Update your metadata
PATCH /fapi/v1/me/metadata · called from the environment's sign-in host
Applies an RFC 7396 merge patch to the authenticated user's user_metadata. app_metadata cannot be written here. The result may be at most 16 KiB, depth 5 and 100 top-level keys. Requires the authenticated user's __Host-idp_session cookie; no recent re-verification is needed. A first-party app on another origin can instead send its front API access token (Authorization: DPoP <token> with a DPoP proof; see Front API access token).
Request
Headers:
| Header | Required | Description |
|---|---|---|
Idp-Client |
yes | SDK identifier. |
Origin |
yes | Must be exactly https://<sign-in host>. |
If-Match |
no | Optional. The ETag of a previous answer (or *); the change is made only if the profile is still at that version. |
Body (application/merge-patch+json or application/json): the merge patch itself, a JSON object. A key set to null is removed; nested objects are merged.
{
"theme": null,
"preferences": {
"newsletter": false
}
}
Response
200 OK with the updated profile (same fields as GET /fapi/v1/me) and a new ETag.
Errors
| Status | Code | When |
|---|---|---|
| 400 | malformed_request |
The body is not a JSON object, or the If-Match header is malformed. |
| 401 | unauthenticated |
No valid session cookie. |
| 403 | origin_not_allowed |
Origin is missing or wrong. |
| 404 | not_found |
The account cannot be read (for example blocked or being deleted). |
| 412 | precondition_failed |
If-Match does not match the current version; nothing changed. |
| 413 | payload_too_large |
The body exceeds 16 KiB. |
| 415 | unsupported_media_type |
Unsupported Content-Type. |
| 422 | validation_failed |
The patch is empty, or the result exceeds a limit (too_large, too_many_keys; the pointer is the body root). |
| 503 | service_unavailable |
The user directory is temporarily unavailable; retry after Retry-After seconds. |
Example
curl -X PATCH https://example.keenauth.app/fapi/v1/me/metadata \
-H "Idp-Client: my-app/1.0.0 (node/22.0.0)" \
-H "Origin: https://example.keenauth.app" \
-H "Content-Type: application/merge-patch+json" \
-b cookies.txt \
-d '{"theme":null}'
Personal data
This endpoint carries personal data: end-user profile. Personal data in the KeenAuth APIs describes what is stored, how long it is kept and how it is deleted. Do not send special categories of personal data (health, biometric data, religion, political opinions, sexual orientation) in any field.