---
title: "Create or update my customer account"
method: POST
path: "/v1/account/customer"
tags: ["Moderated Actions"]
---

# Create or update my customer account

`POST /v1/account/customer`

## Request

- Base URL: `https://loppee.com`
- URL: `https://loppee.com/v1/account/customer`
- Auth: HTTP bearer

Creates or partially updates the signed-in customer's private profile. The bearer identity and normalized email are authoritative; body fields cannot select another user. A signature-verified AAL1 customer session may create or update the profile when customer MFA is optional; the deployment-wide required mode still enforces AAL2. avatar_url accepts an empty string to remove the photo or a client-cropped square PNG/JPEG/WebP/GIF data URI (at most 300 KB decoded and 512 px per side). Loppee validates the bytes, stores them in private object storage, and returns only a short-lived signed display URL. The avatar-only path cannot create/reactivate an account or change authentication identity, roles, trust, reviews, ranking, or recommendation eligibility. Customer, owner, and admin identities are pairwise exclusive by user id and normalized email.

## Request body

- CustomerAccountUpsertRequest
  - `full_name` string
  - `phone` string
  - `city` string
  - `state` string
  - `search_category` string
  - `service_need` string
  - `auth_provider` string
  - `avatar_url` string: Empty string removes the photo. Otherwise, a client-cropped square PNG/JPEG/WebP/GIF base64 data URI; decoded bytes must be at most 300 KB and dimensions at most 512×512. Raw object-storage locators and remote URLs are rejected.

## Response `200`

CustomerAccountUpsertResponse

- CustomerAccountUpsertResponse
  - `status` 'active', required
  - `account` CustomerAccount, required
    - `id` string, required
    - `full_name` string, required
    - `email` string, email, required
    - `phone` string, nullable, required
    - `city` string, nullable, required
    - `state` string, nullable, required
    - `avatar_url` string, uri, nullable, required: Short-lived signed display URL for a private avatar object, or null. The internal storage locator is never returned.
    - `status` 'active', required
    - `created_at` string, date-time, nullable, required
    - `updated_at` string, date-time, nullable, required

## Other responses

- `400`: ErrorResponse
- `401`: ErrorResponse
- `403`: ErrorResponse
- `409`: ErrorResponse
- `413`: ErrorResponse
- `429`: RateLimitError
- `503`: ErrorResponse
- `default`: ErrorResponse

---

[API](https://skmtc.dev/loppee/apis/loppee-business-registry-api-for-external-agents.md) · [All operations](https://skmtc.dev/loppee/apis/loppee-business-registry-api-for-external-agents/llms.txt) · [OpenAPI document](https://skmtc.dev/loppee/apis/loppee-business-registry-api-for-external-agents/revisions/37285f7cddcd?raw)