WOMMWorks On My Machine · onmymachineitworks.comSample · fictional data

Smoke test report · API

Acme Ledger Public API · Staging

Passed with issues

Environment: https://api.staging.acme-ledger.example
API version: 2.4.0 (OpenAPI 3.1)
Build: 4.2.0-rc1
Executed: 2026-10-20 09:12 – 09:21 UTC
Executed by: Tomasz Kordiak (QA lead), suite in acme/qa-api-tests
Scope: Read-only. Writes use dryRun=true; no data created, modified or deleted.

Overview

98.9%pass rate

270Tests

265Passed

3Failed

2Skipped

249 msMedian response

64Operations tested

Auth

14/14

Customers

23/23

Contacts

16/16

Products

19/19

Invoices

32/35 · 2 failed · 1 skipped

Payments

21/22 · 1 skipped

Credit notes

17/17

Recurring schedules

19/19

Taxes

14/14

Webhooks

19/20 · 1 failed

Reports

19/19

Users and roles

20/20

Files

16/16

Audit log

16/16

Response time: median 249 ms, p95 470 ms, max 855 ms. Pass rate excludes skipped tests. Every successful response was validated against the OpenAPI schema.

Environment and scope

Base URL	`https://api.staging.acme-ledger.example/v2`
Test tenants	`t-demo-01` (1,019 invoices, 7-year retention), `t-demo-02` (265 invoices, 365-day retention)
Clients	3 OAuth clients: full scope, read-only scope, no scope
Users	5 roles: Admin, Finance, Accountant, Sales, Viewer
Tooling	Python 3.12, pytest, schemathesis for schema checks; runs in CI on every deploy to staging
Out of scope	Write operations without `dryRun`, payment provider callbacks, load (see performance report)
Entry criteria	Build deployed, health check green, seed data loaded — met at 09:05 UTC

Issues found 3 failed tests

High `INV-26` Invoices past data retention are listed but cannot be retrieved

Observed: GET /invoices returns invoices whose retention period has expired. GET /invoices/{id} returns 404 Invoice not found for the same IDs.
Evidence: 5 of the first 20 listed invoices; 41 of 1,284 in total. All belong to t-demo-02, created before 2025-10-20, with retention.days = 365. Reproduced 3 times per ID.
Impact: Integrations that list then fetch get unexpected 404s. totalItems and dashboards include effectively deleted records.
Expected: Expired invoices excluded from the list and from totalItems.
Defect: ACME-512 · full detail in the test case execution report ACME-T-118

Medium `INV-25` Invalid status filter value is silently ignored

Observed: GET /invoices?status=payed returns 200 with all 1,284 invoices. The spec documents 400.
Evidence: Control checks: status=paid → 913, status=open → 371.
Impact: A typo returns unfiltered data instead of an error.
Defect: ACME-513

Medium `WH-19` Webhook retries ignore the configured back-off

Observed: Subscription configured with back-off 1 min / 5 min / 15 min; the delivery log shows the 3rd retry 1 minute after the 2nd.
Impact: Receivers that are down get retried too fast, and the event is marked failed 13 minutes early.
Defect: ACME-514

Defects 4 reported

Key	Summary	Severity	Status	Component	Found by	Owner	Created
`ACME-512`	Invoice list returns invoices already removed by data retention (404 on detail)	High	Open	Invoices API	`INV-26`	Backend	20 Oct 2026
`ACME-513`	Invalid `status` filter value silently ignored instead of 400	Medium	Open	Invoices API	`INV-25`	Backend	20 Oct 2026
`ACME-514`	Webhook retry ignores the configured back-off on the 3rd attempt	Medium	Open	Webhooks	`WH-19`	Platform	20 Oct 2026
`ACME-516`	OpenAPI spec documents `limit` max 200, API enforces 100 Found while writing checks; the API behaviour is correct, the spec is not.	Low	Open	API docs	`–`	Backend	20 Oct 2026

Observations no defect, worth knowing

ID	Area	Observation	Impact	Suggested action
`OBS-01`	Customers	`GET /customers/{id}` for another tenant returns `404`, not `403`.	None	None — consistent with docs and hides which IDs exist.
`OBS-02`	Invoices	Invoice PDF is the slowest operation (p95 ≈ 1 s).	Performance	Include in the load test (done: see performance report).
`OBS-03`	Auth	HTTP requests are redirected with `301`; clients that don't follow redirects fail.	Low	Docs already say HTTPS only; no change.
`OBS-04`	Pagination	Cursor values are base64 JSON and decodable by clients.	Low	Fine if clients are told cursors are opaque; add a line to the docs.
`OBS-05`	Errors	Validation errors return the first failing field only.	Usability	Consider returning all field errors at once (API v3).
`OBS-06`	Rate limiting	Limit is 100 requests/minute per client; bursts are not smoothed.	Low	Document the limit per endpoint group.
`OBS-07`	Webhooks	Webhook URLs resolving to private IPs are rejected (SSRF protection).	Positive	Keep; covered by WH validation check.
`OBS-08`	Skipped	2 checks skipped: Peppol export (flag off on staging) and SEPA mandate (sandbox down).	Coverage	Run both on rc3 once available.

Coverage of the API

Area	Documented operations	Tested	Not tested
Auth and platform	4	4	–
Customers and contacts	9	9	–
Products and taxes	7	7	–
Invoices	12	10	`POST /invoices/{id}/duplicate` (deprecated), `PUT /invoices/{id}/lines` (beta, not released)
Payments and credit notes	10	9	`POST /mandates` (skipped, sandbox down)
Recurring schedules	5	5	–
Webhooks	6	6	–
Reports	5	5	–
Users, roles, files, audit log	11	9	`POST /users/{id}/impersonate` (admin tool, excluded), `PATCH /users/{id}/locale` (UI only)

69 documented operations, 64 tested (93%). Not tested operations are listed with the reason.

Response times by area

Area	Tests	Median	p95	Max
Auth	14	243 ms	349 ms	349 ms
Customers	23	225 ms	331 ms	348 ms
Contacts	16	258 ms	347 ms	347 ms
Products	19	222 ms	345 ms	345 ms
Invoices	34	255 ms	770 ms	823 ms
Payments	21	235 ms	324 ms	341 ms
Credit notes	17	251 ms	855 ms	855 ms
Recurring schedules	19	249 ms	338 ms	338 ms
Taxes	14	231 ms	337 ms	337 ms
Webhooks	20	230 ms	336 ms	336 ms
Reports	19	488 ms	594 ms	594 ms
Users and roles	20	227 ms	333 ms	333 ms
Files	16	243 ms	349 ms	349 ms
Audit log	16	259 ms	348 ms	348 ms

Test results 270 tests

Auth 14/14 passed

ID	Test	Endpoint	Expected	Actual	Time	Result
`AUTH-01`	Token issued for valid client credentials	`POST /oauth/token`	200	200	120 ms	Pass
`AUTH-02`	Invalid client secret rejected	`POST /oauth/token`	401	401	173 ms	Pass
`AUTH-03`	Unknown client id rejected	`POST /oauth/token`	401	401	226 ms	Pass
`AUTH-04`	Request without token rejected	`GET /invoices`	401	401	279 ms	Pass
`AUTH-05`	Expired token rejected	`GET /invoices`	401	401	332 ms	Pass
`AUTH-06`	Token signed with wrong key rejected	`GET /invoices`	401	401	155 ms	Pass
`AUTH-07`	Token for tenant A cannot read tenant B	`GET /invoices/{id}`	404	404	208 ms	Pass
`AUTH-08`	Scopes listed in the token are enforced	`GET /reports/revenue`	403	403	261 ms	Pass
`AUTH-09`	Token lifetime is 3600 s	`POST /oauth/token`	expires_in 3600	expires_in 3600	314 ms	Pass
`AUTH-10`	HTTP request redirected to HTTPS	`GET http://…/invoices`	301	301	137 ms	Pass
`AUTH-11`	CORS: unknown origin not allowed	`OPTIONS /invoices`	no ACAO header	no ACAO header	190 ms	Pass
`AUTH-12`	Rate limit headers present	`GET /invoices`	X-RateLimit-*	X-RateLimit-*	243 ms	Pass
`AUTH-13`	Rate limit returns 429 with Retry-After	`GET /invoices × 120/min`	429	429	296 ms	Pass
`AUTH-14`	Health endpoint without auth	`GET /health`	200	200	349 ms	Pass

Customers 23/23 passed

ID	Test	Endpoint	Expected	Actual	Time	Result
`CUS-01`	List customers	`GET /customers`	200	200	172 ms	Pass
`CUS-02`	Pagination: page size and next cursor	`GET /customers?limit=20`	20 + cursor	20 + cursor	225 ms	Pass
`CUS-03`	Pagination: last page has no cursor	`GET /customers?cursor=…`	no cursor	no cursor	278 ms	Pass
`CUS-04`	Limit above 100 rejected	`GET /customers?limit=500`	400	400	331 ms	Pass
`CUS-05`	Sort by creation date, descending	`GET /customers?sort=-createdAt`	sorted	sorted	154 ms	Pass
`CUS-06`	Filter by `name`	`GET /customers?name=…`	matching items only	matching items only	207 ms	Pass
`CUS-07`	Filter by `vatNumber`	`GET /customers?vatNumber=…`	matching items only	matching items only	260 ms	Pass
`CUS-08`	Filter by `country`	`GET /customers?country=…`	matching items only	matching items only	313 ms	Pass
`CUS-09`	Filter by `createdFrom`	`GET /customers?createdFrom=…`	matching items only	matching items only	136 ms	Pass
`CUS-10`	Filter by `tag`	`GET /customers?tag=…`	matching items only	matching items only	189 ms	Pass
`CUS-11`	Get by id	`GET /customers/{id}`	200	200	242 ms	Pass
`CUS-12`	Unknown id	`GET /customers/{id}`	404	404	295 ms	Pass
`CUS-13`	Other tenant's id	`GET /customers/{id}`	404	404	348 ms	Pass
`CUS-14`	Response matches OpenAPI schema	`GET /customers/{id}`	valid	valid	171 ms	Pass
`CUS-15`	Create (dry run)	`POST /customers?dryRun=true`	200	200	224 ms	Pass
`CUS-16`	Rejects missing `name`	`POST /customers?dryRun=true`	400	400	277 ms	Pass
`CUS-17`	Rejects invalid email	`POST /customers?dryRun=true`	400	400	330 ms	Pass
`CUS-18`	Rejects invalid country code	`POST /customers?dryRun=true`	400	400	153 ms	Pass
`CUS-19`	Rejects VAT number format	`POST /customers?dryRun=true`	400	400	206 ms	Pass
`CUS-20`	Rejects name over 200 chars	`POST /customers?dryRun=true`	400	400	259 ms	Pass
`CUS-21`	Missing scope rejected	`GET /customers`	403	403	312 ms	Pass
`CUS-22`	Customer with open invoices cannot be deleted	`DELETE /customers/{id}?dryRun=true`	409	409	135 ms	Pass
`CUS-23`	Archived customers excluded by default	`GET /customers`	archived hidden	archived hidden	188 ms	Pass

Contacts 16/16 passed

ID	Test	Endpoint	Expected	Actual	Time	Result
`CON-01`	List contacts	`GET /customers/{id}/contacts`	200	200	241 ms	Pass
`CON-02`	Pagination: page size and next cursor	`GET /customers/{id}/contacts?limit=20`	20 + cursor	20 + cursor	294 ms	Pass
`CON-03`	Pagination: last page has no cursor	`GET /customers/{id}/contacts?cursor=…`	no cursor	no cursor	347 ms	Pass
`CON-04`	Limit above 100 rejected	`GET /customers/{id}/contacts?limit=500`	400	400	170 ms	Pass
`CON-05`	Sort by creation date, descending	`GET /customers/{id}/contacts?sort=-createdAt`	sorted	sorted	223 ms	Pass
`CON-06`	Filter by `role`	`GET /customers/{id}/contacts?role=…`	matching items only	matching items only	276 ms	Pass
`CON-07`	Filter by `email`	`GET /customers/{id}/contacts?email=…`	matching items only	matching items only	329 ms	Pass
`CON-08`	Get by id	`GET /customers/{id}/contacts/{cid}`	200	200	152 ms	Pass
`CON-09`	Unknown id	`GET /customers/{id}/contacts/{cid}`	404	404	205 ms	Pass
`CON-10`	Other tenant's id	`GET /customers/{id}/contacts/{cid}`	404	404	258 ms	Pass
`CON-11`	Response matches OpenAPI schema	`GET /customers/{id}/contacts/{cid}`	valid	valid	311 ms	Pass
`CON-12`	Create (dry run)	`POST /customers/{id}/contacts?dryRun=true`	200	200	134 ms	Pass
`CON-13`	Rejects missing email	`POST /customers/{id}/contacts?dryRun=true`	400	400	187 ms	Pass
`CON-14`	Rejects duplicate primary contact	`POST /customers/{id}/contacts?dryRun=true`	400	400	240 ms	Pass
`CON-15`	Missing scope rejected	`GET /customers/{id}/contacts`	403	403	293 ms	Pass
`CON-16`	Primary contact is unique per customer	`GET /customers/{id}/contacts`	1 primary	1 primary	346 ms	Pass

Products 19/19 passed

ID	Test	Endpoint	Expected	Actual	Time	Result
`PRD-01`	List products	`GET /products`	200	200	169 ms	Pass
`PRD-02`	Pagination: page size and next cursor	`GET /products?limit=20`	20 + cursor	20 + cursor	222 ms	Pass
`PRD-03`	Pagination: last page has no cursor	`GET /products?cursor=…`	no cursor	no cursor	275 ms	Pass
`PRD-04`	Limit above 100 rejected	`GET /products?limit=500`	400	400	328 ms	Pass
`PRD-05`	Sort by creation date, descending	`GET /products?sort=-createdAt`	sorted	sorted	151 ms	Pass
`PRD-06`	Filter by `sku`	`GET /products?sku=…`	matching items only	matching items only	204 ms	Pass
`PRD-07`	Filter by `active`	`GET /products?active=…`	matching items only	matching items only	257 ms	Pass
`PRD-08`	Filter by `vatRate`	`GET /products?vatRate=…`	matching items only	matching items only	310 ms	Pass
`PRD-09`	Get by id	`GET /products/{id}`	200	200	133 ms	Pass
`PRD-10`	Unknown id	`GET /products/{id}`	404	404	186 ms	Pass
`PRD-11`	Other tenant's id	`GET /products/{id}`	404	404	239 ms	Pass
`PRD-12`	Response matches OpenAPI schema	`GET /products/{id}`	valid	valid	292 ms	Pass
`PRD-13`	Create (dry run)	`POST /products?dryRun=true`	200	200	345 ms	Pass
`PRD-14`	Rejects negative unit price	`POST /products?dryRun=true`	400	400	168 ms	Pass
`PRD-15`	Rejects unknown VAT rate	`POST /products?dryRun=true`	400	400	221 ms	Pass
`PRD-16`	Rejects missing `name`	`POST /products?dryRun=true`	400	400	274 ms	Pass
`PRD-17`	Rejects SKU already used	`POST /products?dryRun=true`	400	400	327 ms	Pass
`PRD-18`	Missing scope rejected	`GET /products`	403	403	150 ms	Pass
`PRD-19`	Price history kept after price change	`GET /products/{id}/prices`	2 entries	2 entries	203 ms	Pass

Invoices 32/35 passed

ID	Test	Endpoint	Expected	Actual	Time	Result
`INV-01`	List invoices	`GET /invoices`	200	200	256 ms	Pass
`INV-02`	Pagination: page size and next cursor	`GET /invoices?limit=20`	20 + cursor	20 + cursor	309 ms	Pass
`INV-03`	Pagination: last page has no cursor	`GET /invoices?cursor=…`	no cursor	no cursor	132 ms	Pass
`INV-04`	Limit above 100 rejected	`GET /invoices?limit=500`	400	400	185 ms	Pass
`INV-05`	Sort by creation date, descending	`GET /invoices?sort=-createdAt`	sorted	sorted	238 ms	Pass
`INV-06`	Filter by `status`	`GET /invoices?status=…`	matching items only	matching items only	291 ms	Pass
`INV-07`	Filter by `customerId`	`GET /invoices?customerId=…`	matching items only	matching items only	344 ms	Pass
`INV-08`	Filter by `issuedFrom`	`GET /invoices?issuedFrom=…`	matching items only	matching items only	167 ms	Pass
`INV-09`	Filter by `issuedTo`	`GET /invoices?issuedTo=…`	matching items only	matching items only	220 ms	Pass
`INV-10`	Filter by `dueFrom`	`GET /invoices?dueFrom=…`	matching items only	matching items only	273 ms	Pass
`INV-11`	Filter by `currency`	`GET /invoices?currency=…`	matching items only	matching items only	326 ms	Pass
`INV-12`	Filter by `number`	`GET /invoices?number=…`	matching items only	matching items only	149 ms	Pass
`INV-13`	Get by id	`GET /invoices/{id}`	200	200	202 ms	Pass
`INV-14`	Unknown id	`GET /invoices/{id}`	404	404	255 ms	Pass
`INV-15`	Other tenant's id	`GET /invoices/{id}`	404	404	308 ms	Pass
`INV-16`	Response matches OpenAPI schema	`GET /invoices/{id}`	valid	valid	131 ms	Pass
`INV-17`	Create (dry run)	`POST /invoices?dryRun=true`	200	200	184 ms	Pass
`INV-18`	Rejects negative quantity	`POST /invoices?dryRun=true`	400	400	237 ms	Pass
`INV-19`	Rejects unknown currency	`POST /invoices?dryRun=true`	400	400	290 ms	Pass
`INV-20`	Rejects missing customer	`POST /invoices?dryRun=true`	400	400	343 ms	Pass
`INV-21`	Rejects due date before issue date	`POST /invoices?dryRun=true`	400	400	166 ms	Pass
`INV-22`	Rejects more than 500 lines	`POST /invoices?dryRun=true`	400	400	219 ms	Pass
`INV-23`	Rejects discount over 100%	`POST /invoices?dryRun=true`	400	400	272 ms	Pass
`INV-24`	Missing scope rejected	`GET /invoices`	403	403	325 ms	Pass
`INV-25`	Invalid status value rejected · ACME-513	`GET /invoices?status=payed`	400	200	148 ms	Fail
`INV-26`	Every listed invoice can be retrieved · ACME-512	`GET /invoices → /invoices/{id}`	200	404 for 5 of 20	201 ms	Fail
`INV-27`	Totals computed correctly (net, VAT, gross)	`POST /invoices?dryRun=true`	match	match	254 ms	Pass
`INV-28`	Rounding: 3 × €0.333 at 23% VAT	`POST /invoices?dryRun=true`	€1.23 gross	€1.23 gross	307 ms	Pass
`INV-29`	Invoice PDF download	`GET /invoices/{id}/pdf`	200 application/pdf	200 application/pdf	770 ms	Pass
`INV-30`	PDF of another tenant's invoice	`GET /invoices/{id}/pdf`	404	404	823 ms	Pass
`INV-31`	`totalItems` equals the sum of pages	`GET /invoices`	equal	equal	236 ms	Pass
`INV-32`	Numbering is sequential per series	`GET /invoices?series=2026`	no gaps	no gaps	289 ms	Pass
`INV-33`	Send invoice (dry run)	`POST /invoices/{id}/send?dryRun=true`	202	202	342 ms	Pass
`INV-34`	Cancelled invoice cannot be sent	`POST /invoices/{id}/send?dryRun=true`	409	409	165 ms	Pass
`INV-35`	Peppol e-invoice export (feature flag off on staging)	`GET /invoices/{id}/ubl`	200	–	–	Skipped

Payments 21/22 passed

ID	Test	Endpoint	Expected	Actual	Time	Result
`PAY-01`	List payments	`GET /payments`	200	200	271 ms	Pass
`PAY-02`	Pagination: page size and next cursor	`GET /payments?limit=20`	20 + cursor	20 + cursor	324 ms	Pass
`PAY-03`	Pagination: last page has no cursor	`GET /payments?cursor=…`	no cursor	no cursor	147 ms	Pass
`PAY-04`	Limit above 100 rejected	`GET /payments?limit=500`	400	400	200 ms	Pass
`PAY-05`	Sort by creation date, descending	`GET /payments?sort=-createdAt`	sorted	sorted	253 ms	Pass
`PAY-06`	Filter by `invoiceId`	`GET /payments?invoiceId=…`	matching items only	matching items only	306 ms	Pass
`PAY-07`	Filter by `method`	`GET /payments?method=…`	matching items only	matching items only	129 ms	Pass
`PAY-08`	Filter by `receivedFrom`	`GET /payments?receivedFrom=…`	matching items only	matching items only	182 ms	Pass
`PAY-09`	Get by id	`GET /payments/{id}`	200	200	235 ms	Pass
`PAY-10`	Unknown id	`GET /payments/{id}`	404	404	288 ms	Pass
`PAY-11`	Other tenant's id	`GET /payments/{id}`	404	404	341 ms	Pass
`PAY-12`	Response matches OpenAPI schema	`GET /payments/{id}`	valid	valid	164 ms	Pass
`PAY-13`	Create (dry run)	`POST /payments?dryRun=true`	200	200	217 ms	Pass
`PAY-14`	Rejects overpayment	`POST /payments?dryRun=true`	400	400	270 ms	Pass
`PAY-15`	Rejects payment on cancelled invoice	`POST /payments?dryRun=true`	400	400	323 ms	Pass
`PAY-16`	Rejects amount with 3 decimals	`POST /payments?dryRun=true`	400	400	146 ms	Pass
`PAY-17`	Rejects currency differs from invoice	`POST /payments?dryRun=true`	400	400	199 ms	Pass
`PAY-18`	Missing scope rejected	`GET /payments`	403	403	252 ms	Pass
`PAY-19`	Partial payment updates the open balance	`POST /payments?dryRun=true`	balance reduced	balance reduced	305 ms	Pass
`PAY-20`	Refund (dry run)	`POST /payments/{id}/refund?dryRun=true`	200	200	128 ms	Pass
`PAY-21`	Refund above paid amount rejected	`POST /payments/{id}/refund?dryRun=true`	422	422	181 ms	Pass
`PAY-22`	SEPA direct debit mandate (provider sandbox unavailable)	`POST /mandates?dryRun=true`	201	–	–	Skipped

Credit notes 17/17 passed

ID	Test	Endpoint	Expected	Actual	Time	Result
`CN-01`	List credit notes	`GET /credit-notes`	200	200	287 ms	Pass
`CN-02`	Pagination: page size and next cursor	`GET /credit-notes?limit=20`	20 + cursor	20 + cursor	340 ms	Pass
`CN-03`	Pagination: last page has no cursor	`GET /credit-notes?cursor=…`	no cursor	no cursor	163 ms	Pass
`CN-04`	Limit above 100 rejected	`GET /credit-notes?limit=500`	400	400	216 ms	Pass
`CN-05`	Sort by creation date, descending	`GET /credit-notes?sort=-createdAt`	sorted	sorted	269 ms	Pass
`CN-06`	Filter by `invoiceId`	`GET /credit-notes?invoiceId=…`	matching items only	matching items only	322 ms	Pass
`CN-07`	Filter by `issuedFrom`	`GET /credit-notes?issuedFrom=…`	matching items only	matching items only	145 ms	Pass
`CN-08`	Get by id	`GET /credit-notes/{id}`	200	200	198 ms	Pass
`CN-09`	Unknown id	`GET /credit-notes/{id}`	404	404	251 ms	Pass
`CN-10`	Other tenant's id	`GET /credit-notes/{id}`	404	404	304 ms	Pass
`CN-11`	Response matches OpenAPI schema	`GET /credit-notes/{id}`	valid	valid	127 ms	Pass
`CN-12`	Create (dry run)	`POST /credit-notes?dryRun=true`	200	200	180 ms	Pass
`CN-13`	Rejects credit above invoice total	`POST /credit-notes?dryRun=true`	400	400	233 ms	Pass
`CN-14`	Rejects credit on draft invoice	`POST /credit-notes?dryRun=true`	400	400	286 ms	Pass
`CN-15`	Missing scope rejected	`GET /credit-notes`	403	403	339 ms	Pass
`CN-16`	Credit note links to its invoice	`GET /credit-notes/{id}`	invoiceId set	invoiceId set	162 ms	Pass
`CN-17`	Credit note PDF download	`GET /credit-notes/{id}/pdf`	200	200	855 ms	Pass

Recurring schedules 19/19 passed

ID	Test	Endpoint	Expected	Actual	Time	Result
`REC-01`	List recurring schedules	`GET /recurring`	200	200	268 ms	Pass
`REC-02`	Pagination: page size and next cursor	`GET /recurring?limit=20`	20 + cursor	20 + cursor	321 ms	Pass
`REC-03`	Pagination: last page has no cursor	`GET /recurring?cursor=…`	no cursor	no cursor	144 ms	Pass
`REC-04`	Limit above 100 rejected	`GET /recurring?limit=500`	400	400	197 ms	Pass
`REC-05`	Sort by creation date, descending	`GET /recurring?sort=-createdAt`	sorted	sorted	250 ms	Pass
`REC-06`	Filter by `customerId`	`GET /recurring?customerId=…`	matching items only	matching items only	303 ms	Pass
`REC-07`	Filter by `frequency`	`GET /recurring?frequency=…`	matching items only	matching items only	126 ms	Pass
`REC-08`	Filter by `active`	`GET /recurring?active=…`	matching items only	matching items only	179 ms	Pass
`REC-09`	Get by id	`GET /recurring/{id}`	200	200	232 ms	Pass
`REC-10`	Unknown id	`GET /recurring/{id}`	404	404	285 ms	Pass
`REC-11`	Other tenant's id	`GET /recurring/{id}`	404	404	338 ms	Pass
`REC-12`	Response matches OpenAPI schema	`GET /recurring/{id}`	valid	valid	161 ms	Pass
`REC-13`	Create (dry run)	`POST /recurring?dryRun=true`	200	200	214 ms	Pass
`REC-14`	Rejects day of month 0	`POST /recurring?dryRun=true`	400	400	267 ms	Pass
`REC-15`	Rejects end date before start	`POST /recurring?dryRun=true`	400	400	320 ms	Pass
`REC-16`	Rejects unknown frequency	`POST /recurring?dryRun=true`	400	400	143 ms	Pass
`REC-17`	Missing scope rejected	`GET /recurring`	403	403	196 ms	Pass
`REC-18`	Next 3 run dates returned	`GET /recurring/{id}`	3 dates	3 dates	249 ms	Pass
`REC-19`	Day 31 falls back to last day of month	`GET /recurring/{id}`	30 Nov	30 Nov	302 ms	Pass

Taxes 14/14 passed

ID	Test	Endpoint	Expected	Actual	Time	Result
`TAX-01`	List taxes	`GET /tax-rates`	200	200	125 ms	Pass
`TAX-02`	Pagination: page size and next cursor	`GET /tax-rates?limit=20`	20 + cursor	20 + cursor	178 ms	Pass
`TAX-03`	Pagination: last page has no cursor	`GET /tax-rates?cursor=…`	no cursor	no cursor	231 ms	Pass
`TAX-04`	Limit above 100 rejected	`GET /tax-rates?limit=500`	400	400	284 ms	Pass
`TAX-05`	Sort by creation date, descending	`GET /tax-rates?sort=-createdAt`	sorted	sorted	337 ms	Pass
`TAX-06`	Filter by `country`	`GET /tax-rates?country=…`	matching items only	matching items only	160 ms	Pass
`TAX-07`	Get by id	`GET /tax-rates/{id}`	200	200	213 ms	Pass
`TAX-08`	Unknown id	`GET /tax-rates/{id}`	404	404	266 ms	Pass
`TAX-09`	Other tenant's id	`GET /tax-rates/{id}`	404	404	319 ms	Pass
`TAX-10`	Response matches OpenAPI schema	`GET /tax-rates/{id}`	valid	valid	142 ms	Pass
`TAX-11`	Create (dry run)	`POST /tax-rates?dryRun=true`	200	200	195 ms	Pass
`TAX-12`	Rejects rate over 100%	`POST /tax-rates?dryRun=true`	400	400	248 ms	Pass
`TAX-13`	Missing scope rejected	`GET /tax-rates`	403	403	301 ms	Pass
`TAX-14`	Reverse charge flag on EU B2B customer	`POST /invoices?dryRun=true`	VAT 0%, note added	VAT 0%, note added	124 ms	Pass

Webhooks 19/20 passed

ID	Test	Endpoint	Expected	Actual	Time	Result
`WH-01`	List webhooks	`GET /webhooks`	200	200	177 ms	Pass
`WH-02`	Pagination: page size and next cursor	`GET /webhooks?limit=20`	20 + cursor	20 + cursor	230 ms	Pass
`WH-03`	Pagination: last page has no cursor	`GET /webhooks?cursor=…`	no cursor	no cursor	283 ms	Pass
`WH-04`	Limit above 100 rejected	`GET /webhooks?limit=500`	400	400	336 ms	Pass
`WH-05`	Sort by creation date, descending	`GET /webhooks?sort=-createdAt`	sorted	sorted	159 ms	Pass
`WH-06`	Filter by `event`	`GET /webhooks?event=…`	matching items only	matching items only	212 ms	Pass
`WH-07`	Get by id	`GET /webhooks/{id}`	200	200	265 ms	Pass
`WH-08`	Unknown id	`GET /webhooks/{id}`	404	404	318 ms	Pass
`WH-09`	Other tenant's id	`GET /webhooks/{id}`	404	404	141 ms	Pass
`WH-10`	Response matches OpenAPI schema	`GET /webhooks/{id}`	valid	valid	194 ms	Pass
`WH-11`	Create (dry run)	`POST /webhooks?dryRun=true`	200	200	247 ms	Pass
`WH-12`	Rejects HTTP (non-TLS) URL	`POST /webhooks?dryRun=true`	400	400	300 ms	Pass
`WH-13`	Rejects unknown event type	`POST /webhooks?dryRun=true`	400	400	123 ms	Pass
`WH-14`	Rejects URL resolving to private IP	`POST /webhooks?dryRun=true`	400	400	176 ms	Pass
`WH-15`	Missing scope rejected	`GET /webhooks`	403	403	229 ms	Pass
`WH-16`	Signature header on test delivery	`POST /webhooks/{id}/test`	X-Acme-Signature	X-Acme-Signature	282 ms	Pass
`WH-17`	Signature verifies with the shared secret	`POST /webhooks/{id}/test`	valid	valid	335 ms	Pass
`WH-18`	Delivery log lists the test event	`GET /webhooks/{id}/deliveries`	200	200	158 ms	Pass
`WH-19`	Retry uses configured back-off (3rd attempt) · ACME-514	`GET /webhooks/{id}/deliveries`	after 15 min	after 1 min	211 ms	Fail
`WH-20`	Secret rotation keeps old secret valid for 24 h	`POST /webhooks/{id}/rotate?dryRun=true`	both valid	both valid	264 ms	Pass

Reports 19/19 passed

ID	Test	Endpoint	Expected	Actual	Time	Result
`REP-01`	List reports	`GET /reports/revenue`	200	200	577 ms	Pass
`REP-02`	Pagination: page size and next cursor	`GET /reports/revenue?limit=20`	20 + cursor	20 + cursor	400 ms	Pass
`REP-03`	Pagination: last page has no cursor	`GET /reports/revenue?cursor=…`	no cursor	no cursor	453 ms	Pass
`REP-04`	Limit above 100 rejected	`GET /reports/revenue?limit=500`	400	400	506 ms	Pass
`REP-05`	Sort by creation date, descending	`GET /reports/revenue?sort=-createdAt`	sorted	sorted	559 ms	Pass
`REP-06`	Filter by `month`	`GET /reports/revenue?month=…`	matching items only	matching items only	382 ms	Pass
`REP-07`	Filter by `currency`	`GET /reports/revenue?currency=…`	matching items only	matching items only	435 ms	Pass
`REP-08`	Get by id	`GET /reports/revenue/{id}`	200	200	488 ms	Pass
`REP-09`	Unknown id	`GET /reports/revenue/{id}`	404	404	541 ms	Pass
`REP-10`	Other tenant's id	`GET /reports/revenue/{id}`	404	404	594 ms	Pass
`REP-11`	Response matches OpenAPI schema	`GET /reports/revenue/{id}`	valid	valid	417 ms	Pass
`REP-12`	Create (dry run)	`POST /reports/revenue?dryRun=true`	200	200	470 ms	Pass
`REP-13`	Rejects month in wrong format	`POST /reports/revenue?dryRun=true`	400	400	523 ms	Pass
`REP-14`	Missing scope rejected	`GET /reports/revenue`	403	403	576 ms	Pass
`REP-15`	Aged receivables report	`GET /reports/aged-receivables`	200	200	399 ms	Pass
`REP-16`	CSV export	`GET /reports/revenue.csv`	text/csv	text/csv	452 ms	Pass
`REP-17`	Report totals equal invoice totals	`GET /reports/revenue`	equal	equal	505 ms	Pass
`REP-18`	Future month returns empty report	`GET /reports/revenue?month=2027-01`	200, 0 rows	200, 0 rows	558 ms	Pass
`REP-19`	VAT summary per rate	`GET /reports/vat`	rates sum to total	rates sum to total	381 ms	Pass

Users and roles 20/20 passed

ID	Test	Endpoint	Expected	Actual	Time	Result
`USR-01`	List users and roles	`GET /users`	200	200	174 ms	Pass
`USR-02`	Pagination: page size and next cursor	`GET /users?limit=20`	20 + cursor	20 + cursor	227 ms	Pass
`USR-03`	Pagination: last page has no cursor	`GET /users?cursor=…`	no cursor	no cursor	280 ms	Pass
`USR-04`	Limit above 100 rejected	`GET /users?limit=500`	400	400	333 ms	Pass
`USR-05`	Sort by creation date, descending	`GET /users?sort=-createdAt`	sorted	sorted	156 ms	Pass
`USR-06`	Filter by `role`	`GET /users?role=…`	matching items only	matching items only	209 ms	Pass
`USR-07`	Filter by `active`	`GET /users?active=…`	matching items only	matching items only	262 ms	Pass
`USR-08`	Get by id	`GET /users/{id}`	200	200	315 ms	Pass
`USR-09`	Unknown id	`GET /users/{id}`	404	404	138 ms	Pass
`USR-10`	Other tenant's id	`GET /users/{id}`	404	404	191 ms	Pass
`USR-11`	Response matches OpenAPI schema	`GET /users/{id}`	valid	valid	244 ms	Pass
`USR-12`	Create (dry run)	`POST /users?dryRun=true`	200	200	297 ms	Pass
`USR-13`	Rejects invite with invalid email	`POST /users?dryRun=true`	400	400	120 ms	Pass
`USR-14`	Rejects unknown role	`POST /users?dryRun=true`	400	400	173 ms	Pass
`USR-15`	Missing scope rejected	`GET /users`	403	403	226 ms	Pass
`USR-16`	Current user	`GET /users/me`	200	200	279 ms	Pass
`USR-17`	Roles are listed	`GET /roles`	5 roles	5 roles	332 ms	Pass
`USR-18`	Accountant cannot invite users	`POST /users/invite?dryRun=true`	403	403	155 ms	Pass
`USR-19`	Viewer cannot create invoices	`POST /invoices?dryRun=true`	403	403	208 ms	Pass
`USR-20`	Admin cannot remove the last admin	`DELETE /users/{id}?dryRun=true`	409	409	261 ms	Pass

Files 16/16 passed

ID	Test	Endpoint	Expected	Actual	Time	Result
`FIL-01`	List files	`GET /files`	200	200	314 ms	Pass
`FIL-02`	Pagination: page size and next cursor	`GET /files?limit=20`	20 + cursor	20 + cursor	137 ms	Pass
`FIL-03`	Pagination: last page has no cursor	`GET /files?cursor=…`	no cursor	no cursor	190 ms	Pass
`FIL-04`	Limit above 100 rejected	`GET /files?limit=500`	400	400	243 ms	Pass
`FIL-05`	Sort by creation date, descending	`GET /files?sort=-createdAt`	sorted	sorted	296 ms	Pass
`FIL-06`	Filter by `type`	`GET /files?type=…`	matching items only	matching items only	349 ms	Pass
`FIL-07`	Get by id	`GET /files/{id}`	200	200	172 ms	Pass
`FIL-08`	Unknown id	`GET /files/{id}`	404	404	225 ms	Pass
`FIL-09`	Other tenant's id	`GET /files/{id}`	404	404	278 ms	Pass
`FIL-10`	Response matches OpenAPI schema	`GET /files/{id}`	valid	valid	331 ms	Pass
`FIL-11`	Create (dry run)	`POST /files?dryRun=true`	200	200	154 ms	Pass
`FIL-12`	Rejects file type not allowed	`POST /files?dryRun=true`	400	400	207 ms	Pass
`FIL-13`	Rejects file over 10 MB	`POST /files?dryRun=true`	400	400	260 ms	Pass
`FIL-14`	Missing scope rejected	`GET /files`	403	403	313 ms	Pass
`FIL-15`	Upload URL expires after 15 min	`POST /files`	expiresAt +15m	expiresAt +15m	136 ms	Pass
`FIL-16`	Download link works	`GET /files/{id}/content`	200	200	189 ms	Pass

Audit log 16/16 passed

ID	Test	Endpoint	Expected	Actual	Time	Result
`AUD-01`	List audit log	`GET /audit-events`	200	200	242 ms	Pass
`AUD-02`	Pagination: page size and next cursor	`GET /audit-events?limit=20`	20 + cursor	20 + cursor	295 ms	Pass
`AUD-03`	Pagination: last page has no cursor	`GET /audit-events?cursor=…`	no cursor	no cursor	348 ms	Pass
`AUD-04`	Limit above 100 rejected	`GET /audit-events?limit=500`	400	400	171 ms	Pass
`AUD-05`	Sort by creation date, descending	`GET /audit-events?sort=-createdAt`	sorted	sorted	224 ms	Pass
`AUD-06`	Filter by `actor`	`GET /audit-events?actor=…`	matching items only	matching items only	277 ms	Pass
`AUD-07`	Filter by `action`	`GET /audit-events?action=…`	matching items only	matching items only	330 ms	Pass
`AUD-08`	Filter by `from`	`GET /audit-events?from=…`	matching items only	matching items only	153 ms	Pass
`AUD-09`	Get by id	`GET /audit-events/{id}`	200	200	206 ms	Pass
`AUD-10`	Unknown id	`GET /audit-events/{id}`	404	404	259 ms	Pass
`AUD-11`	Other tenant's id	`GET /audit-events/{id}`	404	404	312 ms	Pass
`AUD-12`	Response matches OpenAPI schema	`GET /audit-events/{id}`	valid	valid	135 ms	Pass
`AUD-13`	Create (dry run)	`POST /audit-events?dryRun=true`	200	200	188 ms	Pass
`AUD-14`	Missing scope rejected	`GET /audit-events`	403	403	241 ms	Pass
`AUD-15`	Invoice change recorded with actor and diff	`GET /audit-events?entity=invoice`	1 event	1 event	294 ms	Pass
`AUD-16`	Audit log is read-only	`DELETE /audit-events/{id}`	405	405	347 ms	Pass

Sample report. Acme Ledger, its data, people and defects are fictional. Your report shows your product, your tickets and your tools.
More sample reports · Book a 15-minute call

Acme Ledger Public API · Staging

Overview

Environment and scope

Issues found 3 failed tests

High INV-26 Invoices past data retention are listed but cannot be retrieved

Medium INV-25 Invalid status filter value is silently ignored

Medium WH-19 Webhook retries ignore the configured back-off

Defects 4 reported

Observations no defect, worth knowing

Coverage of the API

Response times by area

Test results 270 tests

Auth 14/14 passed

Customers 23/23 passed

Contacts 16/16 passed

Products 19/19 passed

Invoices 32/35 passed

Payments 21/22 passed

Credit notes 17/17 passed

Recurring schedules 19/19 passed

Taxes 14/14 passed

Webhooks 19/20 passed

Reports 19/19 passed

Users and roles 20/20 passed

Files 16/16 passed

Audit log 16/16 passed

High `INV-26` Invoices past data retention are listed but cannot be retrieved

Medium `INV-25` Invalid status filter value is silently ignored

Medium `WH-19` Webhook retries ignore the configured back-off