Changes the caller's own name or address.
Errors
400 when a value fails its rule, 401 when the password is wrong, 403
when an API token was used, 409 when the name or address is taken.
sessiontessera_session<token>Set by POST /auth/login. A browser sends it automatically; it is HttpOnly, so page scripts cannot read or set it.
application/json- body
Body of PATCH /account.
current_password?|The current password.
Required even though the caller is signed in. Otherwise an unlocked browser left on a desk is enough to move the account's address to one the finder controls, after which the reset flow hands them the account.
Omitted by an account without one (has_password: false); see
reauthentication_required.
8 <= length <= 1024email?|A new address, or omitted to keep the current one.
Changing it clears the verification: the new address has not been proven reachable, and carrying the old flag over would mean an unverified address wearing a verified one's badge.
emailusername?|A new name, or omitted to keep the current one.
^[a-zA-Z0-9][a-zA-Z0-9_-]*$3 <= length <= 32The account as it now stands
application/json- response
An account, as the API describes it. Never carries a hash.
email*stringNormalised address.
email_verified_at?|When the address was last proven to reach this user, or null if never.
Set by confirming a registration, by a provider vouching for the
address, or by following the link from
POST /account/email/verification. Cleared when the address changes.
date-timehas_password*booleanWhether the account has a password.
An account created through GitHub, Discord or OIDC has none. It confirms
changes by having signed in within the last few minutes instead of by
typing one, so a client shows a password field only when this is
true; see reauthentication_required.
id*stringStable identifier.
is_admin*booleanWhether the account holds the seeded administrator role.
Kept because clients read it, but derived and not stored, and narrower
than permissions. An account in a role granting users:read
and nothing else is not an administrator, yet reaches one administrative
endpoint. New clients should read permissions.
must_change_password*booleanWhether the account must set a new password before doing anything else.
Set on the administrator generated at first run. A client seeing this should send the user to a change-password screen and nowhere else.
permissions*array<string>Everything this account is allowed to do.
resource:verb strings, and what a client should decide from. A screen
guessing from is_admin is wrong for every role between "member" and
"everything".
quota_bytes?|A storage quota set on this one account, overriding its role's.
null means the role's applies; 0 means this account has no ceiling
of its own. What is actually left is storage_remaining_bytes on
/capabilities, which accounts for what has been used.
int640 <= valueroles*array<string>The roles it is in, by name.
username*stringNormalised account name.
curl -X PATCH 'https://example.com/api/v1/account' \ -H 'Content-Type: application/json' \ -d '{}'{ "email": "string", "email_verified_at": "2019-08-24T14:15:22Z", "has_password": true, "id": "string", "is_admin": true, "must_change_password": true, "permissions": [ "string" ], "quota_bytes": 0, "roles": [ "string" ], "username": "string"}