, i.e., GumTree, MTDiff, and IJM, by automatically evaluating 210,997 file revisions from ten Java projects. Furthermore, we manually evaluate the correctness of the code edit actions generated for 200 file revisions with 12 evaluators. The results demonstrate that iASTMapper outperforms the baselines. iASTMapper can generate shorter code edit actions by at least 1.29% than the baselines, with a high accuracy of 96.23%.

With the increasing adoption of services-oriented computing and cloud computing technologies, web APIs have become the fundamental building blocks for constructing software applications. Web APIs are developed and published on the internet. The functionality of web APIs can be used to facilitate the development of software applications. There are numerous studies on retrieving and recommending candidate web APIs based on user requirements from a large set of web APIs. However, there are very limited studies on the features of web APIs that make them more likely to be used and the issues of using web APIs in practice. Moreover, users' expectations on the development and management of web APIs are rarely investigated. In this paper, we conduct a large-scale empirical study of 20,047 web APIs published at two popular and publicly accessible web API registries: ProgrammableWeb and APIs.guru. We first extract the questions posted in Stack Overflow (SO) that are relevant to the web APIs. We then manually analyze 1,885 randomly sampled SO questions and identify 24 web API issue types (e.g., authorization error ) that are encountered by users. Afterwards, we conduct a user survey to investigate the features of web APIs that users often consider when shortlisting a web API for testing before they adopt it, validate the identified types of web API issues, and understand users' expectations on the development and management of web APIs. From the 191 received responses, we extract 14 important features for users to decide whether to use a web API (e.g., well-organized documentation ). We also gain a better understanding of web API issue types and summarize 11 categories of user expectations on web APIs (e.g., documentation and SDK/library ). As the result of our study, we provide guidelines for web API developers and registry managers to improve web APIs and promote the use of web APIs.