Update a protected customer profile through delegated write access.

PATCH

/api/protected/customer-profiles/users/{userId}

Code sample: Shell / cURL

curl --request PATCH \
  --url 'https://auth.example.com/api/protected/customer-profiles/users/example?include=actor%2Csubject%2Caudit' \
  --header 'Authorization: Bearer <token>' \
  --header 'Content-Type: application/json' \
  --header 'Idempotency-Key: example' \
  --data '{ "input": { "name": "Example User", "email": "user@example.com" }, "audit": { "reason": "user_requested_update" } }'

Applies a customer-profile update for the authenticated actor. No delegated-write authority is defined for this route, so the path userId must equal the access token subject, and that subject must be the local account id itself (tokens with a mapped pairwise or persistent sub, an externally asserted subject, an act claim, or a client or admin principal subject are refused). Any other request returns 403 access_denied before a step-up token is issued, whether or not that user exists. The request requires an Idempotency-Key header and an Authrim step-up receipt for the operation hash before the profile is mutated. The step-up confirmation is an additional requirement and never grants access to another user.

Authorizations

• bearerAuth

Parameters

Path Parameters

userId

required

string

Subject user id whose customer profile is updated. Must equal the access token subject.

Header Parameters

Idempotency-Key

required

string

Idempotency key used for delegated write replay protection. Reuse the key of the step_up_required response when retrying with the receipt; that response (and a refused receipt) is not stored as the key’s outcome, but the key stays bound to the request body, so a different body with the same key is refused with 409 idempotency_conflict. Once the update completes, a retry with the same key and body replays the stored response. A retry that arrives while another one with the same key is running gets 425 idempotency_in_progress with Retry-After.

Authrim-Step-Up-Receipt

string

Step-up receipt bound to the profile update operation. When omitted, the API returns step_up_required.

Query Parameters

include

string

Example

actor,subject,audit

Optional comma-separated response expansions.

Request Body ^required

Media type application/json

object

input

required

object

key

additional properties

audit

object

key

additional properties

Example

{
  "input": {
    "name": "Example User",
    "email": "user@example.com"
  },
  "audit": {
    "reason": "user_requested_update"
  }
}

Responses

200

Successful JSON response.

Media type application/json

object

customer_profile

required

object

sub

required

string

tenant_id

required

string

name

string | null

given_name

string | null

family_name

string | null

email

string | null format: email

email_verified

required

boolean

phone_number

string | null

phone_number_verified

required

boolean

address

object | null

updated_at

required

integer

key

additional properties

actor

object

id

string

subject

object

id

string

audit

object

key

additional properties

Example

{
  "customer_profile": {
    "sub": "user_123",
    "tenant_id": "tenant_123",
    "name": "Example User",
    "email": "user@example.com",
    "email_verified": true,
    "phone_number_verified": false,
    "updated_at": 1770000000000
  }
}

400

Error response.

Media type application/json

object

key

additional properties

Example ^generated

{
  "additionalProperty": "example"
}

401

Error response.

Media type application/json

object

key

additional properties

Example ^generated

{
  "additionalProperty": "example"
}

403

Error response.

Media type application/json

object

key

additional properties

Example ^generated

{
  "additionalProperty": "example"
}

409

Error response.

Media type application/json

object

key

additional properties

Example ^generated

{
  "additionalProperty": "example"
}

425

Error response.

Media type application/json

object

key

additional properties

Example ^generated

{
  "additionalProperty": "example"
}

503

Error response.

Media type application/json

object

key

additional properties

Example ^generated

{
  "additionalProperty": "example"
}