curl --request PATCH \
--url https://{host}/v1/me \
--header 'Authorization: Bearer <token>' \
--header 'Content-Type: application/vnd.api+json' \
--data '
{
"data": {
"type": "users",
"attributes": {
"name": "Jeffrey",
"lastName": "Ponsen",
"locale": "nl",
"currentPassword": "the-one-they-typed",
"newPassword": "the-one-they-chose"
}
}
}
'const options = {
method: 'PATCH',
headers: {Authorization: 'Bearer <token>', 'Content-Type': 'application/vnd.api+json'},
body: JSON.stringify({
data: {
type: 'users',
attributes: {
name: 'Jeffrey',
lastName: 'Ponsen',
locale: 'nl',
currentPassword: 'the-one-they-typed',
newPassword: 'the-one-they-chose'
}
}
})
};
fetch('https://{host}/v1/me', options)
.then(res => res.json())
.then(res => console.log(res))
.catch(err => console.error(err));<?php
$curl = curl_init();
curl_setopt_array($curl, [
CURLOPT_URL => "https://{host}/v1/me",
CURLOPT_RETURNTRANSFER => true,
CURLOPT_ENCODING => "",
CURLOPT_MAXREDIRS => 10,
CURLOPT_TIMEOUT => 30,
CURLOPT_HTTP_VERSION => CURL_HTTP_VERSION_1_1,
CURLOPT_CUSTOMREQUEST => "PATCH",
CURLOPT_POSTFIELDS => json_encode([
'data' => [
'type' => 'users',
'attributes' => [
'name' => 'Jeffrey',
'lastName' => 'Ponsen',
'locale' => 'nl',
'currentPassword' => 'the-one-they-typed',
'newPassword' => 'the-one-they-chose'
]
]
]),
CURLOPT_HTTPHEADER => [
"Authorization: Bearer <token>",
"Content-Type: application/vnd.api+json"
],
]);
$response = curl_exec($curl);
$err = curl_error($curl);
curl_close($curl);
if ($err) {
echo "cURL Error #:" . $err;
} else {
echo $response;
}import requests
url = "https://{host}/v1/me"
payload = { "data": {
"type": "users",
"attributes": {
"name": "Jeffrey",
"lastName": "Ponsen",
"locale": "nl",
"currentPassword": "the-one-they-typed",
"newPassword": "the-one-they-chose"
}
} }
headers = {
"Authorization": "Bearer <token>",
"Content-Type": "application/vnd.api+json"
}
response = requests.patch(url, json=payload, headers=headers)
print(response.text){
"data": {
"type": "users",
"id": "15",
"attributes": {
"name": "Jeffrey",
"lastName": "Ponsen",
"email": "jeffrey@example.com",
"phone": "+31612345678",
"locale": "nl",
"emailVerified": true,
"mfaEnabled": false,
"identities": [
"apple"
],
"createdAt": "2024-03-11T09:12:44.000000Z"
}
}
}{
"errors": [
{
"status": "404",
"code": "watch_reserved",
"title": "Not Found",
"detail": "<string>",
"meta": {},
"source": {
"pointer": "/data/attributes/reference",
"parameter": "<string>"
}
}
],
"jsonapi": {
"version": "1.0"
}
}{
"errors": [
{
"status": "404",
"code": "watch_reserved",
"title": "Not Found",
"detail": "<string>",
"meta": {},
"source": {
"pointer": "/data/attributes/reference",
"parameter": "<string>"
}
}
],
"jsonapi": {
"version": "1.0"
}
}{
"errors": [
{
"status": "404",
"code": "watch_reserved",
"title": "Not Found",
"detail": "<string>",
"meta": {},
"source": {
"pointer": "/data/attributes/reference",
"parameter": "<string>"
}
}
],
"jsonapi": {
"version": "1.0"
}
}{
"errors": [
{
"status": "404",
"code": "watch_reserved",
"title": "Not Found",
"detail": "<string>",
"meta": {},
"source": {
"pointer": "/data/attributes/reference",
"parameter": "<string>"
}
}
],
"jsonapi": {
"version": "1.0"
}
}{
"errors": [
{
"status": "404",
"code": "watch_reserved",
"title": "Not Found",
"detail": "<string>",
"meta": {},
"source": {
"pointer": "/data/attributes/reference",
"parameter": "<string>"
}
}
],
"jsonapi": {
"version": "1.0"
}
}Update current user
Scope: account:write
A name, an email, a phone number, a language. Only what the body names is
changed — a PATCH that carries an email does not reset a phone number to
whatever the client last happened to know.
| Attribute | |
|---|---|
name, lastName | Strings, at most 255 characters. Cannot be null. |
email | An address no other account has. Cannot be null. |
phone | At most 20 characters: digits with an optional leading +, and the spaces, dashes, dots and brackets people type between them (at least six digits). null clears it. |
locale | One of en, nl, de, es, fr, it, pt, fi, pl. |
newPassword | At least 8 characters, at most 255. Write-only. |
currentPassword | Required with newPassword, and with an email that changes. Write-only. |
emailConfirmed | Write-only; see below. |
Everything else on the resource is read-only, and is ignored when sent.
A password needs the current one beside it, and so does an email. A token lifted off a device must not be enough to lock somebody out of their own account — and the address is the account, because whoever holds it can ask for a password reset and be sent one. Neither password is ever returned.
currentPassword is asked for only when the address actually changes, so a
client that sends the whole object back can still edit a phone number. It may be
asked about five times in fifteen minutes, shared with every other endpoint that
asks; after that, 429 too_many_attempts.
Changing either one ends the account’s other sessions: every other access and refresh token is revoked, and every browser signed in to the website is signed out; the token making this call is kept, so the app the person is holding stays signed in. A new password is also mailed about, to the address on file.
Changing the address also clears emailVerified, sends a confirmation link to
the new address, and tells the old one it happened. Read emailVerified back from
GET /v1/me rather than assuming it survived.
A new address that looks mistyped is questioned, as on the website: 422 with
code implausible_email and meta.suggestion, exactly as POST /v1/users answers
it; send the same request again with emailConfirmed set to the address as typed to
keep it. The address already on file is never questioned.
Not idempotent by key: this endpoint ignores an Idempotency-Key header.
curl --request PATCH \
--url https://{host}/v1/me \
--header 'Authorization: Bearer <token>' \
--header 'Content-Type: application/vnd.api+json' \
--data '
{
"data": {
"type": "users",
"attributes": {
"name": "Jeffrey",
"lastName": "Ponsen",
"locale": "nl",
"currentPassword": "the-one-they-typed",
"newPassword": "the-one-they-chose"
}
}
}
'const options = {
method: 'PATCH',
headers: {Authorization: 'Bearer <token>', 'Content-Type': 'application/vnd.api+json'},
body: JSON.stringify({
data: {
type: 'users',
attributes: {
name: 'Jeffrey',
lastName: 'Ponsen',
locale: 'nl',
currentPassword: 'the-one-they-typed',
newPassword: 'the-one-they-chose'
}
}
})
};
fetch('https://{host}/v1/me', options)
.then(res => res.json())
.then(res => console.log(res))
.catch(err => console.error(err));<?php
$curl = curl_init();
curl_setopt_array($curl, [
CURLOPT_URL => "https://{host}/v1/me",
CURLOPT_RETURNTRANSFER => true,
CURLOPT_ENCODING => "",
CURLOPT_MAXREDIRS => 10,
CURLOPT_TIMEOUT => 30,
CURLOPT_HTTP_VERSION => CURL_HTTP_VERSION_1_1,
CURLOPT_CUSTOMREQUEST => "PATCH",
CURLOPT_POSTFIELDS => json_encode([
'data' => [
'type' => 'users',
'attributes' => [
'name' => 'Jeffrey',
'lastName' => 'Ponsen',
'locale' => 'nl',
'currentPassword' => 'the-one-they-typed',
'newPassword' => 'the-one-they-chose'
]
]
]),
CURLOPT_HTTPHEADER => [
"Authorization: Bearer <token>",
"Content-Type: application/vnd.api+json"
],
]);
$response = curl_exec($curl);
$err = curl_error($curl);
curl_close($curl);
if ($err) {
echo "cURL Error #:" . $err;
} else {
echo $response;
}import requests
url = "https://{host}/v1/me"
payload = { "data": {
"type": "users",
"attributes": {
"name": "Jeffrey",
"lastName": "Ponsen",
"locale": "nl",
"currentPassword": "the-one-they-typed",
"newPassword": "the-one-they-chose"
}
} }
headers = {
"Authorization": "Bearer <token>",
"Content-Type": "application/vnd.api+json"
}
response = requests.patch(url, json=payload, headers=headers)
print(response.text){
"data": {
"type": "users",
"id": "15",
"attributes": {
"name": "Jeffrey",
"lastName": "Ponsen",
"email": "jeffrey@example.com",
"phone": "+31612345678",
"locale": "nl",
"emailVerified": true,
"mfaEnabled": false,
"identities": [
"apple"
],
"createdAt": "2024-03-11T09:12:44.000000Z"
}
}
}{
"errors": [
{
"status": "404",
"code": "watch_reserved",
"title": "Not Found",
"detail": "<string>",
"meta": {},
"source": {
"pointer": "/data/attributes/reference",
"parameter": "<string>"
}
}
],
"jsonapi": {
"version": "1.0"
}
}{
"errors": [
{
"status": "404",
"code": "watch_reserved",
"title": "Not Found",
"detail": "<string>",
"meta": {},
"source": {
"pointer": "/data/attributes/reference",
"parameter": "<string>"
}
}
],
"jsonapi": {
"version": "1.0"
}
}{
"errors": [
{
"status": "404",
"code": "watch_reserved",
"title": "Not Found",
"detail": "<string>",
"meta": {},
"source": {
"pointer": "/data/attributes/reference",
"parameter": "<string>"
}
}
],
"jsonapi": {
"version": "1.0"
}
}{
"errors": [
{
"status": "404",
"code": "watch_reserved",
"title": "Not Found",
"detail": "<string>",
"meta": {},
"source": {
"pointer": "/data/attributes/reference",
"parameter": "<string>"
}
}
],
"jsonapi": {
"version": "1.0"
}
}{
"errors": [
{
"status": "404",
"code": "watch_reserved",
"title": "Not Found",
"detail": "<string>",
"meta": {},
"source": {
"pointer": "/data/attributes/reference",
"parameter": "<string>"
}
}
],
"jsonapi": {
"version": "1.0"
}
}Authorizations
Query Parameters
sellers— the shops you belong to, as whole resources: name, logo and the rest, which is what a shop switcher draws from. For a partner's token, only the ones it was granted.addresses— your address book.favorites, andfavorites.watchfor the listings behind them.savedSearches— the searches you are notified about.
Everything but sellers is the account itself and needs the account:read scope;
asked for without it, the answer is a 403 with the code missing_scope.
sellers, addresses, favorites, favorites.watch, savedSearches