PATCH /v1/me

Authentication

Send an API key as a bearer token. This endpoint does not state a specific permission in the specification, so give your key the least it needs and check the response rather than assuming.

This endpoint takes no organisation id. Your key already identifies the organisation it belongs to, and the response is scoped to it.

Try it

Replace anything in angle brackets with your own values, and the key placeholder with a key from your dashboard.

curl -X PATCH https://api.zinndigital.com/v1/me \
  -H "Authorization: Bearer zdk_live_…" \
  -H "Content-Type: application/json" \
  -d '{  }'

Signed in? The API console in your dashboard fills in your real organisation id and your own key, and runs the request against the live API so you can see the actual response. Open this endpoint in the API console

Details

The write path that did not exist — twice, for the same reason, one product surface apart. `User.locale` has been read by the notification renderer since notifications were built, and until 2026-07-30 exactly one code path in the whole platform ever wrote it — the public guest checkout. Anyone who signed up any other way received every email, notice and notification in English for the lifetime of their account, with no endpoint, no screen and no way to change it, while a fully built 58-locale pipeline sat one field-read away. `User.currency` had the same shape until 2026-08-04 (#460). The dashboard's currency switcher wrote a cookie plus `localStorage` and made **no server call at all**, so a customer who chose GBP on their laptop saw USD on their phone, and USD again after clearing cookies. `Organization.default_currency` is not that field: it is the tenant's **billing** currency — what a converting trial is charged in — and it belongs to the org because an invoice is issued to an org, while what a person browses in belongs to the person. Requires only an authenticated user session: this is a person changing a fact about themselves, not an act on an organization, so it carries no permission key. Both fields are optional and independent — send the one that changed. Setting either marks it **chosen**, which is not cosmetic in either case. For language, an explicit choice outranks the `locale` claim the identity provider puts on every token. For currency, it outranks the geo/locale inference that runs on every request (docs/29 §3.1). Without that distinction the inference silently re-decides the value on the next request and the bug looks like "it does not save". `name` and `email` are deliberately NOT writable here. Both belong to Keycloak, and a second writable copy in the engine would drift from the identity the tokens are minted against.

Request body

Response

Errors this endpoint can return

401 · 403 · 422 · 429