Updating your profile

Read your profile, then confirm it's you before changing sensitive details.

Read profile

GET BASE/v1/api/user/profile
Authorization: Bearer <token>

Use this path — not /v1/api/auth/get-session (that returns 404 on purpose).

Account overview (mailbox summary + flags):

GET BASE/v1/api/user/account-overview
Authorization: Bearer <token>

Example data.mailAddress:

{
  "address": "you@daaymail.com",
  "localPart": "you",
  "domain": "daaymail.com",
  "status": "active",
  "storageQuotaBytes": "1073741824",
  "unreadCount": 0,
  "usedBytes": 0
}

Sensitive updates need a second check

Phone, WhatsApp, contact address, and names are sensitive — you confirm it’s really you before changing them. After a successful change there is a cooldown (default 60 days; admins can override).

See what you can use:

GET BASE/v1/api/user/step-up/methods
Authorization: Bearer <token>

You always get email_otp. You also get totp if 2FA is on, and passkey if you registered a passkey.

Email OTP

POST BASE/v1/api/user/step-up/request
Authorization: Bearer <token>

POST BASE/v1/api/user/step-up/confirm
Authorization: Bearer <token>
Content-Type: application/json

{ "method": "email_otp", "code": "123456" }

TOTP (2FA)

No /request call — send a current authenticator code:

POST BASE/v1/api/user/step-up/confirm
Authorization: Bearer <token>
Content-Type: application/json

{ "method": "totp", "code": "123456" }

Passkey

POST BASE/v1/api/user/step-up/passkey/options
Authorization: Bearer <token>

Run navigator.credentials.get() with those options, then:

POST BASE/v1/api/user/step-up/confirm
Authorization: Bearer <token>
Content-Type: application/json

{ "method": "passkey", "response": { /* passkey assertion */ } }

This issues a short-lived step-up grant only — it does not create a new login session.

Use the grant

Confirm responses return something like:

{
  "token": "…",
  "expiresInSeconds": 900,
  "header": "x-step-up-token"
}

PATCH BASE/v1/api/user/profile/sensitive
Authorization: Bearer <token>
x-step-up-token: <token>
Content-Type: application/json

{
  "phoneNumber": "+2348098765432",
  "firstName": "Ada"
}

Setting a banking PIN uses the same header — see Setting a banking PIN.