Skip to main content
POST
Initiate Loan Journey

Authorizations

Authorization
string
header
required

API key of the form ec_(live|test). Scopes are listed per operation.

Headers

X-Signature
string
required

HMAC-SHA256 signature over method, path, timestamp, nonce and raw body.

X-Timestamp
string
required

Unix epoch seconds. Requests outside the tolerance window are rejected.

X-Nonce
string
required

Unique per-request nonce. Replays are rejected.

Body

application/json
channel
enum<string>
required
Available options:
API_HOSTED,
API_HEADLESS
productCode
enum<string>
required

Catalog code (ONLINE_*) or legacy alias.

Available options:
ONLINE_PERSONAL,
ONLINE_GOLD,
PERSONAL_LOAN,
GOLD_LOAN
mobile
string
required
Pattern: ^[6-9]\d{9}$
Example:

"9876543210"

customer
object
required

Applicant details. Provide monthlyIncome OR annualIncome (at least one).

goldLoanDetails
object

Required when productCode is ONLINE_GOLD.

Response

Success

API_HOSTED returns a hostedUrl (single-use resume link to hand to the customer). API_HEADLESS returns a journeySession token. Authorize subsequent /action and /{journeyId} calls by passing it in the journey_session cookie OR the X-Journey-Session header — NOT in Authorization, which carries your API key.

success
boolean
required
data
object
required