Skip to main content
PATCH
Update the details of an existing customer, such as correcting a misspelled name or refreshing an email or phone number that has changed. Identify the customer by the Soap customer_id (the cus_ id returned when the customer was created) in the URL. Since this is a PATCH request, only the fields you include in the request body are changed, and any fields you leave out keep their current values. PUT on the same path is accepted as an alias and behaves identically. Updates are always scoped to the customer belonging to the merchant whose API key is used. Every Soap API request is authenticated with a bearer token in the Authorization header:
Your API key is in the Soap Dashboard under the Developers section. It looks like key_.... Requests with a missing or invalid API key return 422 — never 401 — with a JSON error field, usually {"error": "API key not found."}. Branch on the status code rather than the message: GET /api/v1/device_pings/latest_geo_check does not yet return the same wording. Never expose your API key in client-side code — it is server-side only.
At least one updatable field (first_name, last_name, email, phone_number, date_of_birth) must be provided, and any unrecognized field will cause the request to be rejected.
Legal name. In production, when KYC is enabled for a checkout type, every checkout of that type with a verified identity checks that the verified identity’s name is consistent with the profile’s first_name and last_name as they are at that moment, so a PATCH made before the checkout takes effect on it. Use the customer’s legal first name and surname as shown on their ID, with no nicknames, middle names, initials or suffixes in those fields. A mismatch restricts the customer with reason code KYC_DOES_NOT_MATCH_PROFILE_NAME; correct the profile here and then lift the restriction in the dashboard.

Authorizations

Authorization
string
header
required

Bearer token authentication using your API key (key_...). Used for every endpoint except POST /api/v1/device_pings.

Path Parameters

id
string
required

Unique Soap identifier of the customer to update (the cus_ id returned at creation).

Example:

"cus_pQsQ4kz3Af6Mb9rCupnWj6VFzxJsmkYK"

Body

application/json

At least one updatable field must be present. Unknown fields are rejected.

email
string<email>

Email address of the customer. Must be unique within your business.

Example:

"john@acme.com"

first_name
string

Customer's legal first name as shown on their ID, with no nicknames, middle names or initials. In production this is checked against the verified identity on KYC-enabled checkouts.

Minimum string length: 1
Example:

"John"

last_name
string

Customer's legal surname as shown on their ID, with no suffixes. In production this is checked against the verified identity on KYC-enabled checkouts.

Minimum string length: 1
Example:

"Doe"

phone_number
string

10-digit US phone number with no country code, spaces or punctuation (for example 5551234567). Must be unique within your business.

Pattern: ^\d{10}$
Example:

"8008001234"

date_of_birth
string<date>

Date of birth of the customer as YYYY-MM-DD.

Example:

"1990-01-01"

Response

Customer updated.

id
string

Unique identifier for the customer to be used for future transactions.

Example:

"cus_pQsQ4kz3Af6Mb9rCupnWj6VFzxJsmkYK"

internal_id

Your identifier for the customer, as supplied; null when none was given.

Example:

"3f1b8c4e-7c2e-4c2c-8d2f-179cf0efb36b"

email
string | null
Example:

"john@acme.com"

first_name
string | null

Null only on accounts configured to create customers without names.

Example:

"John"

last_name
string | null

Null only on accounts configured to create customers without names.

Example:

"Doe"

phone_number
string | null
Example:

"8008001234"

date_of_birth
string<date> | null
Example:

"1990-01-01"

created_at
string<date-time>
Example:

"2025-03-05T18:26:43.069Z"

updated_at
string<date-time>
Example:

"2025-03-10T16:08:14.427Z"