# Profile

Both profile endpoints are contact-authenticated: they require the tenant API key in `Authorization` and a valid contact session token in `X-Customer-Token`. Reading needs the `contacts:read` scope, updating needs `contacts:write` (`customers:read` / `customers:write` accepted).

## GET /v1/api/contacts/me

Also served at `/v1/api/customers/me` for existing integrations; identical request and response.

Fetch the authenticated contact's profile.

### Headers

| Name | Type | Required | Description |
| --- | --- | --- | --- |
| `X-Customer-Token` | string | Yes | Contact session token from register or login. |

No query or body parameters.

```bash title="Request"
curl https://api.borkol.com/v1/api/contacts/me \
  -H "Authorization: Bearer {api_key}" \
  -H "X-Customer-Token: 13|Gh7rS2uX5vWy8zAbCdEfGhIjKlMnOpQrStUvWxYz"
```

Status: `200 OK`.

```json title="Response"
{
  "data": {
    "id": "9d4e2f1a-6b3c-4f8e-9a1d-2c5b7e8f0a3d",
    "name": "Jane Doe",
    "email": "jane@example.com",
    "phone": "+31612345678",
    "kind": "person",
    "company_name": null,
    "registration_number": null,
    "vat_id": null,
    "external_id": null,
    "display_name": "Jane Doe",
    "created_at": "2026-08-14T10:32:11+00:00"
  }
}
```

A contact created by the merchant as a company (through the client dashboard or CSV import) instead looks like:

```json title="Response (company contact)"
{
  "data": {
    "id": "c2d3e4f5-6a7b-4c8d-9e0f-1a2b3c4d5e6f",
    "name": "Mark van Dijk",
    "email": null,
    "phone": "+31201234567",
    "kind": "company",
    "company_name": "Van Dijk Bouw B.V.",
    "registration_number": "34567890",
    "vat_id": "NL123456789B01",
    "external_id": "erp-4471",
    "display_name": "Van Dijk Bouw B.V.",
    "created_at": "2026-08-20T09:00:00+00:00"
  }
}
```

### Errors

- `401` `{"message":"Invalid customer token."}` when `X-Customer-Token` is missing or invalid.

## PATCH /v1/api/contacts/me

Also served at `/v1/api/customers/me` for existing integrations; identical request and response.

Update the authenticated contact's profile. This is a partial update: all body fields are optional and only the fields you send are changed. Changing the email of a non-guest account requires the account's current password in `current_password`. `kind`, `company_name`, `registration_number`, `vat_id`, and `external_id` are not accepted on this endpoint — they are read-only through the storefront API and are set by the merchant.

### Headers

| Name | Type | Required | Description |
| --- | --- | --- | --- |
| `X-Customer-Token` | string | Yes | Contact session token from register or login. |

### Body parameters

| Name | Type | Required | Description |
| --- | --- | --- | --- |
| `name` | string | No | Full name. Maximum 150 characters. |
| `email` | string | No | Valid email address, maximum 255 characters. Lowercased server-side. Must not belong to another contact. Changing it on a non-guest account requires `current_password`. |
| `phone` | string or null | No | Phone number, maximum 50 characters. Send `null` to clear. |
| `current_password` | string | No | Required only when changing `email` on a non-guest account. Never stored; only checked. |

```bash title="Request"
curl -X PATCH https://api.borkol.com/v1/api/contacts/me \
  -H "Authorization: Bearer {api_key}" \
  -H "X-Customer-Token: 13|Gh7rS2uX5vWy8zAbCdEfGhIjKlMnOpQrStUvWxYz" \
  -H "Content-Type: application/json" \
  -d '{"name":"Jane A. Doe","phone":"+31612345678"}'
```

Status: `200 OK`. Returns the updated contact.

```json title="Response"
{
  "data": {
    "id": "9d4e2f1a-6b3c-4f8e-9a1d-2c5b7e8f0a3d",
    "name": "Jane A. Doe",
    "email": "jane@example.com",
    "phone": "+31612345678",
    "kind": "person",
    "company_name": null,
    "registration_number": null,
    "vat_id": null,
    "external_id": null,
    "display_name": "Jane A. Doe",
    "created_at": "2026-08-14T10:32:11+00:00"
  }
}
```

### Errors

- `422` with `errors.current_password` `["Current password is required to change email."]` when changing the email of a non-guest account without `current_password`, or with a wrong one.
- `422` with `errors.email` `["Email already registered."]` when the new email belongs to another contact.
- `422` for field validation failures.
- `401` `{"message":"Invalid customer token."}` when `X-Customer-Token` is missing or invalid.