---
title: "Update Handle"
method: PATCH
path: "/api/my/handle"
---

# Update Handle

`PATCH /api/my/handle`

## Request

- Base URL: `https://api.drillflow.de` (the document declares no server; this is the origin it was published from)
- URL: `https://api.drillflow.de/api/my/handle`
- Auth: none declared

Claim the account's handle, or move to another one (C1b).

There is deliberately no "is this free?" endpoint: it would be a perfect
enumeration oracle for other people's handles. The answer comes from this
call, which sits behind the session and the rate limit.

A handle the account gives up is remembered. It returns to the pool only if
nothing was ever published under it — otherwise a stranger could take it and
revive its dead URLs with their own diagrams. Its former owner may always
take it back.

Cookie-only (C2): moving the handle kills every named URL under the old one,
which is not something a token in an agent's config should be able to do.

## Request body

- HandleUpdate: Claim a handle, or move to another one (C1b).
  - `handle` string, required

## Response `200`

Successful Response

- UserResponse
  - `id` integer, required
  - `email` string, required
  - `verified` boolean, required
  - `handle` string, nullable
  - `entitlements` string[]
  - `has_password` boolean
  - `google` boolean
  - `providers` string[]

## Other responses

- `422`: Validation Error

## Changes

- **2026-10-19** `c892102e97b0`: 1 info
  - added the optional property `providers` to the response with the `200` status

[Operation history](https://skmtc.dev/drillflow/apis/drillflow-api/changes/api/my/handle/patch.md)

---

[API](https://skmtc.dev/drillflow/apis/drillflow-api.md) · [All operations](https://skmtc.dev/drillflow/apis/drillflow-api/llms.txt) · [OpenAPI document](https://skmtc.dev/drillflow/apis/drillflow-api/revisions/c892102e97b0?raw)