Initiate Loan Journey
Authorizations
API key of the form ec_(live|test). Scopes are listed per operation.
Headers
HMAC-SHA256 signature over method, path, timestamp, nonce and raw body.
Unix epoch seconds. Requests outside the tolerance window are rejected.
Unique per-request nonce. Replays are rejected.
Body
API_HOSTED, API_HEADLESS Catalog code (ONLINE_*) or legacy alias. Instant PL (ONLINE_INSTANT) is NOT a journey product — use POST /api/v1/partner/instant-loans.
ONLINE_PERSONAL, ONLINE_GOLD, PERSONAL_LOAN, GOLD_LOAN ^[6-9]\d{9}$"9876543210"
Applicant details. Provide monthlyIncome OR annualIncome (at least one).
Required when productCode is ONLINE_GOLD.
Response
Success
API_HOSTED returns a hostedUrl (single-use resume link to hand to the customer). API_HEADLESS returns a journeySession token. Authorize subsequent /action and /{journeyId} calls by passing it in the journey_session cookie OR the X-Journey-Session header — NOT in Authorization, which carries your API key.