> ## Documentation Index
> Fetch the complete documentation index at: https://codebyahmed.mintlify.site/llms.txt
> Use this file to discover all available pages before exploring further.

# User Profile — Get and Update Your Account Details

> Retrieve your current profile or update your display name. Use PATCH /users/me to change first or last name; email and phone require separate flows.

Your profile holds the core identity fields tied to your account — names, email, phone number, role, and email verification status. Use `GET /users/me` to read the current state at any time, `PATCH /users/me` to update your display name, and `DELETE /users/me` to permanently close your account. Changing your email or phone number requires dedicated verification flows described in the [Email Change](/api-reference/users/email-change) and [Phone Change](/api-reference/users/phone-change) guides.

## Get Your Profile

Fetch the full profile for the currently authenticated user. No request body is needed — the server identifies you from your session cookie.

**`GET /users/me`**

<CodeGroup>
  ```bash cURL theme={null}
  curl -X GET https://api.example.com/api/v1/users/me \
    --cookie "session=<your-session-cookie>"
  ```

  ```javascript JavaScript theme={null}
  const response = await fetch("https://api.example.com/api/v1/users/me", {
    method: "GET",
    credentials: "include",
  });
  const { data } = await response.json();
  console.log(data);
  ```

  ```python Python theme={null}
  import requests

  resp = requests.get(
      "https://api.example.com/api/v1/users/me",
      cookies={"session": "<your-session-cookie>"},
  )
  print(resp.json()["data"])
  ```
</CodeGroup>

### Response — 200 OK

```json theme={null}
{
  "success": true,
  "data": {
    "public_id": "usr_01H",
    "first_name": "Jane",
    "last_name": "Doe",
    "email": "jane@example.com",
    "phone_number": "+14155552671",
    "role": "CUSTOMER",
    "email_verified": true
  }
}
```

<Expandable title="Response fields">
  <ResponseField name="public_id" type="string" required>
    Immutable account identifier. Always prefixed with `usr_`.
  </ResponseField>

  <ResponseField name="first_name" type="string" required>
    The user's first name, 1–100 characters.
  </ResponseField>

  <ResponseField name="last_name" type="string" required>
    The user's last name, 1–100 characters.
  </ResponseField>

  <ResponseField name="email" type="string" required>
    The verified or unverified email address on the account.
  </ResponseField>

  <ResponseField name="phone_number" type="string" required>
    E.164-formatted phone number, e.g. `+14155552671`.
  </ResponseField>

  <ResponseField name="role" type="string" required>
    Account privilege level. One of `CUSTOMER`, `ADMIN`, or `SUPER_ADMIN`.
  </ResponseField>

  <ResponseField name="email_verified" type="boolean" required>
    `true` if the account email has been confirmed via the verification link.
  </ResponseField>
</Expandable>

***

## Update Your Profile

Change your first name, last name, or both. Supply at least one field — the API rejects a body that contains neither. Each value is trimmed automatically and must be between 1 and 100 characters after trimming.

**`PATCH /users/me`**

<Note>
  Before sending a `PATCH` request, call `GET /auth/csrf-token` to obtain a CSRF token and include it in the `x-csrf-token` header.
</Note>

### Request Body

<ParamField body="first_name" type="string">
  Updated first name. Must be 1–100 characters after trimming. Optional if `last_name` is provided.
</ParamField>

<ParamField body="last_name" type="string">
  Updated last name. Must be 1–100 characters after trimming. Optional if `first_name` is provided.
</ParamField>

<CodeGroup>
  ```bash cURL theme={null}
  # Step 1 — get CSRF token
  CSRF=$(curl -s -X GET https://api.example.com/api/v1/auth/csrf-token \
    --cookie "session=<your-session-cookie>" | jq -r '.data.csrf_token')

  # Step 2 — update profile
  curl -X PATCH https://api.example.com/api/v1/users/me \
    --cookie "session=<your-session-cookie>" \
    -H "x-csrf-token: $CSRF" \
    -H "Content-Type: application/json" \
    -d '{"first_name": "Janet", "last_name": "Smith"}'
  ```

  ```javascript JavaScript theme={null}
  // Step 1 — get CSRF token
  const { data: csrfData } = await fetch(
    "https://api.example.com/api/v1/auth/csrf-token",
    { credentials: "include" }
  ).then((r) => r.json());

  // Step 2 — update profile
  const response = await fetch("https://api.example.com/api/v1/users/me", {
    method: "PATCH",
    credentials: "include",
    headers: {
      "Content-Type": "application/json",
      "x-csrf-token": csrfData.csrf_token,
    },
    body: JSON.stringify({ first_name: "Janet", last_name: "Smith" }),
  });
  ```

  ```python Python theme={null}
  import requests

  session = requests.Session()
  session.cookies.set("session", "<your-session-cookie>")

  # Step 1 — get CSRF token
  csrf = session.get(
      "https://api.example.com/api/v1/auth/csrf-token"
  ).json()["data"]["csrf_token"]

  # Step 2 — update profile
  resp = session.patch(
      "https://api.example.com/api/v1/users/me",
      headers={"x-csrf-token": csrf},
      json={"first_name": "Janet", "last_name": "Smith"},
  )
  print(resp.json())
  ```
</CodeGroup>

### Response — 200 OK

```json theme={null}
{
  "success": true,
  "data": {}
}
```

### Error Responses

| Status | Meaning                                                                   |
| ------ | ------------------------------------------------------------------------- |
| `400`  | Validation failed — no fields supplied, or a name exceeds 100 characters. |
| `401`  | Missing or expired session cookie.                                        |

***

## Delete Your Account

Soft-delete your account by supplying your current password. All active sessions are immediately revoked and your session cookie is cleared. The server responds with `204 No Content` on success.

**`DELETE /users/me`**

<Warning>
  Account deletion is **irreversible via the API**. Once deleted, your profile, order history, and personal data are permanently deactivated and cannot be restored through any self-service endpoint. Contact support if you believe the deletion was made in error.
</Warning>

### Request Body

<ParamField body="password" type="string" required>
  Your current account password, used to confirm the deletion request.
</ParamField>

<CodeGroup>
  ```bash cURL theme={null}
  # Step 1 — get CSRF token
  CSRF=$(curl -s -X GET https://api.example.com/api/v1/auth/csrf-token \
    --cookie "session=<your-session-cookie>" | jq -r '.data.csrf_token')

  # Step 2 — delete account
  curl -X DELETE https://api.example.com/api/v1/users/me \
    --cookie "session=<your-session-cookie>" \
    -H "x-csrf-token: $CSRF" \
    -H "Content-Type: application/json" \
    -d '{"password": "S3cure!Pass"}'
  ```

  ```javascript JavaScript theme={null}
  const { data: csrfData } = await fetch(
    "https://api.example.com/api/v1/auth/csrf-token",
    { credentials: "include" }
  ).then((r) => r.json());

  const response = await fetch("https://api.example.com/api/v1/users/me", {
    method: "DELETE",
    credentials: "include",
    headers: {
      "Content-Type": "application/json",
      "x-csrf-token": csrfData.csrf_token,
    },
    body: JSON.stringify({ password: "S3cure!Pass" }),
  });
  // 204 No Content on success
  ```
</CodeGroup>

### Response — 204 No Content

No response body is returned. After receiving a `204`, treat the session as terminated and redirect the user to your sign-in page.

### Error Responses

| Status | Meaning                                        |
| ------ | ---------------------------------------------- |
| `400`  | Missing or malformed request body.             |
| `401`  | Wrong password, or session is already expired. |