---
title: "Update the merchant's light profile fields"
method: PATCH
path: "/api/merchants/me"
tags: ["merchant"]
---

# Update the merchant's light profile fields

`PATCH /api/merchants/me`

## Request

- Base URL: `https://api.depixapp.com`
- URL: `https://api.depixapp.com/api/merchants/me`
- Auth: HTTP bearer

Partial update of the authenticated merchant's LIGHT profile fields: business_name, website, logo_url, default_callback_url, default_redirect_url. Requires scope `merchant_write` on the API-key path. liquid_address, cnpj and password are owner-only and rejected with 400 validation_error (details.field names the offending field); split_address is never editable here. Read the current profile via GET /api/me. Every PATCH authenticated by an API key emails the account owner naming the changed fields and the key id, so a key-driven change is never silent.

## Request body

- MerchantUpdateRequest: Partial merchant-profile update — only the provided fields change. On the API-key path ONLY these 5 light fields are editable; sending liquid_address, cnpj or password is rejected with 400 validation_error (owner + web dashboard only). split_address is never editable here (admin only). Every key-authenticated PATCH emails the account owner (compensating control).
  - `business_name` string: New business name (2–100 chars). Changing it rotates the public merchant_slug and retires the old one, so any outstanding payment links or checkout URLs built on the old slug will 404 — rename with that in mind.
  - `website` string, nullable: New website URL (normalized to https://; null/empty clears it).
  - `logo_url` string, nullable: New HTTPS logo URL (null/empty clears it).
  - `default_callback_url` string, nullable: New HTTPS default webhook endpoint for deposit.*/withdraw.* events (null/empty clears it).
  - `default_redirect_url` string, nullable: New HTTPS default post-payment redirect for this merchant's customers (null/empty clears it).

## Response `200`

Updated.

- MerchantUpdateResponse: Result of a merchant-profile update.
  - `success` true, required: Always true on success.
  - `merchant_slug` string, required: The merchant's public URL slug after the update (unchanged unless business_name changed).

## Other responses

- `400`: Invalid field value, empty update, or an owner-only field (liquid_address/cnpj/password) sent on the API-key path — `details.field` names it.
- `401`: Missing/invalid credentials. `invalid_api_key` for a failed sk_* lookup (revoked/expired/unknown); `invalid_token` for a bad or missing JWT/Authorization header.
- `403`: The API key lacks the `merchant_write` scope required by this operation. May also be `account_blocked`, or an operation-specific 403 — see the error catalog.
- `429`: Rate limited (per-IP, per-key or per-merchant window). Retry after `retry_after` seconds (also in the Retry-After header).

---

[API](https://skmtc.dev/depixapp/apis/depix-api.md) · [All operations](https://skmtc.dev/depixapp/apis/depix-api/llms.txt) · [OpenAPI document](https://skmtc.dev/depixapp/apis/depix-api/revisions/04094536dd0f?raw)