PUT /v3/user/profile — partial update

PUT

/v3/user/profile

const url = 'https://api-ha-prod-p8.handbid.dev/v3/user/profile';
const options = {
  method: 'PUT',
  headers: {Authorization: 'Bearer <token>', 'Content-Type': '*/*'},
  body: '"{\n  \"firstName\": \"Taylor\",\n  \"lastName\": \"Pearce\",\n  \"displayName\": \"Tay\",\n  \"company\": \"Acme Co\",\n  \"countryCode\": \"US\",\n  \"userCellPhone\": \"3035551234\"\n}"'
};

try {
  const response = await fetch(url, options);
  const data = await response.json();
  console.log(data);
} catch (error) {
  console.error(error);
}

curl --request PUT \
  --url https://api-ha-prod-p8.handbid.dev/v3/user/profile \
  --header 'Authorization: Bearer <token>' \
  --header 'Content-Type: */*' \
  --data '"{\n  \"firstName\": \"Taylor\",\n  \"lastName\": \"Pearce\",\n  \"displayName\": \"Tay\",\n  \"company\": \"Acme Co\",\n  \"countryCode\": \"US\",\n  \"userCellPhone\": \"3035551234\"\n}"'

NEW (HAN-2040, 2026-06-05). Partial update of the editable profile scalars. Auth required. No mass-assignment: an allowlist of editable keys only.

Editable fields (any subset): displayName, firstName, lastName, countryCode, userCellPhone, company.

Any other key in the body — including email, profilePhotoUrl, identity, usersGuid, shippingAddress — is rejected.

Response (204 No Content): empty body. Re-read via GET /v3/user/profile.

Validation:

countryCode — ISO 3166-1 alpha-2; an unknown code → 400 validation_error. It also acts as the region hint for userCellPhone in the same request, so an atomic country+phone change validates the phone against the new country.
userCellPhone — libphonenumber format check only (no Twilio reachability lookup on profile save). Numbers with a leading + are parsed as E.164; otherwise the effective country (this request’s countryCode, else the user’s current) is the region hint. Invalid → 400 invalid_phone.

Errors: 422 validation_error (non-editable / unknown key, lists the offending fields), 400 validation_error (bad countryCode), 400 invalid_phone, 401 anonymous.

Side-effects: users.save() fires event.user (HbNodeEvent::EVENT_USER_UPDATE) and invalidates the legacy bidder_index_user_{env}_{id} cache, so V1 bidder/index readers stay fresh during the V3 transition.

Rate limit: userProfileUpdate.

Authorizations

bearer

Request Body

*/*

string

Example

"{\n  \"firstName\": \"Taylor\",\n  \"lastName\": \"Pearce\",\n  \"displayName\": \"Tay\",\n  \"company\": \"Acme Co\",\n  \"countryCode\": \"US\",\n  \"userCellPhone\": \"3035551234\"\n}"

Responses

200

Successful response

application/json