Update your profile

PATCH /fapi/v1/me · called from the environment's sign-in host

Changes the authenticated user's profile fields. A field present in the body is changed, an absent field is left as it is, and an empty string or null clears the field. user_metadata, when given, is merged as an RFC 7396 merge patch. The same field rules as the management API apply. Requires the authenticated user's __Host-idp_session cookie; no recent re-verification is needed. A first-party app on another origin can instead send its front API access token (Authorization: DPoP <token> with a DPoP proof; see Front API access token).

Field errors (422 validation_failed, in errors[]): invalid (format or length; /locale also when the language is not enabled for the environment), too_large and too_many_keys (user_metadata over 16 KiB, depth 5 or 100 top-level keys), identifier_type_disabled (usernames are turned off in the environment), profile_field_disabled (the environment turned the field off; clearing it is still allowed) and profile_field_required (the environment requires the field, so it cannot be cleared).

Request

Headers:

Header Required Description
Idp-Client yes SDK identifier.
Origin yes Must be exactly https://<sign-in host>.
If-Match no Optional. The ETag of a previous answer (or *); the change is made only if the profile is still at that version.

Body (application/json or application/merge-patch+json):

Field Type Description
given_name string or null Given name.
family_name string or null Family name.
name string or null Full name.
picture string or null Picture URL (https).
locale string or null Language (BCP 47 tag).
zoneinfo string or null Time zone (IANA name).
username string or null Username.
user_metadata object Merge patch applied to user_metadata (RFC 7396). 
{
  "given_name": "Ada",
  "zoneinfo": "",
  "user_metadata": {
    "theme": null
  }
}

Response

200 OK with the updated profile (same fields as GET /fapi/v1/me) and a new ETag.

Errors

Status Code When
400 malformed_request The body or the If-Match header is malformed.
400 unknown_field The body has a field that cannot be changed here (for example email or app_metadata).
401 unauthenticated No valid session cookie.
403 origin_not_allowed Origin is missing or wrong.
404 not_found The account cannot be read (for example blocked or being deleted).
409 username_unavailable The username is reserved or already used by another account (both answer the same).
412 precondition_failed If-Match does not match the current version; nothing changed.
413 payload_too_large The body exceeds 16 KiB.
415 unsupported_media_type Unsupported Content-Type.
422 validation_failed A field breaks a rule; errors[] names the field and the reason (see above).
503 service_unavailable The user directory is temporarily unavailable; retry after Retry-After seconds.

Example

curl -X PATCH https://example.keenauth.app/fapi/v1/me \
  -H "Idp-Client: my-app/1.0.0 (node/22.0.0)" \
  -H "Origin: https://example.keenauth.app" \
  -H 'If-Match: "7"' \
  -H "Content-Type: application/json" \
  -b cookies.txt \
  -d '{"given_name":"Ada","zoneinfo":""}'

Personal data

This endpoint carries personal data: end-user profile. Personal data in the KeenAuth APIs describes what is stored, how long it is kept and how it is deleted. Do not send special categories of personal data (health, biometric data, religion, political opinions, sexual orientation) in any field.