Update profile (partial)

A new address needs currentPassword. It doesn't change email yet: it sets pendingEmail and emails the new address a link, and opening the link makes the change. Sending the current address cancels a pending change.

Turn card-activity emails on or off.

Empty when no upload; otherwise /api/v1/users/{id}/avatar

False for OAuth-only users (no password set). The hash itself is never returned.

Whether the address has been confirmed. Currently a soft gate - every endpoint still works for an unverified user - so treat it as a prompt to nudge, not as an authorization signal.

Present while an email change waits for confirmation. email stays the current address until the link sent to this one is opened.

Whether the user has two-factor sign-in on. Managed from Settings → Security through session-only routes (/me/2fa*); personal access tokens and MCP tokens are not affected by it.

Whether card-activity emails are sent (mentions, assignments, and activity on followed cards that stays unread for a few minutes). Defaults to true. Account email such as password resets is always sent.

False when the newsletter feature isn't configured on the deployment at all, which is different from being unsubscribed.

Whether the user can reach the /admin dashboard. Informational only - the real gate is server-side, and the admin endpoints are session-authenticated, so a token cannot use them.

Present only for cookie/session callers, who need it to send mutations. Omitted for bearer-token callers, since CSRF does not apply to a credential that isn't attached automatically.