# Create investor journey

Creates an investor portal URL for the given email, PAN, and scheme. Requires a platform merchant JWT.

Endpoint: POST /investor-journey
Version: 1.0.0
Security: JWT

## Security:

  - `JWT` (unknown)
    http bearer JWT

## Request fields (application/json):

  - `email` (string, required)
    The investor's email address. Surrounding whitespace is removed and the address is lower-cased before it is checked. The part before `@` can be at most 64 characters, with no leading, trailing or consecutive dots; the domain must contain a dot and end in a top-level domain of 2–63 letters; and the whole address can be at most 254 characters. An invalid address returns `400`.
    Example: investor@example.com

  - `pan` (string, required)
    The investor's PAN: five letters, four digits and a final letter, where the fourth letter must be `P`. Surrounding whitespace is removed before the check. An invalid PAN returns `400`.
    Example: ABCPD1234E

  - `scheme_no` (string, required)
    Example: HGEMR

## Response 200:

  - `200` (unknown)
    Success

## Response 200 fields (application/json):

  - `url` (string, required)
    The investor portal URL to send the investor to. The journey details travel encrypted in the URL fragment (`#payload=…`), so pass the URL on unchanged.
    Example: https://investor-portal.glomopay.com#payload=...

## Response 400:

  - `400` (unknown)
    Bad Request — validation failed (email/PAN), or scheme_no is unknown or not owned by a child merchant of this platform.

## Response 400 fields (application/json):

  - `error` (string)
    Example: Bad Request

  - `message` (string)
    Example: Scheme not found

## Response 401:

  - `401` (unknown)
    Unauthorized — missing/invalid JWT, or the caller is not a platform merchant.

## Response 401 fields (application/json):

  - `error` (string)
    Example: Unauthorized

  - `message` (string)
    Example: Access restricted to platform businesses only

## Response 400 examples:

  - `Invalid PAN or email` (unknown)

  - `Unknown or unowned scheme` (unknown)

## Response 401 examples:

  - `Missing JWT` (unknown)

  - `Non-platform merchant token` (unknown)