Update the profile
tenantKeybearerAuthX-Tenant-Key<token>The public store key (pk_live_…). Required on every call.
AuthorizationBearer <token>A customer token from POST /v1/auth/login, or a merchant API key, on routes that need one.
X-Client-IP?stringOptional. IP address of the shopper (one IPv4/IPv6, no port, no list). Honoured only together with a valid X-Tenant-Secret; ignored otherwise. Used for rate limits and recorded with form submissions.
X-Tenant-Secret?stringOptional here. Server secret of the store: server-to-server only, never from a browser. Enables X-Client-IP.
application/json- body
PATCH auth/me {name?, email?, current_password?}.
At least one of name/email is required. Changing the email — including a case-only change,
which is still a different string on the users.email unique index — requires
current_password: a stolen bearer token alone must not be able to move the account to an
address the thief controls and then reset the password from there. The same email as today
needs no password and is a no-op.
Uniqueness is per store (the FormRequest resolves inside the tenant group, so the default
connection is this tenant's database — same reasoning as RegisterRequest) and
case-insensitive, so [email protected] cannot be claimed while [email protected] exists. The message is
Laravel's standard unique wording, same as registration already exposes.
name?stringlength <= 255email?stringemaillength <= 255current_password?string|nullSuccess.
application/json- response
data*curl -X PATCH 'https://api.elaraone.app/api/v1/auth/me' \ -H 'X-Tenant-Key: pk_live_…' \ -H 'X-Tenant-Secret: your-server-secret' \ -H 'Content-Type: application/json' \ -d '{}'{ "data": { "id": 0, "name": "string", "email": "string", "email_verified_at": "string", "customer_id": 0 }}