Update Visitor Account

Updates the signed-in visitor's own profile: name, phone numbers and photo URL. Send only the fields you want to change.

PATCH/v1/account

Authentication

Public key + visitor?key=pk_… · Authorization: Bearer

Public key in the `key` query parameter, plus the signed-in visitor's access token as `Authorization: Bearer`.

Edge cache: no-store

Query Parameters

keystring

required

The site's public key (pk_…). It selects the account. Safe to ship to the browser.

Body Parameters

namestring

optional

Full name, 3 to 120 characters.

phonesarray

optional

Replaces the phone numbers: up to 10 strings of 1 to 40 characters each.

imagestring | null

optional

Profile photo as an `https://` URL (up to 2048 characters), usually the `publicUrl` from Upload Account Photo. `null` removes the photo.

Responses

200Success

application/json

titlestring

hideToastboolean

typestring

variantstring

messagestring

Errors

400Invalid body (message names the first problem), an unknown field such as `email` or `password`, or an empty body (`Nothing to update`).

401`Sign in required`: missing, expired or wrong-site access token.

403The token does not belong to a site visitor (for example a dashboard user), so there is no visitor profile to edit. Also returned with `code: "TENANT_INACTIVE"` when the Panda account is not active.

404The visitor's contact was not found.

Notes

The body is strict: any field other than `name`, `phones` and `image` is rejected. Email and password change only through the auth flows.
The change is logged in the contact's CRM activity and the site owner is notified.

Request

curl --request PATCH \
  --url "https://api.pandaidx.com/v1/account?key={{public_key}}" \
  --header "Authorization: Bearer {{visitor_token}}" \
  --header "Content-Type: application/json" \
  --data '{"name":"Alex Example"}'

Response200 OK

{
  "title": "Profile updated successfully",
  "hideToast": true,
  "type": "success",
  "variant": "default",
  "message": "Profile updated successfully"
}