borkoldocs

Customers

Profile

Read and update the authenticated customer's profile.

View as Markdown

Both profile endpoints are customer-authenticated: they require the tenant API key in Authorization and a valid customer session token in X-Customer-Token. Reading needs the customers:read scope, updating needs customers:write.

GET /v1/api/customers/me

Fetch the authenticated customer's profile.

Headers

NameTypeRequiredDescription
X-Customer-TokenstringYesCustomer session token from register or login.

No query or body parameters.

Request
curl https://api.borkol.com/v1/api/customers/me \
  -H "Authorization: Bearer {api_key}" \
  -H "X-Customer-Token: 13|Gh7rS2uX5vWy8zAbCdEfGhIjKlMnOpQrStUvWxYz"

Status: 200 OK.

Response
{
  "data": {
    "id": "9d4e2f1a-6b3c-4f8e-9a1d-2c5b7e8f0a3d",
    "name": "Jane Doe",
    "email": "jane@example.com",
    "phone": "+31612345678",
    "created_at": "2026-08-14T10:32:11+00:00"
  }
}

Errors

  • 401 {"message":"Invalid customer token."} when X-Customer-Token is missing or invalid.

PATCH /v1/api/customers/me

Update the authenticated customer's profile. This is a partial update: all body fields are optional and only the fields you send are changed. Changing the email of a non-guest account requires the account's current password in current_password.

Headers

NameTypeRequiredDescription
X-Customer-TokenstringYesCustomer session token from register or login.

Body parameters

NameTypeRequiredDescription
namestringNoFull name. Maximum 150 characters.
emailstringNoValid email address, maximum 255 characters. Lowercased server-side. Must not belong to another customer. Changing it on a non-guest account requires current_password.
phonestring or nullNoPhone number, maximum 50 characters. Send null to clear.
current_passwordstringNoRequired only when changing email on a non-guest account. Never stored; only checked.
Request
curl -X PATCH https://api.borkol.com/v1/api/customers/me \
  -H "Authorization: Bearer {api_key}" \
  -H "X-Customer-Token: 13|Gh7rS2uX5vWy8zAbCdEfGhIjKlMnOpQrStUvWxYz" \
  -H "Content-Type: application/json" \
  -d '{"name":"Jane A. Doe","phone":"+31612345678"}'

Status: 200 OK. Returns the updated customer.

Response
{
  "data": {
    "id": "9d4e2f1a-6b3c-4f8e-9a1d-2c5b7e8f0a3d",
    "name": "Jane A. Doe",
    "email": "jane@example.com",
    "phone": "+31612345678",
    "created_at": "2026-08-14T10:32:11+00:00"
  }
}

Errors

  • 422 with errors.current_password ["Current password is required to change email."] when changing the email of a non-guest account without current_password, or with a wrong one.
  • 422 with errors.email ["Email already registered."] when the new email belongs to another customer.
  • 422 for field validation failures.
  • 401 {"message":"Invalid customer token."} when X-Customer-Token is missing or invalid.