---
title: "Update profile (partial)"
method: PATCH
path: "/me"
---

# Update profile (partial)

`PATCH /me`

## Request

- Base URL: `https://craaft.io/api/v1`
- URL: `https://craaft.io/api/v1/me`
- Auth: HTTP bearer

## Request body

- object
  - `name` string
  - `email` string, email: A new address needs `currentPassword`. It doesn't change `email` yet: it sets `pendingEmail` and emails the new address a link, and opening the link makes the change. Sending the current address cancels a pending change.
  - `currentPassword` string
  - `username` string
  - `emailNotifications` boolean: Turn card-activity emails on or off.

## Response `200`

Updated user

- User
  - `id` string, uuid, required
  - `email` string, email, required
  - `name` string, required
  - `username` string, required
  - `avatarUrl` string, required: Empty when no upload; otherwise /api/v1/users/{id}/avatar
  - `hasPassword` boolean, required: False for OAuth-only users (no password set). The hash itself is never returned.
  - `emailVerified` boolean, required: Whether the address has been confirmed. Currently a soft gate - every endpoint still works for an unverified user - so treat it as a prompt to nudge, not as an authorization signal.
  - `pendingEmail` string, email: Present while an email change waits for confirmation. `email` stays the current address until the link sent to this one is opened.
  - `twoFactorEnabled` boolean, required: Whether the user has two-factor sign-in on. Managed from Settings → Security through session-only routes (`/me/2fa*`); personal access tokens and MCP tokens are not affected by it.
  - `newsletterSubscribed` boolean, required
  - `emailNotifications` boolean, required: Whether card-activity emails are sent (mentions, assignments, and activity on followed cards that stays unread for a few minutes). Defaults to true. Account email such as password resets is always sent.
  - `newsletterAvailable` boolean, required: False when the newsletter feature isn't configured on the deployment at all, which is different from being unsubscribed.
  - `isSuperAdmin` boolean, required: Whether the user can reach the `/admin` dashboard. Informational only - the real gate is server-side, and the admin endpoints are session-authenticated, so a token cannot use them.
  - `csrfToken` string: Present only for cookie/session callers, who need it to send mutations. Omitted for bearer-token callers, since CSRF does not apply to a credential that isn't attached automatically.

## Changes

- **2026-10-19** `3a1e9d30d7dc`: 2 info
  - added the new optional request property `currentPassword`
  - added the optional property `pendingEmail` to the response with the `200` status

[Operation history](https://skmtc.dev/craaft/apis/craaft-api/changes/me/patch.md)

---

[API](https://skmtc.dev/craaft/apis/craaft-api.md) · [All operations](https://skmtc.dev/craaft/apis/craaft-api/llms.txt) · [OpenAPI document](https://skmtc.dev/craaft/apis/craaft-api/revisions/3a1e9d30d7dc?raw)