Test scenarios
Precium S2S Testing Checklist
This document provides a comprehensive testing checklist to ensure your integration handles all payment scenarios correctly before going live.
Pre-Testing Setup
Before running tests, ensure you have:
- Sandbox API credentials configured
- Standard API Key and S2S API Key available
- Brand ID configured for sandbox
- Webhook endpoint deployed and accessible
- Logging enabled for all API calls and responses
- Test card numbers ready (see Test Cards Reference below)
Test Categories Overview
| Category | Tests | Priority |
|---|---|---|
| Happy Path | 8 | Critical |
| Pre-Authorization & Capture | 6 | Critical |
| Void/Cancel Operations | 4 | High |
| Refund Scenarios | 5 | High |
| Error Handling | 12 | Critical |
| 3DS Scenarios | 5 | Critical |
| Webhook Integration | 8 | Critical |
| Edge Cases | 7 | Medium |
| External Integrations | 4 | Conditional |
| Security & Compliance | 6 | Critical |
Total: 65 test cases
1. Happy Path Tests
1.1 Standard CIT Payment with Internal 3DS
Test Card:4000000000001091 (3DS required)
| Step | Action | Expected Result |
|---|---|---|
| 1 | Create client | Returns client ID |
| 2 | Create purchase (amount: 10000, force_recurring: true) | Returns purchase ID and direct_post_url |
| 3 | Submit card data with browser fingerprint | Returns 3DS parameters or ready status |
| 4 | Complete 3DS challenge | Redirects to callback URL |
| 5 | POST to callback with MD and PaRes | Returns success |
| 6 | Verify purchase status | Status: "paid" |
| 7 | Check for token | payment_method_details.card.token present |
| 8 | Check for network_transaction_id | Value present for MIT use |
1.2 Standard CIT Payment without 3DS Challenge
Test Card:4000000000001000 (No 3DS)
| Step | Action | Expected Result |
|---|---|---|
| 1 | Create client | Returns client ID |
| 2 | Create purchase | Returns purchase ID |
| 3 | Submit card data | No 3DS parameters returned |
| 4 | Charge purchase | Status: "paid" |
1.3 Zero Authorization (Card Validation)
Test Card:4000000000001091
| Step | Action | Expected Result |
|---|---|---|
| 1 | Create client | Returns client ID |
| 2 | Create purchase with amount: 0 | Returns purchase ID |
| 3 | Submit card data | 3DS flow initiated |
| 4 | Complete 3DS | Success |
| 5 | Verify no charge | Amount authorized: 0 |
| 6 | Verify token generated | Token present (if force_recurring: true) |
1.4 MIT Recurring Charge
Prerequisite: Completed CIT with token stored
| Step | Action | Expected Result |
|---|---|---|
| 1 | Create MIT purchase with token reference | Returns purchase ID |
| 2 | Include previous_network_transaction_id | Accepted |
| 3 | Include original_amount_cents | Accepted |
| 4 | Submit with stored token (no CVV) | Ready for charge |
| 5 | Charge purchase | Status: "paid" |
| 6 | Verify no 3DS required | No 3DS challenge |
1.5 Mastercard Payment
Test Card:5555555555554444
| Step | Action | Expected Result |
|---|---|---|
| 1 | Complete standard flow | Success |
| 2 | Verify card brand in response | brand: "mastercard" |
1.6 Multiple Products in Single Purchase
| Step | Action | Expected Result |
|---|---|---|
| 1 | Create purchase with multiple products | Total calculated correctly |
| 2 | Complete payment | Full amount charged |
1.7 Payment with Metadata
| Step | Action | Expected Result |
|---|---|---|
| 1 | Create purchase with metadata | Accepted |
| 2 | Complete payment | Success |
| 3 | Retrieve purchase | Metadata preserved |
| 4 | Receive webhook | Metadata included |
1.8 Different Currency (if supported)
| Step | Action | Expected Result |
|---|---|---|
| 1 | Create purchase with USD currency | Accepted |
| 2 | Complete payment | Charged in USD |
2. Pre-Authorization & Capture Tests
2.1 Pre-Auth with Full Capture
Test Card:4000000000001091
| Step | Action | Expected Result |
|---|---|---|
| 1 | Create purchase (amount: 50000) | Returns purchase ID |
| 2 | Submit card and complete 3DS | Authorization successful |
| 3 | Verify status | Status: "authorized" |
| 4 | Capture full amount | Status: "paid" |
| 5 | Verify captured amount | amount: 50000 |
2.2 Pre-Auth with Partial Capture
| Step | Action | Expected Result |
|---|---|---|
| 1 | Create and authorize (amount: 50000) | Status: "authorized" |
| 2 | Capture partial amount (35000) | Status: "paid" |
| 3 | Verify captured amount | amount: 35000 |
| 4 | Verify remaining released | No hold for remaining 15000 |
2.3 Pre-Auth with Multiple Partial Captures
| Step | Action | Expected Result |
|---|---|---|
| 1 | Authorize 100000 | Status: "authorized" |
| 2 | First capture: 30000 | Success, remaining: 70000 |
| 3 | Second capture: 40000 | Success, remaining: 30000 |
| 4 | Third capture: 30000 | Success, fully captured |
| 5 | Fourth capture attempt | Error: nothing remaining |
2.4 Pre-Auth without CVV (Token-based)
Prerequisite: Stored token from previous CIT
| Step | Action | Expected Result |
|---|---|---|
| 1 | Create purchase with is_recurring: true | Accepted |
| 2 | Submit with token, CVV: "000" | Accepted |
| 3 | Authorization completes | Status: "authorized" |
| 4 | Capture | Status: "paid" |
2.5 Capture Exceeding Authorization
| Step | Action | Expected Result |
|---|---|---|
| 1 | Authorize 50000 | Status: "authorized" |
| 2 | Attempt capture of 60000 | Error: capture_amount_exceeds_authorization |
2.6 Authorization Expiry Handling
| Step | Action | Expected Result |
|---|---|---|
| 1 | Note: May require waiting or test mode | — |
| 2 | Attempt capture on expired auth | Error: authorization_expired |
| 3 | Verify appropriate error handling | User-friendly message |
3. Void/Cancel Tests
3.1 Void Pre-Authorization
| Step | Action | Expected Result |
|---|---|---|
| 1 | Create and authorize purchase | Status: "authorized" |
| 2 | Call cancel endpoint | Status: "cancelled" |
| 3 | Verify funds released | No hold on card |
| 4 | Attempt capture after void | Error: already_voided |
3.2 Void Capture (Same Day, Before Settlement)
| Step | Action | Expected Result |
|---|---|---|
| 1 | Complete payment | Status: "paid" |
| 2 | Void same day | Status: "cancelled" |
| 3 | Verify immediate reversal | Funds released |
3.3 Void After Settlement (Should Fail)
| Step | Action | Expected Result |
|---|---|---|
| 1 | Attempt void on settled transaction | Error: void_not_permitted |
| 2 | Verify error message | Suggests using refund |
3.4 Void Refund (Before Settlement)
| Step | Action | Expected Result |
|---|---|---|
| 1 | Process refund | Refund ID returned |
| 2 | Void refund same day | Success |
| 3 | Verify original charge intact | Full amount charged |
4. Refund Scenarios
4.1 Full Refund
| Step | Action | Expected Result |
|---|---|---|
| 1 | Complete payment (29900) | Status: "paid" |
| 2 | Request full refund | Status: "refunded" |
| 3 | Verify refund amount | amount: 29900 |
| 4 | Receive webhook | Event: purchase.refunded |
4.2 Partial Refund
| Step | Action | Expected Result |
|---|---|---|
| 1 | Complete payment (50000) | Status: "paid" |
| 2 | Request partial refund (20000) | Success |
| 3 | Verify remaining | 30000 still charged |
| 4 | Verify refund details | Refund ID, amount: 20000 |
4.3 Multiple Partial Refunds
| Step | Action | Expected Result |
|---|---|---|
| 1 | Complete payment (100000) | Status: "paid" |
| 2 | First refund (25000) | Success, remaining: 75000 |
| 3 | Second refund (25000) | Success, remaining: 50000 |
| 4 | Third refund (50000) | Success, remaining: 0 |
| 5 | Fourth refund attempt | Error: nothing to refund |
4.4 Refund Exceeding Original Amount
| Step | Action | Expected Result |
|---|---|---|
| 1 | Complete payment (30000) | Status: "paid" |
| 2 | Request refund (40000) | Error: exceeds original |
4.5 Refund Exceeding Remaining Amount
| Step | Action | Expected Result |
|---|---|---|
| 1 | Complete payment (50000) | Status: "paid" |
| 2 | First refund (30000) | Success |
| 3 | Second refund (30000) | Error: exceeds remaining |
5. Error Handling Tests
5.1 Card Declined - Generic
Test Card:4000000000000002
| Step | Action | Expected Result |
|---|---|---|
| 1 | Submit declined card | Error returned |
| 2 | Verify error code | do_not_honour |
| 3 | Verify user-friendly message | Appropriate message |
5.2 Expired Card
Test Card:4000000000000069
| Step | Action | Expected Result |
|---|---|---|
| 1 | Submit expired card | Error: expired_card |
| 2 | Verify message | "Card has expired" |
5.3 Insufficient Funds
| Step | Action | Expected Result |
|---|---|---|
| 1 | Submit card with insufficient funds | Error: insufficient_funds |
| 2 | Verify soft decline | Can retry later |
5.4 Invalid CVC
Test Card:4000000000000127
| Step | Action | Expected Result |
|---|---|---|
| 1 | Submit with wrong CVC | Error: cvc_check_failed |
5.5 Invalid Card Number
Test Input:4111111111111112 (fails Luhn)
| Step | Action | Expected Result |
|---|---|---|
| 1 | Submit invalid card number | Error: invalid_card_number |
| 2 | Verify validation message | Clear error message |
5.6 Invalid Expiry Format
| Step | Action | Expected Result |
|---|---|---|
| 1 | Submit wrong format | Error: invalid_expires |
| 2 | Test: "2028/12", "1228" | All fail |
| 3 | Correct: "12/28" | Success |
5.7 Processing Error
Test Card:4000000000000119
| Step | Action | Expected Result |
|---|---|---|
| 1 | Trigger processing error | Error returned |
| 2 | Verify retry logic | Exponential backoff |
5.8 Missing Required Fields
| Step | Action | Expected Result |
|---|---|---|
| 1 | Submit without client_id | Validation error |
| 2 | Submit without brand_id | Validation error |
| 3 | Submit without currency | Validation error |
| 4 | Submit without products | Validation error |
5.9 Invalid API Key
| Step | Action | Expected Result |
|---|---|---|
| 1 | Use invalid API key | HTTP 401 |
| 2 | Use wrong key type | Error returned |
| 3 | Use expired key | HTTP 401 |
5.10 Network Timeout Handling
| Step | Action | Expected Result |
|---|---|---|
| 1 | Simulate network timeout | Error caught |
| 2 | Verify retry logic | Retries with backoff |
| 3 | Verify idempotency | No duplicate charges |
5.11 Duplicate Charge Prevention
| Step | Action | Expected Result |
|---|---|---|
| 1 | Submit charge request | Success |
| 2 | Resubmit same request | Idempotent response |
| 3 | Verify only one charge | Single transaction |
5.12 Expired Direct Post URL
| Step | Action | Expected Result |
|---|---|---|
| 1 | Create purchase | Get direct_post_url |
| 2 | Use URL once | Success |
| 3 | Reuse URL | Error: expired |
6. 3DS Scenarios
6.1 3DS Challenge Flow (Internal)
Test Card:4000000000001091
| Step | Action | Expected Result |
|---|---|---|
| 1 | Submit card requiring 3DS | 3DS parameters returned |
| 2 | Verify 3DS fields | MD, PaReq, URL, callback_url |
| 3 | Redirect to 3DS URL | Bank page loads |
| 4 | Complete challenge | Redirects to callback |
| 5 | Submit callback | Payment completes |
6.2 3DS Authentication Failed
| Step | Action | Expected Result |
|---|---|---|
| 1 | Initiate 3DS | Challenge presented |
| 2 | Fail authentication | Error: 3ds_authentication_failed |
| 3 | Verify retry available | Can retry |
6.3 3DS Timeout
| Step | Action | Expected Result |
|---|---|---|
| 1 | Initiate 3DS | Challenge presented |
| 2 | Allow timeout | Error: timeout |
| 3 | Verify graceful handling | User-friendly message |
6.4 Frictionless 3DS
Test Card:4000000000001000
| Step | Action | Expected Result |
|---|---|---|
| 1 | Submit low-risk transaction | No challenge |
| 2 | Verify frictionless | Success without redirect |
6.5 3DS Data in Response
| Step | Action | Expected Result |
|---|---|---|
| 1 | Complete 3DS transaction | Success |
| 2 | Verify ECI value | Present |
| 3 | Verify CAVV | Present |
7. Webhook Tests
7.1 Receive purchase.paid Event
| Step | Action | Expected Result |
|---|---|---|
| 1 | Complete payment | Webhook received |
| 2 | Verify event type | purchase.paid |
| 3 | Verify payload | All fields present |
| 4 | Verify purchase_id | Matches transaction |
7.2 Receive purchase.payment_failure Event
| Step | Action | Expected Result |
|---|---|---|
| 1 | Submit declined card | Payment fails |
| 2 | Receive webhook | purchase.payment_failure |
| 3 | Verify error details | Error code included |
7.3 Receive purchase.refunded Event
| Step | Action | Expected Result |
|---|---|---|
| 1 | Process refund | Completes |
| 2 | Receive webhook | purchase.refunded |
| 3 | Verify details | Amount, refund_id |
7.4 Receive purchase.authorized Event
| Step | Action | Expected Result |
|---|---|---|
| 1 | Complete pre-auth | Holds funds |
| 2 | Receive webhook | purchase.authorized |
| 3 | Verify details | Amount, expiry |
7.5 Signature Verification - Valid
| Step | Action | Expected Result |
|---|---|---|
| 1 | Receive webhook | Headers present |
| 2 | Verify signature | Matches computed |
| 3 | Verify timestamp | Within 5 minutes |
| 4 | Process webhook | Success |
7.6 Signature Verification - Invalid
| Step | Action | Expected Result |
|---|---|---|
| 1 | Receive tampered webhook | — |
| 2 | Verify signature | Mismatch detected |
| 3 | Reject webhook | HTTP 401 |
| 4 | No processing | No action taken |
7.7 Duplicate Webhook Handling
| Step | Action | Expected Result |
|---|---|---|
| 1 | Receive webhook | Process |
| 2 | Receive same again | Detect duplicate |
| 3 | Return HTTP 200 | Acknowledge |
| 4 | Do not reprocess | Idempotent |
7.8 Webhook Timeout Recovery
| Step | Action | Expected Result |
|---|---|---|
| 1 | Simulate timeout | Precium retries |
| 2 | Fix endpoint | Next retry succeeds |
| 3 | Verify no data loss | Event processed |
8. Edge Cases
8.1 Very Small Amount
| Step | Action | Expected Result |
|---|---|---|
| 1 | Create purchase (amount: 1) | Accepted |
| 2 | Complete payment | Success |
8.2 Very Large Amount
| Step | Action | Expected Result |
|---|---|---|
| 1 | Create large purchase | Accepted or limit error |
| 2 | Verify handling | Appropriate response |
8.3 Special Characters in Fields
| Step | Action | Expected Result |
|---|---|---|
| 1 | Name with accents | Handled |
| 2 | Special characters | Handled |
| 3 | Verify encoding | UTF-8 preserved |
8.4 Token Expiry
| Step | Action | Expected Result |
|---|---|---|
| 1 | Use expired token | Error: token_expired |
| 2 | Verify handling | Prompts re-tokenization |
8.5 Concurrent Requests
| Step | Action | Expected Result |
|---|---|---|
| 1 | Send multiple simultaneous | All handled |
| 2 | Verify no race conditions | No duplicates |
| 3 | Verify data integrity | All correct |
8.6 Client Reuse
| Step | Action | Expected Result |
|---|---|---|
| 1 | Create client once | ID stored |
| 2 | Use for multiple purchases | All succeed |
| 3 | Verify consistency | Data unchanged |
8.7 Browser Fingerprint Variations
| Step | Action | Expected Result |
|---|---|---|
| 1 | Minimal fingerprint | Accepted |
| 2 | Full fingerprint | Accepted |
| 3 | Missing optional fields | Handled |
9. External Integration Tests
Complete if using external 3DS or network tokens
9.1 External 3DS (MPI) Flow
| Step | Action | Expected Result |
|---|---|---|
| 1 | Complete 3DS with MPI | Auth data obtained |
| 2 | Create purchase (is_external_3DS: true) | Accepted |
| 3 | Include CAVV, ECI, transaction ID | Validated |
| 4 | Complete payment | Success |
9.2 External 3DS - Invalid Data
| Step | Action | Expected Result |
|---|---|---|
| 1 | Submit invalid CAVV | Error |
| 2 | Submit missing fields | Error |
| 3 | Submit wrong ECI format | Error |
9.3 Network Token Provisioning
| Step | Action | Expected Result |
|---|---|---|
| 1 | Submit network token | Accepted |
| 2 | Include cryptogram | Validated |
| 3 | Complete payment | Success |
9.4 Network Token - Expired Cryptogram
| Step | Action | Expected Result |
|---|---|---|
| 1 | Submit expired cryptogram | Error |
| 2 | Verify handling | Prompts refresh |
10. Security & Compliance Tests
10.1 API Key Security
| Step | Action | Expected Result |
|---|---|---|
| 1 | Check client-side code | Keys not exposed |
| 2 | Check logs | Keys masked |
| 3 | Verify HTTPS only | No HTTP |
10.2 Card Data Handling
| Step | Action | Expected Result |
|---|---|---|
| 1 | Check logs | Card numbers masked |
| 2 | Check storage | CVV not stored |
| 3 | Check URLs | Card data in POST only |
10.3 Token Storage Security
| Step | Action | Expected Result |
|---|---|---|
| 1 | Verify encryption | Encrypted at rest |
| 2 | Verify access control | Auth required |
| 3 | Verify UI | Tokens masked |
10.4 Webhook Endpoint Security
| Step | Action | Expected Result |
|---|---|---|
| 1 | Verify HTTPS | HTTP rejected |
| 2 | Verify signature | Invalid rejected |
| 3 | Verify timestamp | Old rejected |
10.5 Error Message Security
| Step | Action | Expected Result |
|---|---|---|
| 1 | Check errors | No sensitive data |
| 2 | Check responses | No internal details |
| 3 | Check customer messages | Generic/friendly |
10.6 Rate Limiting Handling
| Step | Action | Expected Result |
|---|---|---|
| 1 | Exceed rate limits | HTTP 429 |
| 2 | Verify backoff | Implements retry |
| 3 | Verify recovery | Resumes normally |
Test Cards Reference
Success Cards
| Card Number | Brand | 3DS | Behavior |
|---|---|---|---|
4000000000001091 | Visa | Yes | Success with 3DS |
4000000000001000 | Visa | No | Success without 3DS |
5555555555554444 | Mastercard | Yes | Success |
Decline Cards
| Card Number | Error Code | Description |
|---|---|---|
4000000000000002 | do_not_honour | Generic decline |
4000000000000069 | expired_card | Expired card |
4000000000000127 | cvc_check_failed | Invalid CVC |
4000000000000119 | processing_error | Processing error |
Test CVCs
| CVC | Behavior |
|---|---|
123 | Success |
000 | Bypass (recurring) |
Test Expiry
Use any future date in MM/YY format. Recommended: 12/28
Go-Live Checklist
Before going live, ensure:
- All critical tests passed
- All high-priority tests passed
- Known issues documented and accepted
- Production credentials obtained
- Production webhook URL configured
- Monitoring and alerting configured
- Support contact information documented
