---
title: "Update the authenticated user's profile (partial; OTP-gated for sensitive fields)"
method: PATCH
path: "/v1/users"
tags: ["Users"]
---

# Update the authenticated user's profile (partial; OTP-gated for sensitive fields)

`PATCH /v1/users`

## Request

- Base URL: `https://identity-api.paymongo.com`
- URL: `https://identity-api.paymongo.com/v1/users`
- Auth: HTTP bearer

Department-only payloads apply in a single call (200 user). Payloads containing first_name / last_name / contact_number enter a two-call OTP flow against `update_user`: empty `code` returns a challenge (`data.type = "challenge"`, 201) carrying expiration_at/resend_at/factor; populated `code` verifies the OTP and applies the patch (`data.type = "user"`, 200). Empty strings on contact_number/department clear the column; empty strings on first_name/last_name are rejected (NOT NULL). A non-empty contact_number must be an E.164 number with any country code (e.g. +639171234567) — anything else returns 422. login_notification is intentionally NOT here — see PATCH /v1/users/login_notification.

## Request body

- UserUpdateProfileRequestEnvelopeDTO
  - `data` object
    - `attributes` UserUpdateProfileRequestDTO
      - `code` string
      - `contact_number` string
      - `department` 'customer_service_and_support' | 'finance_and_accounting' | 'it_developer' | 'operations' | 'owner_management' | 'sales_and_marketing'
      - `factor` 'email' | 'sms' | 'totp'
      - `first_name` string
      - `last_name` string

## Response `200`

Applied (department-only payload, or OTP-verified apply branch)

- object: Standard response containing data and its metadata if any
  - `data` object
    - `attributes` UserUpdateProfileSuccessAttributesDTO
      - `department` string
      - `email` string
      - `login_notification` boolean
      - `organization_id` string
      - `user_contact_number` string
      - `user_first_name` string
      - `user_last_name` string
    - `id` string
    - `type` string
  - `has_more` boolean

## Other responses

- `201`: Issued an OTP challenge (sensitive field present, empty code)
- `400`: Bad Request
- `401`: Unauthorized
- `410`: Gone
- `422`: Unprocessable Entity
- `429`: Too Many Requests
- `500`: Internal Server Error
- `502`: Bad Gateway

---

[API](https://skmtc.dev/paymongo/apis/identity.md) - [All operations](https://skmtc.dev/paymongo/apis/identity/llms.txt) - [OpenAPI document](https://skmtc.dev/paymongo/apis/identity/revisions/cc3056164874?raw)