Browse the Knowledge Hub56 resources
Test cases
Subscription test cases, for the invoice that nobody can explain
Twenty eight cases covering mid cycle proration across months of different lengths, duplicate and out of order webhooks, renewal double charges, dunning and grace periods, trial conversion and abuse, cancellation and reactivation, coupon rules, metered usage boundaries, seat limits, refunds and tax.
All 28 test cases, ready to copy
Free to use and adapt, no sign-up. Download as CSV or Markdown, or copy it straight into your own tooling.
Last updated
28 worked examples
Subscribe to a paid plan and grant entitlement
TypeFunctionalPriorityHigh- Test data
- A new customer selecting a monthly plan with a valid payment method
- Expected result
- Payment is taken, the subscription becomes active, entitlement is granted immediately, and an invoice is issued matching the amount charged.
Grant entitlement only after the payment succeeds
TypeStatePriorityHigh- Test data
- Force the payment to be declined at the provider
- Expected result
- No entitlement is granted and no partially active subscription is left behind. Granting on submission rather than on confirmation gives away the product.
Avoid a double charge when checkout is retried
TypeSecurityPriorityHigh- Test data
- Press subscribe repeatedly, then replay the checkout request
- Expected result
- Exactly one charge and one subscription. The provider idempotency key is generated before the first attempt and reused on every retry.
Handle a provider webhook delivered twice
TypeStatePriorityHigh- Test data
- Replay a payment succeeded webhook for the same event identifier
- Expected result
- Processed once. Webhooks are retried by design, so handlers must be idempotent on the event identifier rather than assuming a single delivery.
Handle webhooks arriving out of order
TypeStatePriorityHigh- Test data
- Deliver a subscription updated event before the subscription created event
- Expected result
- Final state is correct regardless of arrival order, using the event timestamp or a version rather than applying whichever arrived last.
Reject a webhook with an invalid signature
TypeSecurityPriorityHigh- Test data
- An unsigned request, a wrong signature and a valid signature replayed past its tolerance window
- Expected result
- All refused. An unauthenticated webhook endpoint lets anyone grant themselves a paid subscription.
Prorate an upgrade taken mid cycle
TypeBoundaryPriorityHigh- Test data
- Upgrade on day 15 of a 30 day cycle from a lower to a higher priced plan
- Expected result
- Charge equals the unused portion of the old plan credited against the remainder of the new one, to the minor unit, and the higher entitlement applies immediately.
Handle a downgrade taken mid cycle
TypeBoundaryPriorityHigh- Test data
- Downgrade on day 15 of a 30 day cycle
- Expected result
- Documented rule is applied consistently, whether that is an immediate credit or a change at renewal, and the customer is told which before confirming.
Prorate correctly across months of different lengths
TypeBoundaryPriorityHigh- Test data
- A mid cycle change in a 28 day February and in a 31 day month
- Expected result
- Daily rate is derived from the actual cycle length, so the proration is exact rather than assuming a 30 day month.
Renew a subscription on the correct date
TypeBoundaryPriorityHigh- Test data
- A subscription started on the 31st renewing into a 30 day month, and one started on 29 February
- Expected result
- Renewal falls on the documented adjusted day and does not drift forward every cycle thereafter.
Charge renewal once when the scheduler runs twice
TypeStatePriorityHigh- Test data
- Run the renewal job twice for the same billing period
- Expected result
- One charge and one invoice. A billing job without a period guard will double charge every customer the first time it is retried.
Enter dunning when a renewal payment fails
TypeStatePriorityHigh- Test data
- Decline the renewal charge, then follow the retry schedule
- Expected result
- Subscription moves to past due rather than being cancelled immediately, retries follow the documented schedule, and the customer is notified each time.
Keep or remove access during the grace period as documented
TypeStatePriorityHigh- Test data
- A past due subscription inside the grace period and one past the end of it
- Expected result
- Access matches the stated policy in both cases, and removal at the end of grace is a single defined transition rather than an incidental side effect.
Recover a past due subscription when payment succeeds
TypeStatePriorityHigh- Test data
- Update the payment method on a past due subscription and retry
- Expected result
- Subscription returns to active, access is restored immediately, the billing date is set according to policy, and no duplicate charge is taken.
Handle an expiring or replaced payment method
TypeStatePriorityHigh- Test data
- A card expiring before the next renewal, and one replaced mid cycle
- Expected result
- Customer is warned ahead of renewal, the replacement is used at the next charge, and removing the only payment method on an active plan is refused.
Start and convert a free trial
TypeStatePriorityHigh- Test data
- A trial with no payment method, and one converting at the end of the trial
- Expected result
- Entitlement matches the trial tier, conversion charges on the correct date, and the trial does not silently extend when the conversion charge fails.
Prevent repeated trials on the same account
TypeSecurityPriorityHigh- Test data
- Cancel a trial and start another, then sign up again with an email alias
- Expected result
- Refused under the documented rule. Trial abuse checks apply to the account and payment method rather than to the email string alone.
Cancel a subscription and retain access to the paid date
TypeStatePriorityHigh- Test data
- Cancel mid cycle, then check access before and after the period end
- Expected result
- Access continues until the paid period ends unless the policy says otherwise, no further charge is taken, and the end date is stated at cancellation.
Reactivate a cancelled subscription before it lapses
TypeStatePriorityMedium- Test data
- Cancel, then reactivate before the period end, then after it
- Expected result
- Before the end resumes the same subscription with no new charge. After the end starts a new period, and the difference is explained to the customer.
Apply a coupon within its rules
TypeBoundaryPriorityHigh- Test data
- An expired coupon, one restricted to new customers used by an existing one, one at its redemption limit, and two coupons together
- Expected result
- Each refused with a specific reason, and stacking follows the documented rule rather than whichever order the codes were entered.
Apply a percentage discount to the correct base
TypeFunctionalPriorityHigh- Test data
- A percentage coupon on a plan with tax and a proration credit in the same invoice
- Expected result
- Discount applies to the documented base, tax is calculated on the discounted amount where the jurisdiction requires it, and the invoice total is internally consistent.
Bill metered usage at the period boundary
TypeBoundaryPriorityHigh- Test data
- Usage recorded one second before and one second after the period ends, and a late arriving usage record
- Expected result
- Each unit is billed in exactly one period, and a record arriving after the invoice is issued is handled by a documented rule rather than dropped.
Enforce seat and quota limits
TypeBoundaryPriorityHigh- Test data
- Add a seat at the plan limit, then add two seats concurrently at the limit
- Expected result
- Limit holds in both cases. A read then write on the seat count lets two concurrent additions exceed the plan.
Refund and credit correctly
TypeStatePriorityHigh- Test data
- A full refund, a partial refund, and a second partial refund that would exceed the original charge
- Expected result
- Amounts are exact, the cumulative refunded total cannot exceed the charge, and entitlement is adjusted according to policy rather than left untouched.
Calculate tax by customer location and status
TypeFunctionalPriorityHigh- Test data
- A domestic consumer, a business with a valid registration number, and one with an invalid number
- Expected result
- Correct treatment for each including reverse charge where applicable, and an invalid registration number is refused rather than accepted and zero rated.
Issue an invoice that reconciles exactly
TypeStatePriorityHigh- Test data
- An invoice containing a proration credit, a discount, metered usage and tax
- Expected result
- Line items sum to the total, the total equals the amount charged at the provider, and the same figures appear in the customer portal and in revenue reporting.
Handle a currency change and a failed provider call
TypeNegativePriorityMedium- Test data
- Attempt to change currency on an active subscription, and time out the provider mid checkout
- Expected result
- Currency change is refused or handled by a documented migration, and the timed out checkout resolves to one definite state with no orphaned subscription.
Complete checkout and plan changes with a keyboard and a screen reader
TypeAccessibilityPriorityMedium- Test data
- Keyboard only navigation through plan selection, payment fields and the confirmation dialogue
- Expected result
- Price and billing period are announced before confirmation, proration amounts are readable, and validation errors are announced and linked to their field.
What goes in each field
ID
RequiredStable identifier, prefixed by module.
Test case
RequiredWhat is being verified, in one line.
Type
Functional, negative, boundary, security, state, performance, accessibility or compatibility. Use it to check coverage is spread rather than clustered on the happy path.
Priority
Risk based, measured in revenue and in trust. Anything that charges the wrong amount, charges twice, grants entitlement without payment, or removes it while payment is current is High.
Test data
The specific values, including the invalid and boundary ones.
Expected result
RequiredThe precise observable outcome, including message text where the wording itself is the requirement.
Change the plan halfway through
Subscribing once with a good card proves the least interesting path works. These four conditions produce the billing complaints.
Upgrade on day 15 of 30
The charge should be the unused portion of the old plan credited against the remainder of the new one, to the minor unit. Then repeat it in February, where a hardcoded 30 day month is wrong.
Deliver the webhook twice
Providers retry by design. A handler that is not idempotent on the event identifier will grant entitlement twice, or charge twice, and the logs will look normal.
Run the renewal job twice
Without a guard on the billing period, the first time that job is retried you double charge every customer at once. This is the most expensive defect in the set.
Decline the renewal
The subscription should go past due and follow a documented retry schedule, not cancel outright. Then recover it and confirm no duplicate charge lands.
Why billing defects cost revenue
Proration is arithmetic that has to be exact and is usually approximate. The unused portion of the old plan credited against the remainder of the new one depends on the daily rate, and the daily rate depends on the actual length of the cycle. An implementation that assumes a thirty day month is wrong in February and wrong in every thirty one day month, by an amount small enough that nobody disputes it individually and large enough to matter across a customer base. The renewal date has the same problem from the other direction: a subscription started on the thirty first has to land somewhere in a thirty day month, and it must not drift forward every cycle afterwards.
Webhooks are the integration surface where subscription systems most often break, because the delivery guarantees are weaker than they appear. Providers retry, which means duplicate delivery is normal rather than exceptional, so every handler needs to be idempotent on the event identifier. Delivery order is not guaranteed either, so an updated event can arrive before the created event, and applying whichever arrived last produces a state that matches neither. And the endpoint has to verify the signature, because an unauthenticated webhook handler lets anyone grant themselves a paid subscription with a single request.
The renewal job is the highest cost defect in the set and the easiest to miss, because it only fires on a schedule. Without a guard that ties a charge to a billing period, the first time that job is retried after a partial failure it charges every active customer a second time. It is testable by simply running it twice, which almost no test suite does.
Finally, failure states need to be designed rather than inherited. A declined renewal should move the subscription to past due and follow a documented retry schedule, and the access policy during grace has to be an explicit decision rather than a side effect of how the entitlement check happens to be written. Recovery matters just as much: updating a payment method on a past due subscription must restore access immediately and must not take a second charge. Every one of these transitions is a place where a paying customer either loses access they have paid for or keeps access they have not.
Suggest an improvementTesting a SaaS billing system?
QAble tests subscription platforms end to end, including proration arithmetic, webhook idempotency, dunning transitions and reconciliation between the app, the provider and the invoice.
SaaS software testing servicesMore test case sets
View allTest cases for a login page
Test cases25 cases across functional, negative, boundary, security, session and accessibility paths, including account enumeration and lockout.Test cases for a registration form
Test cases28 cases covering validation, duplicate accounts, email verification, password rules and the enumeration leak most signup forms ship with.Test cases for search functionality
Test cases28 cases across relevance, partial and fuzzy matching, filters, pagination, empty states, injection attempts and performance under load.Test cases for a shopping cart
Test cases27 cases on quantity limits, price recalculation, stock changes, coupon stacking, guest to account merge and cart persistence.Test cases for checkout and payment
Test cases30 cases including 3D Secure, declines, timeouts, duplicate charges, idempotency, refunds and partial captures.Test cases for file upload
Test cases28 cases on size and type limits, spoofed content types, malicious filenames, progress, resume, virus scanning and storage limits.Test cases for forgot password
Test cases26 cases on reset token expiry, single use enforcement, session invalidation and the enumeration and rate limit gaps that are routine here.Test cases for OTP verification
Test cases26 cases on expiry, resend throttling, attempt limits, code reuse, delivery failure and the brute force window teams forget to close.Test cases for user roles and permissions
Test cases26 cases on horizontal and vertical privilege checks, direct object access, role changes mid-session and permission inheritance.Test cases for form validation
Test cases27 rules-based cases on required fields, length and numeric boundaries, client and server parity, hidden field tampering and error accessibility.Test cases for a date picker
Test cases26 cases on timezone shifts, ambiguous day and month order, impossible dates, min and max limits, leap years and keyboard operation.Test cases for pagination
Test cases24 cases on ordering stability, records changing mid-session, page size caps, deep offset cost, permission-filtered totals and state restore.Test cases for push notifications
Test cases26 cases on app states, deep link routing, token release on sign out, lock screen privacy, preferences, provider failures and platform differences.Test cases for reports and data export
Test cases25 cases on permission filtering in the file, spreadsheet formula injection, encoding, typed numbers and dates, row limits and audit logging.Test cases for a chatbot
Test cases28 cases on paraphrased intents, context, fallback loops, human handoff, policy grounding, prompt injection and data scoping.Test cases for net banking transactions
Test cases28 cases on duplicate debits from a retried request, concurrent transfers against one balance, daily limits across channels, beneficiary cooling periods, second factor binding and reconciliation.Test cases for wallet and UPI payments
Test cases28 cases on payments that time out with no response, idempotency on retry, racing balances, caps across devices, collect request fraud, mandates and refunds.Test cases for insurance claim submission
Test cases28 cases on coverage at the date of loss, waiting periods, deductibles and sub limits, exclusions and riders, duplicate claims and settlement reconciliation.Test cases for patient records in an EHR
Test cases28 cases on duplicate detection and merge, wrong patient entry, units of measure, allergy and interaction alerting, break glass access and audit of reads.Test cases for CRM lead management
Test cases28 cases on duplicate leads under concurrency, routing and the unrouted fallback, round robin races, territory visibility, conversion and bulk import.Test cases for an ERP purchase order
Test cases28 cases on approval thresholds, amendments that must reset approval, budget commitment races, over receipt tolerance, three-way match and duplicate invoices.Test cases for OTT video playback
Test cases28 cases on bitrate recovery after a dip, DRM renewal mid stream, concurrent stream limits and leaked slots, resume conflicts, ad cue points and offline expiry.Test cases for game level progression
Test cases28 cases on save corruption during a crash write, cloud save conflicts, offline queue replay, unlock gating, currency exploits and purchase restore.Test cases for a REST API
Test cases28 cases on status code correctness, cross tenant resource access, mass assignment, idempotent retries, cursor pagination, rate limits and contract drift.Test cases for SSO and social login
Test cases28 cases on linking an account on an unverified email, state and code replay, redirect allow lists, token signature and issuer, deprovisioning and session rotation.Test cases for data tables, filters and sorting
Test cases28 cases on unstable sorts across pages, filters that must reset pagination, selection surviving a filter change, bulk action scope and export fidelity.Test cases for session timeout and concurrent login
Test cases28 cases on tokens that survive sign out, refresh token reuse, idle against absolute lifetime, multi tab expiry, session limits and remote revocation.Test cases for a multi step form wizard
Test cases28 cases on values lost to back navigation, refresh and session expiry, step skipping, server side revalidation, duplicate submission and conditional branches.Test cases for email verification
Test cases28 cases on token reuse and expiry, invalidating earlier links, account enumeration, header injection, safe address change and mail scanner prefetching.Test cases for dashboards and analytics widgets
Test cases28 cases on reconciling against source rows, widgets that disagree, timezone aggregation, zero baselines, no data shown as zero and permission leaks in aggregates.Test cases for booking and reservation
Test cases28 cases on concurrent bookings for the last slot, inventory holds that leak, payment without a booking, cancellation boundaries and channel sync.Test cases for mobile app install and update
Test cases28 cases on migration chains across skipped versions, crashes during post upgrade migration, forced update lockouts, deep links and clean reinstall.Test cases for accessibility (WCAG 2.2 AA)
Test cases28 cases on keyboard only completion, focus management, live region announcements, contrast, reflow at 320 pixels, target size and screen reader verification.Test cases for performance and load
Test cases28 cases on spikes with no ramp, recovery after peak, soak and leak detection, pool exhaustion, cold caches, retry storms and data correctness under load.Test cases for the OWASP Top 10
Test cases28 cases on broken access control, mass assignment, injection across every input surface, credential stuffing, session invalidation, SSRF and exposed secrets.Test cases for cross browser compatibility
Test cases28 cases on storage that throws in private mode, blocked third party cookies, engine date parsing, mobile viewport units, in app browsers and ad blockers.Test cases for database and data integrity
Test cases28 cases on uniqueness under concurrency, lost updates, counter races, orphaned rows, migration and backfill safety, replica lag and verified restores.Test cases for localisation and multi language support
Test cases28 cases on text expansion, concatenated sentences, plural rules, locale date parsing, decimal separators, right to left layout, collation and encoding.Want your billing arithmetic proven, not assumed?
QAble covers functional, boundary and security paths with ISTQB-certified engineers. Start with a free QA audit of your platform.