smallcase order deeplinks

A deeplink lets a gateway partner send a user straight into a smallcase order flow inside the Distribution Module (DM) — Subscribe, Invest or Invest More — so the user does not have to tap the CTA a second time after landing on the smallcase.

Deeplinks work for both equity (ETI) and mutual fund (MF) smallcases.

How it works

The order instruction is carried in the URL hash (the part after #) of the DM page your integration opens. When DM loads that URL, it reads the hash and starts the matching flow.

The flow is triggered:

• on initial page load — a fresh open, for example the SDK opening a new WebView, and
• on a same-route hash change — if the hash is appended while the user is already on the page.

The flow starts only after DM's gateway session is ready, so a deeplink never races SDK initialisation.

URL format

https://<partner>.smallcase.com/<path>#<ROT13( <ACTION>?<key>=<value>&<key>=<value> )>

• <path> — the DM page you want the user to land on (see Recommended landing pages). This is the same route you would pass as the SDK's targetEndpoint.

• Everything after # is the order instruction, and it is ROT13-encoded (see Encoding: ROT13).

• Plain (decoded) shape of the hash:

  Text

  #<ACTION>?scid=<SCID>&assetClass=<ETI|MF>[&iscid=<ISCID>]

Supported actions

The same channel also supports EXIT, MANAGE, REBALANCE, SIP and REPAIR for invested smallcases — all iscid-based, with the same shape as Invest More. Start with the three actions above; the others can be enabled as needed.

Parameters

Deeplinks identify a smallcase with an scid and a user's investment in one with an iscid.

Encoding: ROT13

The hash is obfuscated with ROT13 — every A–Z / a–z letter is shifted by 13 (A ↔ N, B ↔ O, and so on). Digits, _, and the URL delimiters ?, = and & are left as-is. ROT13 is its own inverse, so encoding twice returns the original.

Encode only the part after the #:

plain:  SUBSCRIPTION?scid=SCET_0004&assetClass=ETI
ROT13:  FHOFPEVCGVBA?fpvq=FPRG_0004&nffrgPynff=RGV
final:  https://<partner>.smallcase.com/smallcase/SCET_0004#FHOFPEVCGVBA?fpvq=FPRG_0004&nffrgPynff=RGV

Any ROT13 tool works. A quick one-liner:

echo 'SUBSCRIPTION?scid=SCET_0004&assetClass=ETI' | tr 'A-Za-z' 'N-ZA-Mn-za-m'

Passing the deeplink through the SDK

When you launch the smallcase Module via the gateway SDK, pass the deeplink hash in the params field of SmallplugData, together with a targetEndpoint for the landing page.

• targetEndpoint — the DM page to land on (the <path> from Recommended landing pages), for example smallcase/SCET_0004.
• params — accepts standard search params (for example count=11&minInvest=0-5000) and the ROT13-encoded deeplink hash. Search params are optional; append the hash (starting with #) after them.

So the URL https://<partner>.smallcase.com/smallcase/SCET_0004#FHOFPEVCGVBA?fpvq=FPRG_0004&nffrgPynff=RGV maps to:

targetEndpoint = "smallcase/SCET_0004"
params         = "count=11&minInvest=0-5000#FHOFPEVCGVBA?fpvq=FPRG_0004&nffrgPynff=RGV"

Examples

SmallcaseGatewaySdk.launchSmallPlug(
    requireActivity(),
    SmallplugData(
        targetEndpoint = "smallcase/SCET_0004",
        params = "count=11&minInvest=0-5000#FHOFPEVCGVBA?fpvq=FPRG_0004&nffrgPynff=RGV"
    ),
    smallPlugListener
)

SCGateway.shared.launchSmallPlug(
    presentingController: self,
    smallplugData: SmallplugData(
        targetEndpoint: "smallcase/SCET_0004",
        params: "count=11&minInvest=0-5000#FHOFPEVCGVBA?fpvq=FPRG_0004&nffrgPynff=RGV"
    )
) { response, error in
    // handle completion
}

gatewayInstance.openSmallplug({
    path: "smallcase/SCET_0004",
    // can also directly pass the hash if no search params are required
    params: "#FHOFPEVCGVBA?fpvq=FPRG_0004&nffrgPynff=RGV"
});

The SDK opens DM at targetEndpoint with the search params and hash applied, and the order flow (Subscribe / Invest / Invest More) starts once the gateway session is ready — no manual CTA tap.

Recommended landing pages

The hash is route-agnostic — it carries the scid / iscid itself — but for the cleanest UX, land the user on the page the action belongs to. These are the same routes listed under supported endpoints.

Example links

Replace SCET_0004 / MF_XXXX_0001 / ISC123 with real ids.

Behaviour and guarantees

• Distribution Module only. These order deeplinks run inside DM as described above. The assetUniverse=US US-stock deeplinks are a separate path and are not used here.
• The user always completes the flow. The deeplink opens the flow; the resulting order or subscription still needs broker auth / OTP / MF 2FA and explicit user confirmation. There is no silent execution.
• Unknown or malformed input is a silent no-op. A missing scid, an unrecognised action, or a non-string id simply does nothing — no error is surfaced to the user.

Testing

1. Build the plain hash, ROT13-encode the part after #, and append it to the DM URL for a real smallcase.
2. Open it in DM — either as a fresh WebView open, or by pasting the whole URL / appending the #… fragment on the target route.
3. The Subscribe / Invest / Invest More sheet should open on load with no manual tap. Cancelling should leave the user on a working page.

Use staging ids for a smallcase in the relevant state — Subscribe needs a private, un-subscribed smallcase; Invest More needs an already-invested one. Pull these ids from staging, not production.

Limitations

• ROT13 is obfuscation, not encryption. It keeps order URLs from being trivially human-readable; it is not a security boundary. Treat these links as non-confidential.
• scid is required for every action, including iscid-based ones.
• Omitting assetClass defaults it to ETI, which mis-routes MF smallcases.
• A deeplink only reaches the start of a flow. It cannot place an order, and it cannot apply an unvalidated offer on its own.