APIFlow-Bench: Measuring Whether Agents Survive Long, Dependent API Workflows
Organizations: Postman, Inc.
Abstract
Tool-using agents are commonly evaluated by a single bit: whether an end-to-end workflow completed. This metric fails to distinguish failures that matter in production, such as expired credentials, malformed payloads, or correct execution followed by incorrect final delivery. We introduce APIFlow-Bench, a fully auditable benchmark for long-horizon, dependent REST-API workflows that decomposes performance into seven engineering capabilities and requires agents to produce answers supported by the actual call path. We generate synthetic API worlds forward, subtask by subtask; each subtask is admitted only after a zero-LLM self-test triad verifies its grader and an oracle establishes solvability, and an adversarial audit identified and fixed six grader exploits. Grading is deterministic and provenance-sensitive: a state check traces a mock-minted canary through the API data flow to the response the answer must originate from, and a typed answer card is verified field by field. We release all answer keys and 44,362 unredacted execution transcripts. Across 19 frontier and open-weight models under one neutral scaffold, we find: (1) longer dependency chains degrade success, from 93% on individual subtasks to 74% on clean 20-subtask chains and 61% when including the 8% of chain trials that a model-consensus screen flags as passed by no model; (2) reliability separates models more than best-case capability, with best-of-five spanning seven points but all-five-of-five reliability spanning 44 points; (3) the independent-error account of compounding failure does not fit the data: pass rates on 20-subtask chains are 33 percentage points above the product of subtask-level rates, and on the clean slice 77% of failing runs reached the correct final state and failed only at delivery.
Figures & tables
Appendix figures & tables9 assets
Supplementary material from the paper’s appendix.
Appendix
| Benchmark | stateful chain | end state / side effect | auth refresh | pagination to end | schema repair |
| AppWorld [ Trivedi et al., 2024 ] | ✓ | ✓ | ✗ | ✓ | |
| -bench [ Yao et al., 2025 ] | ✓ | ✓ | ✗ | ✗ | ✗ |
| BFCL v3 [ Patil et al., 2025 ] | ✓ | ✗ | ✗ | ✗ | |
| SWE-bench [ Jimenez et al., 2024 ] | ✓ | ✓ | ✗ | ✗ | ✗ |
| APIFlow-Bench (this work) | ✓ | ✓ | ✓ | ✓ | ✓ |
| Axis | What it tests | Pass | Pass (excl. flagged) | |
| multistep | carry state across calls | 91.2 | 92.6 | 6,457 |
| schema | repair a rejected body | 88.9 | 92.0 | 5,604 |
| statefulness | confirm the side effect | 88.4 | 90.8 | 7,215 |
| pagination | walk to the last page | 87.8 | 89.6 | 4,840 |
| error recovery | back off and retry | 84.6 | 89.3 | 7,217 |
| authentication | refresh a token mid-session | 80.7 | 86.1 | 6,078 |
| Model | All | Solo | Chain-5 | Chain-10 | Chain-15 | Chain-20 (90% CI) | $/trial |
| gpt-5.5 | 87.8 | 94.9 | 92.3 | 75.0 | 72.7 | 72.7 [45.5, 90.9] | 0.170 |
| claude-opus-4-8 | 88.6 | 96.0 | 92.3 | 68.3 | 72.7 | 69.1 [45.5, 90.9] | 0.086 |
| deepseek-v4-flash | 88.4 | 95.6 | 98.5 | 75.0 | 70.9 | 69.1 [47.3, 89.1] | 0.008 |
| glm-5p2 | 87.1 | 93.9 | 92.3 | 75.0 | 74.5 | 65.5 [40.0, 85.5] | 0.079 |
| qwen3p7-plus | 86.2 | 94.0 | 90.8 | 73.3 | 68.5 | 65.5 [40.0, 85.5] | 0.039 |
| claude-haiku-4-5 | 86.0 | 92.9 | 96.9 | 75.0 | 58.2 | 63.6 [36.4, 81.8] | 0.022 |
| Axis | Class | The exploit | The fix |
| schema | false neg. | a creation POST returns 201 while the check pinned 200, rejecting the minimal correct solve | accept the real success code ( [200,201] ) |
| schema | false pos. | the graded value was echoable (present in a payload the agent could copy without fetching it) | remove the echo; pin a distinct canary the mock serves only on the real path |
| statefulness | false neg. | a currency comparator demanded a USD unit the agent had no source for, rejecting correct numbers | grade numerically; stop forcing a hallucinated unit |
| pagination | false pos. | the total was also served on a summary endpoint, making the task passable without paging | remove the leak; a terminal-page marker forces the full walk |
| multistep | false pos. | the final canary was reachable by guessing a single URL, skipping the chain | gate the value behind stateful mock logic and a non-guessable id |
| multistep | false pos. | a value was readable before the publish step that was supposed to produce it | gate the read on the publish; add chain-level state checks |
Tool-Use Evaluation
Tool-use evaluation measures whether AI agents select, call, and rely on tools correctly, efficiently, and safely across realistic tasks.
See all 99 papers