View all services
Talk to QA Advisor
Browse the Knowledge Hub56 resources
/Test Cases/Subscription and billing test cases

Test cases

Subscription test cases, for the invoice that nobody can explain

Twenty eight cases covering mid cycle proration across months of different lengths, duplicate and out of order webhooks, renewal double charges, dunning and grace periods, trial conversion and abuse, cancellation and reactivation, coupon rules, metered usage boundaries, seat limits, refunds and tax.

28cases/8coverage types/9boundary cases/FreeCSV download

All 28 test cases, ready to copy

Free to use and adapt, no sign-up. Download as CSV or Markdown, or copy it straight into your own tooling.

Last updated

28 worked examples

SUB-01

Subscribe to a paid plan and grant entitlement

TypeFunctionalPriorityHigh
Test data
A new customer selecting a monthly plan with a valid payment method
Expected result
Payment is taken, the subscription becomes active, entitlement is granted immediately, and an invoice is issued matching the amount charged.
SUB-02

Grant entitlement only after the payment succeeds

TypeStatePriorityHigh
Test data
Force the payment to be declined at the provider
Expected result
No entitlement is granted and no partially active subscription is left behind. Granting on submission rather than on confirmation gives away the product.
SUB-03

Avoid a double charge when checkout is retried

TypeSecurityPriorityHigh
Test data
Press subscribe repeatedly, then replay the checkout request
Expected result
Exactly one charge and one subscription. The provider idempotency key is generated before the first attempt and reused on every retry.
SUB-04

Handle a provider webhook delivered twice

TypeStatePriorityHigh
Test data
Replay a payment succeeded webhook for the same event identifier
Expected result
Processed once. Webhooks are retried by design, so handlers must be idempotent on the event identifier rather than assuming a single delivery.
SUB-05

Handle webhooks arriving out of order

TypeStatePriorityHigh
Test data
Deliver a subscription updated event before the subscription created event
Expected result
Final state is correct regardless of arrival order, using the event timestamp or a version rather than applying whichever arrived last.
SUB-06

Reject a webhook with an invalid signature

TypeSecurityPriorityHigh
Test data
An unsigned request, a wrong signature and a valid signature replayed past its tolerance window
Expected result
All refused. An unauthenticated webhook endpoint lets anyone grant themselves a paid subscription.
SUB-07

Prorate an upgrade taken mid cycle

TypeBoundaryPriorityHigh
Test data
Upgrade on day 15 of a 30 day cycle from a lower to a higher priced plan
Expected result
Charge equals the unused portion of the old plan credited against the remainder of the new one, to the minor unit, and the higher entitlement applies immediately.
SUB-08

Handle a downgrade taken mid cycle

TypeBoundaryPriorityHigh
Test data
Downgrade on day 15 of a 30 day cycle
Expected result
Documented rule is applied consistently, whether that is an immediate credit or a change at renewal, and the customer is told which before confirming.
SUB-09

Prorate correctly across months of different lengths

TypeBoundaryPriorityHigh
Test data
A mid cycle change in a 28 day February and in a 31 day month
Expected result
Daily rate is derived from the actual cycle length, so the proration is exact rather than assuming a 30 day month.
SUB-10

Renew a subscription on the correct date

TypeBoundaryPriorityHigh
Test data
A subscription started on the 31st renewing into a 30 day month, and one started on 29 February
Expected result
Renewal falls on the documented adjusted day and does not drift forward every cycle thereafter.
SUB-11

Charge renewal once when the scheduler runs twice

TypeStatePriorityHigh
Test data
Run the renewal job twice for the same billing period
Expected result
One charge and one invoice. A billing job without a period guard will double charge every customer the first time it is retried.
SUB-12

Enter dunning when a renewal payment fails

TypeStatePriorityHigh
Test data
Decline the renewal charge, then follow the retry schedule
Expected result
Subscription moves to past due rather than being cancelled immediately, retries follow the documented schedule, and the customer is notified each time.
SUB-13

Keep or remove access during the grace period as documented

TypeStatePriorityHigh
Test data
A past due subscription inside the grace period and one past the end of it
Expected result
Access matches the stated policy in both cases, and removal at the end of grace is a single defined transition rather than an incidental side effect.
SUB-14

Recover a past due subscription when payment succeeds

TypeStatePriorityHigh
Test data
Update the payment method on a past due subscription and retry
Expected result
Subscription returns to active, access is restored immediately, the billing date is set according to policy, and no duplicate charge is taken.
SUB-15

Handle an expiring or replaced payment method

TypeStatePriorityHigh
Test data
A card expiring before the next renewal, and one replaced mid cycle
Expected result
Customer is warned ahead of renewal, the replacement is used at the next charge, and removing the only payment method on an active plan is refused.
SUB-16

Start and convert a free trial

TypeStatePriorityHigh
Test data
A trial with no payment method, and one converting at the end of the trial
Expected result
Entitlement matches the trial tier, conversion charges on the correct date, and the trial does not silently extend when the conversion charge fails.
SUB-17

Prevent repeated trials on the same account

TypeSecurityPriorityHigh
Test data
Cancel a trial and start another, then sign up again with an email alias
Expected result
Refused under the documented rule. Trial abuse checks apply to the account and payment method rather than to the email string alone.
SUB-18

Cancel a subscription and retain access to the paid date

TypeStatePriorityHigh
Test data
Cancel mid cycle, then check access before and after the period end
Expected result
Access continues until the paid period ends unless the policy says otherwise, no further charge is taken, and the end date is stated at cancellation.
SUB-19

Reactivate a cancelled subscription before it lapses

TypeStatePriorityMedium
Test data
Cancel, then reactivate before the period end, then after it
Expected result
Before the end resumes the same subscription with no new charge. After the end starts a new period, and the difference is explained to the customer.
SUB-20

Apply a coupon within its rules

TypeBoundaryPriorityHigh
Test data
An expired coupon, one restricted to new customers used by an existing one, one at its redemption limit, and two coupons together
Expected result
Each refused with a specific reason, and stacking follows the documented rule rather than whichever order the codes were entered.
SUB-21

Apply a percentage discount to the correct base

TypeFunctionalPriorityHigh
Test data
A percentage coupon on a plan with tax and a proration credit in the same invoice
Expected result
Discount applies to the documented base, tax is calculated on the discounted amount where the jurisdiction requires it, and the invoice total is internally consistent.
SUB-22

Bill metered usage at the period boundary

TypeBoundaryPriorityHigh
Test data
Usage recorded one second before and one second after the period ends, and a late arriving usage record
Expected result
Each unit is billed in exactly one period, and a record arriving after the invoice is issued is handled by a documented rule rather than dropped.
SUB-23

Enforce seat and quota limits

TypeBoundaryPriorityHigh
Test data
Add a seat at the plan limit, then add two seats concurrently at the limit
Expected result
Limit holds in both cases. A read then write on the seat count lets two concurrent additions exceed the plan.
SUB-24

Refund and credit correctly

TypeStatePriorityHigh
Test data
A full refund, a partial refund, and a second partial refund that would exceed the original charge
Expected result
Amounts are exact, the cumulative refunded total cannot exceed the charge, and entitlement is adjusted according to policy rather than left untouched.
SUB-25

Calculate tax by customer location and status

TypeFunctionalPriorityHigh
Test data
A domestic consumer, a business with a valid registration number, and one with an invalid number
Expected result
Correct treatment for each including reverse charge where applicable, and an invalid registration number is refused rather than accepted and zero rated.
SUB-26

Issue an invoice that reconciles exactly

TypeStatePriorityHigh
Test data
An invoice containing a proration credit, a discount, metered usage and tax
Expected result
Line items sum to the total, the total equals the amount charged at the provider, and the same figures appear in the customer portal and in revenue reporting.
SUB-27

Handle a currency change and a failed provider call

TypeNegativePriorityMedium
Test data
Attempt to change currency on an active subscription, and time out the provider mid checkout
Expected result
Currency change is refused or handled by a documented migration, and the timed out checkout resolves to one definite state with no orphaned subscription.
SUB-28

Complete checkout and plan changes with a keyboard and a screen reader

TypeAccessibilityPriorityMedium
Test data
Keyboard only navigation through plan selection, payment fields and the confirmation dialogue
Expected result
Price and billing period are announced before confirmation, proration amounts are readable, and validation errors are announced and linked to their field.

What goes in each field

ID

Required

Stable identifier, prefixed by module.

Test case

Required

What is being verified, in one line.

Type

Functional, negative, boundary, security, state, performance, accessibility or compatibility. Use it to check coverage is spread rather than clustered on the happy path.

Priority

Risk based, measured in revenue and in trust. Anything that charges the wrong amount, charges twice, grants entitlement without payment, or removes it while payment is current is High.

Test data

The specific values, including the invalid and boundary ones.

Expected result

Required

The precise observable outcome, including message text where the wording itself is the requirement.

How To Use This

Change the plan halfway through

Subscribing once with a good card proves the least interesting path works. These four conditions produce the billing complaints.

Upgrade on day 15 of 30

The charge should be the unused portion of the old plan credited against the remainder of the new one, to the minor unit. Then repeat it in February, where a hardcoded 30 day month is wrong.

Deliver the webhook twice

Providers retry by design. A handler that is not idempotent on the event identifier will grant entitlement twice, or charge twice, and the logs will look normal.

Run the renewal job twice

Without a guard on the billing period, the first time that job is retried you double charge every customer at once. This is the most expensive defect in the set.

Decline the renewal

The subscription should go past due and follow a documented retry schedule, not cancel outright. Then recover it and confirm no duplicate charge lands.

What Most Sets Miss

Why billing defects cost revenue

Proration is arithmetic that has to be exact and is usually approximate. The unused portion of the old plan credited against the remainder of the new one depends on the daily rate, and the daily rate depends on the actual length of the cycle. An implementation that assumes a thirty day month is wrong in February and wrong in every thirty one day month, by an amount small enough that nobody disputes it individually and large enough to matter across a customer base. The renewal date has the same problem from the other direction: a subscription started on the thirty first has to land somewhere in a thirty day month, and it must not drift forward every cycle afterwards.

Webhooks are the integration surface where subscription systems most often break, because the delivery guarantees are weaker than they appear. Providers retry, which means duplicate delivery is normal rather than exceptional, so every handler needs to be idempotent on the event identifier. Delivery order is not guaranteed either, so an updated event can arrive before the created event, and applying whichever arrived last produces a state that matches neither. And the endpoint has to verify the signature, because an unauthenticated webhook handler lets anyone grant themselves a paid subscription with a single request.

The renewal job is the highest cost defect in the set and the easiest to miss, because it only fires on a schedule. Without a guard that ties a charge to a billing period, the first time that job is retried after a partial failure it charges every active customer a second time. It is testable by simply running it twice, which almost no test suite does.

Finally, failure states need to be designed rather than inherited. A declined renewal should move the subscription to past due and follow a documented retry schedule, and the access policy during grace has to be an explicit decision rather than a side effect of how the entitlement check happens to be written. Recovery matters just as much: updating a payment method on a past due subscription must restore access immediately and must not take a second charge. Every one of these transitions is a place where a paying customer either loses access they have paid for or keeps access they have not.

Suggest an improvement

Testing a SaaS billing system?

QAble tests subscription platforms end to end, including proration arithmetic, webhook idempotency, dunning transitions and reconciliation between the app, the provider and the invoice.

SaaS software testing services

More test case sets

View all

Test cases for a login page

Test cases
25 cases across functional, negative, boundary, security, session and accessibility paths, including account enumeration and lockout.

Test cases for a registration form

Test cases
28 cases covering validation, duplicate accounts, email verification, password rules and the enumeration leak most signup forms ship with.

Test cases for search functionality

Test cases
28 cases across relevance, partial and fuzzy matching, filters, pagination, empty states, injection attempts and performance under load.

Test cases for a shopping cart

Test cases
27 cases on quantity limits, price recalculation, stock changes, coupon stacking, guest to account merge and cart persistence.

Test cases for checkout and payment

Test cases
30 cases including 3D Secure, declines, timeouts, duplicate charges, idempotency, refunds and partial captures.

Test cases for file upload

Test cases
28 cases on size and type limits, spoofed content types, malicious filenames, progress, resume, virus scanning and storage limits.

Test cases for forgot password

Test cases
26 cases on reset token expiry, single use enforcement, session invalidation and the enumeration and rate limit gaps that are routine here.

Test cases for OTP verification

Test cases
26 cases on expiry, resend throttling, attempt limits, code reuse, delivery failure and the brute force window teams forget to close.

Test cases for user roles and permissions

Test cases
26 cases on horizontal and vertical privilege checks, direct object access, role changes mid-session and permission inheritance.

Test cases for form validation

Test cases
27 rules-based cases on required fields, length and numeric boundaries, client and server parity, hidden field tampering and error accessibility.

Test cases for a date picker

Test cases
26 cases on timezone shifts, ambiguous day and month order, impossible dates, min and max limits, leap years and keyboard operation.

Test cases for pagination

Test cases
24 cases on ordering stability, records changing mid-session, page size caps, deep offset cost, permission-filtered totals and state restore.

Test cases for push notifications

Test cases
26 cases on app states, deep link routing, token release on sign out, lock screen privacy, preferences, provider failures and platform differences.

Test cases for reports and data export

Test cases
25 cases on permission filtering in the file, spreadsheet formula injection, encoding, typed numbers and dates, row limits and audit logging.

Test cases for a chatbot

Test cases
28 cases on paraphrased intents, context, fallback loops, human handoff, policy grounding, prompt injection and data scoping.

Test cases for net banking transactions

Test cases
28 cases on duplicate debits from a retried request, concurrent transfers against one balance, daily limits across channels, beneficiary cooling periods, second factor binding and reconciliation.

Test cases for wallet and UPI payments

Test cases
28 cases on payments that time out with no response, idempotency on retry, racing balances, caps across devices, collect request fraud, mandates and refunds.

Test cases for insurance claim submission

Test cases
28 cases on coverage at the date of loss, waiting periods, deductibles and sub limits, exclusions and riders, duplicate claims and settlement reconciliation.

Test cases for patient records in an EHR

Test cases
28 cases on duplicate detection and merge, wrong patient entry, units of measure, allergy and interaction alerting, break glass access and audit of reads.

Test cases for CRM lead management

Test cases
28 cases on duplicate leads under concurrency, routing and the unrouted fallback, round robin races, territory visibility, conversion and bulk import.

Test cases for an ERP purchase order

Test cases
28 cases on approval thresholds, amendments that must reset approval, budget commitment races, over receipt tolerance, three-way match and duplicate invoices.

Test cases for OTT video playback

Test cases
28 cases on bitrate recovery after a dip, DRM renewal mid stream, concurrent stream limits and leaked slots, resume conflicts, ad cue points and offline expiry.

Test cases for game level progression

Test cases
28 cases on save corruption during a crash write, cloud save conflicts, offline queue replay, unlock gating, currency exploits and purchase restore.

Test cases for a REST API

Test cases
28 cases on status code correctness, cross tenant resource access, mass assignment, idempotent retries, cursor pagination, rate limits and contract drift.

Test cases for SSO and social login

Test cases
28 cases on linking an account on an unverified email, state and code replay, redirect allow lists, token signature and issuer, deprovisioning and session rotation.

Test cases for data tables, filters and sorting

Test cases
28 cases on unstable sorts across pages, filters that must reset pagination, selection surviving a filter change, bulk action scope and export fidelity.

Test cases for session timeout and concurrent login

Test cases
28 cases on tokens that survive sign out, refresh token reuse, idle against absolute lifetime, multi tab expiry, session limits and remote revocation.

Test cases for a multi step form wizard

Test cases
28 cases on values lost to back navigation, refresh and session expiry, step skipping, server side revalidation, duplicate submission and conditional branches.

Test cases for email verification

Test cases
28 cases on token reuse and expiry, invalidating earlier links, account enumeration, header injection, safe address change and mail scanner prefetching.

Test cases for dashboards and analytics widgets

Test cases
28 cases on reconciling against source rows, widgets that disagree, timezone aggregation, zero baselines, no data shown as zero and permission leaks in aggregates.

Test cases for booking and reservation

Test cases
28 cases on concurrent bookings for the last slot, inventory holds that leak, payment without a booking, cancellation boundaries and channel sync.

Test cases for mobile app install and update

Test cases
28 cases on migration chains across skipped versions, crashes during post upgrade migration, forced update lockouts, deep links and clean reinstall.

Test cases for accessibility (WCAG 2.2 AA)

Test cases
28 cases on keyboard only completion, focus management, live region announcements, contrast, reflow at 320 pixels, target size and screen reader verification.

Test cases for performance and load

Test cases
28 cases on spikes with no ramp, recovery after peak, soak and leak detection, pool exhaustion, cold caches, retry storms and data correctness under load.

Test cases for the OWASP Top 10

Test cases
28 cases on broken access control, mass assignment, injection across every input surface, credential stuffing, session invalidation, SSRF and exposed secrets.

Test cases for cross browser compatibility

Test cases
28 cases on storage that throws in private mode, blocked third party cookies, engine date parsing, mobile viewport units, in app browsers and ad blockers.

Test cases for database and data integrity

Test cases
28 cases on uniqueness under concurrency, lost updates, counter races, orphaned rows, migration and backfill safety, replica lag and verified restores.

Test cases for localisation and multi language support

Test cases
28 cases on text expansion, concatenated sentences, plural rules, locale date parsing, decimal separators, right to left layout, collation and encoding.

Want your billing arithmetic proven, not assumed?

QAble covers functional, boundary and security paths with ISTQB-certified engineers. Start with a free QA audit of your platform.

Talk to QA Advisor