# Profile

Both profile endpoints are customer-authenticated: they require the tenant API key in `Authorization` and a valid customer session token in `X-Customer-Token`. Reading needs the `customers:read` scope, updating needs `customers:write`.

## GET /v1/api/customers/me

Fetch the authenticated customer's profile.

### Headers

| Name | Type | Required | Description |
| --- | --- | --- | --- |
| `X-Customer-Token` | string | Yes | Customer session token from register or login. |

No query or body parameters.

```bash title="Request"
curl https://api.borkol.com/v1/api/customers/me \
  -H "Authorization: Bearer {api_key}" \
  -H "X-Customer-Token: 13|Gh7rS2uX5vWy8zAbCdEfGhIjKlMnOpQrStUvWxYz"
```

Status: `200 OK`.

```json title="Response"
{
  "data": {
    "id": "9d4e2f1a-6b3c-4f8e-9a1d-2c5b7e8f0a3d",
    "name": "Jane Doe",
    "email": "jane@example.com",
    "phone": "+31612345678",
    "created_at": "2026-08-14T10:32:11+00:00"
  }
}
```

### Errors

- `401` `{"message":"Invalid customer token."}` when `X-Customer-Token` is missing or invalid.

## PATCH /v1/api/customers/me

Update the authenticated customer's profile. This is a partial update: all body fields are optional and only the fields you send are changed. Changing the email of a non-guest account requires the account's current password in `current_password`.

### Headers

| Name | Type | Required | Description |
| --- | --- | --- | --- |
| `X-Customer-Token` | string | Yes | Customer session token from register or login. |

### Body parameters

| Name | Type | Required | Description |
| --- | --- | --- | --- |
| `name` | string | No | Full name. Maximum 150 characters. |
| `email` | string | No | Valid email address, maximum 255 characters. Lowercased server-side. Must not belong to another customer. Changing it on a non-guest account requires `current_password`. |
| `phone` | string or null | No | Phone number, maximum 50 characters. Send `null` to clear. |
| `current_password` | string | No | Required only when changing `email` on a non-guest account. Never stored; only checked. |

```bash title="Request"
curl -X PATCH https://api.borkol.com/v1/api/customers/me \
  -H "Authorization: Bearer {api_key}" \
  -H "X-Customer-Token: 13|Gh7rS2uX5vWy8zAbCdEfGhIjKlMnOpQrStUvWxYz" \
  -H "Content-Type: application/json" \
  -d '{"name":"Jane A. Doe","phone":"+31612345678"}'
```

Status: `200 OK`. Returns the updated customer.

```json title="Response"
{
  "data": {
    "id": "9d4e2f1a-6b3c-4f8e-9a1d-2c5b7e8f0a3d",
    "name": "Jane A. Doe",
    "email": "jane@example.com",
    "phone": "+31612345678",
    "created_at": "2026-08-14T10:32:11+00:00"
  }
}
```

### Errors

- `422` with `errors.current_password` `["Current password is required to change email."]` when changing the email of a non-guest account without `current_password`, or with a wrong one.
- `422` with `errors.email` `["Email already registered."]` when the new email belongs to another customer.
- `422` for field validation failures.
- `401` `{"message":"Invalid customer token."}` when `X-Customer-Token` is missing or invalid.