# Update your metadata

`PATCH /fapi/v1/me/metadata` · called from the environment's sign-in host

Applies an RFC 7396 merge patch to the authenticated user's `user_metadata`. `app_metadata` cannot be written here. The result may be at most 16 KiB, depth 5 and 100 top-level keys. Requires the authenticated user's `__Host-idp_session` cookie; no recent re-verification is needed. A first-party app on another origin can instead send its front API access token (`Authorization: DPoP <token>` with a DPoP proof; see [Front API access token](/docs/api/fapi/front-api-token)).

## Request

Headers:

| Header | Required | Description |
| --- | --- | --- |
| `Idp-Client` | yes | SDK identifier. |
| `Origin` | yes | Must be exactly `https://<sign-in host>`. |
| `If-Match` | no | Optional. The `ETag` of a previous answer (or `*`); the change is made only if the profile is still at that version. |

Body (`application/merge-patch+json` or `application/json`): the merge patch itself, a JSON object. A key set to `null` is removed; nested objects are merged.

```json
{
  "theme": null,
  "preferences": {
    "newsletter": false
  }
}
```

## Response

`200 OK` with the updated profile (same fields as `GET /fapi/v1/me`) and a new `ETag`.

## Errors

| Status | Code | When |
| --- | --- | --- |
| 400 | `malformed_request` | The body is not a JSON object, or the `If-Match` header is malformed. |
| 401 | `unauthenticated` | No valid session cookie. |
| 403 | `origin_not_allowed` | `Origin` is missing or wrong. |
| 404 | `not_found` | The account cannot be read (for example blocked or being deleted). |
| 412 | `precondition_failed` | `If-Match` does not match the current version; nothing changed. |
| 413 | `payload_too_large` | The body exceeds 16 KiB. |
| 415 | `unsupported_media_type` | Unsupported `Content-Type`. |
| 422 | `validation_failed` | The patch is empty, or the result exceeds a limit (`too_large`, `too_many_keys`; the pointer is the body root). |
| 503 | `service_unavailable` | The user directory is temporarily unavailable; retry after `Retry-After` seconds. |

## Example

```bash
curl -X PATCH https://example.keenauth.app/fapi/v1/me/metadata \
  -H "Idp-Client: my-app/1.0.0 (node/22.0.0)" \
  -H "Origin: https://example.keenauth.app" \
  -H "Content-Type: application/merge-patch+json" \
  -b cookies.txt \
  -d '{"theme":null}'
```

## Personal data

This endpoint carries personal data: end-user profile. [Personal data in the KeenAuth APIs](/docs/policies/personal-data) describes what is stored, how long it is kept and how it is deleted. Do not send special categories of personal data (health, biometric data, religion, political opinions, sexual orientation) in any field.