---
title: "Update person"
method: PATCH
path: "/admin/persons/{id}"
tags: ["person"]
---

# Update person

`PATCH /admin/persons/{id}`

## Request

- Base URL: `https://api.instruxi.dev/api/v1/enforcer`
- URL: `https://api.instruxi.dev/api/v1/enforcer/admin/persons/{id}`
- Auth: one of:
  - API key in header `Authorization`
  - API key in header `X-API-Key`

Partial PII patch on a cross-tenant person: a field present in the JSON body is applied — even an empty string clears it — while an absent field is left unchanged, so a {} body is a no-op. username is rejected with 400 (it is account-scoped, not person-scoped; use PATCH /accounts/{id} instead). The regulated block — DOB, home address, primary email and phone — is echoed back in the response only to a system-admin (global) caller, never to a tenant_admin, so an empty patch cannot be used as a read of those fields at the lower gate.

## Path parameters

- `id` string, required

## Request body

- InternalDeliveryHttpHandlerUpdatePersonRequest
  - `dob` string: YYYY-MM-DD
  - `first_name` string
  - `home_address_line1` string
  - `home_address_line2` string
  - `home_city` string
  - `home_country` string
  - `home_place_id` string
  - `home_postal_code` string
  - `home_region` string
  - `last_name` string
  - `name` string
  - `primary_email` string
  - `primary_phone` string
  - `profile_image_url` string
  - `username` string: account-scoped; applied to the caller's current account

## Response `200`

OK

- InternalDeliveryHttpHandlerPersonResponse
  - `data` EnforcerV3InternalDomainPersonPerson
    - `created_at` string
    - `dob` string
    - `email_verified` boolean
    - `first_name` string
    - `home_address_line1` string
    - `home_address_line2` string
    - `home_city` string
    - `home_country` string
    - `home_place_id` string: Home address — canonical, owned here (cybrid KYC + report-builder read it). HomePlaceID references an enforcer-geo place; the rest is a denormalized snapshot so /auth/me serves the address without a geo round-trip.
    - `home_postal_code` string
    - `home_region` string
    - `id` string
    - `last_name` string
    - `name` string: deprecated display name; prefer first_name/last_name
    - `phone_verified` boolean
    - `primary_email` string
    - `primary_phone` string
    - `profile_image_url` string
    - `updated_at` string
  - `success` boolean

## Other responses

- `400`: Bad Request
- `401`: Unauthorized
- `403`: Forbidden
- `404`: Not Found

---

[API](https://skmtc.dev/instruxi/apis/enforcer-api.md) · [All operations](https://skmtc.dev/instruxi/apis/enforcer-api/llms.txt) · [OpenAPI document](https://skmtc.dev/instruxi/apis/enforcer-api/revisions/fa82bc1becc0?raw)