Users

Update User

Updates part of the data of one of your users without sending the full registration again. Only the fields you send with a value change; everything else stays as it is.

Request

Field	Type	Required	Description
Authorization	Header	Yes	`Bearer <access_token>` obtained from POST /api/v1/client/token.
user_id	Path	Yes	Identifier of the user.

Request body

All fields are optional. Send at least one.

Field	Type	Description
tradeName	String	Display name of the user.
person.firstName, person.middleName, person.firstSurname, person.lastName, person.businessName	String	Name fields of the person.
person.pep	Boolean	Whether the user is a Politically Exposed Person. It is stored if the user has no PEP declaration yet. Sending the same value again changes nothing; a different value is rejected with `422`.
person.identificationType, person.identificationNro, person.verificateDigit	String	The identity document cannot be changed. You can send the current values, but any different value is rejected with `422`.
person.contactsData	Array	Contacts to update. Each item has `dataTypeContact` (`EMAIL`, `PHONE` or `ADDRESS`), `dataValue` and optionally `isVerified`. Each type can appear only once. An item with only `isVerified` (no `dataValue`) changes just the verification of that contact; if the user doesn’t have that contact, it is rejected with `422`.
person.additionalInfo	Array	Additional fields to update. Each item has `infoName` and `infoValue`.

How the update works

Fields that are not listed here are rejected with 422 (extra_forbidden, “field not allowed”), even if their value is null. Email and phone go in person.contactsData.
A field that is missing, null or empty is ignored. Nothing is ever deleted through this endpoint.
Contacts are matched by type and additional fields by name: an existing one is replaced, a new one is created.
PHONE must be in E.164 format (for example +573001234567) and EMAIL must be a valid email address. The format is checked only for values that change; sending the current value again is accepted.
A phone number or email cannot belong to another user of your company (409).
If you change the value of a contact and don’t send isVerified, the contact is marked as not verified. If an email differs only in upper/lower case, the stored email is updated and its verification is kept.
The user’s status never changes with this endpoint.
Fields managed by Kravata cannot be changed and are rejected with 422: any additionalInfo name that starts with TERMS or POLICY (terms and policy acceptance), KYC session and results, the KYC form completion date and the country of residence.
DEPARTMENT and CITY_HOME must be a valid department and city of the user’s country of residence.
Name, email and phone changes are also applied to the user’s login profile. If that fails, nothing is updated and you get 502.
Kravata keeps a history of the previous values and sends the user.updated webhook when something changes. If nothing changes, the response is 200 with the current data and no webhook is sent.

Response

The updated user: id, status, tradeName and person (names, identification, contactsData and additionalInfo).

Errors

Errors use the body {"error": {"code", "message", "request_id", "details"}}; details is present on validation errors.

Status	Code	When
400	`BAD_REQUEST`	The request is not valid.
404	`NOT_FOUND`	The user does not exist in your company.
409	`EMAIL_IN_USE`	The email belongs to another user.
409	`PHONE_IN_USE`	The phone belongs to another user.
409	`CONFLICT`	Another request is changing the same email or phone at that moment. Wait a few seconds and retry the same request.
422	`VALIDATION_ERROR`	Invalid format, duplicated contact type or field name, protected field, document change, unknown field, or invalid department/city. `details` lists each field.
422	`INVALID_PROFILE_DATA`	The profile data was rejected when updating the user’s login profile.
502	`UPSTREAM_ERROR`	A service that Kravata depends on failed. Nothing was updated; retry the request.

PATCH

api

provider

users

{user_id}

Update User

curl --request PATCH \
  --url https://test-api-kore.kravata.co/api/v1/provider/users/{user_id} \
  --header 'Authorization: Bearer <token>' \
  --header 'Content-Type: application/json' \
  --data '
{
  "person": {
    "contactsData": [
      {
        "dataTypeContact": "EMAIL",
        "dataValue": "john.doe@example.com"
      },
      {
        "dataTypeContact": "PHONE",
        "dataValue": "+573009876543"
      }
    ]
  }
}
'

import requests

url = "https://test-api-kore.kravata.co/api/v1/provider/users/{user_id}"

payload = { "person": { "contactsData": [
            {
                "dataTypeContact": "EMAIL",
                "dataValue": "john.doe@example.com"
            },
            {
                "dataTypeContact": "PHONE",
                "dataValue": "+573009876543"
            }
        ] } }
headers = {
    "Authorization": "Bearer <token>",
    "Content-Type": "application/json"
}

response = requests.patch(url, json=payload, headers=headers)

print(response.text)

const options = {
  method: 'PATCH',
  headers: {Authorization: 'Bearer <token>', 'Content-Type': 'application/json'},
  body: JSON.stringify({
    person: {
      contactsData: [
        {dataTypeContact: 'EMAIL', dataValue: 'john.doe@example.com'},
        {dataTypeContact: 'PHONE', dataValue: '+573009876543'}
      ]
    }
  })
};

fetch('https://test-api-kore.kravata.co/api/v1/provider/users/{user_id}', options)
  .then(res => res.json())
  .then(res => console.log(res))
  .catch(err => console.error(err));

<?php

$curl = curl_init();

curl_setopt_array($curl, [
  CURLOPT_URL => "https://test-api-kore.kravata.co/api/v1/provider/users/{user_id}",
  CURLOPT_RETURNTRANSFER => true,
  CURLOPT_ENCODING => "",
  CURLOPT_MAXREDIRS => 10,
  CURLOPT_TIMEOUT => 30,
  CURLOPT_HTTP_VERSION => CURL_HTTP_VERSION_1_1,
  CURLOPT_CUSTOMREQUEST => "PATCH",
  CURLOPT_POSTFIELDS => json_encode([
    'person' => [
        'contactsData' => [
                [
                                'dataTypeContact' => 'EMAIL',
                                'dataValue' => 'john.doe@example.com'
                ],
                [
                                'dataTypeContact' => 'PHONE',
                                'dataValue' => '+573009876543'
                ]
        ]
    ]
  ]),
  CURLOPT_HTTPHEADER => [
    "Authorization: Bearer <token>",
    "Content-Type: application/json"
  ],
]);

$response = curl_exec($curl);
$err = curl_error($curl);

curl_close($curl);

if ($err) {
  echo "cURL Error #:" . $err;
} else {
  echo $response;
}

package main

import (
	"fmt"
	"strings"
	"net/http"
	"io"
)

func main() {

	url := "https://test-api-kore.kravata.co/api/v1/provider/users/{user_id}"

	payload := strings.NewReader("{\n  \"person\": {\n    \"contactsData\": [\n      {\n        \"dataTypeContact\": \"EMAIL\",\n        \"dataValue\": \"john.doe@example.com\"\n      },\n      {\n        \"dataTypeContact\": \"PHONE\",\n        \"dataValue\": \"+573009876543\"\n      }\n    ]\n  }\n}")

	req, _ := http.NewRequest("PATCH", url, payload)

	req.Header.Add("Authorization", "Bearer <token>")
	req.Header.Add("Content-Type", "application/json")

	res, _ := http.DefaultClient.Do(req)

	defer res.Body.Close()
	body, _ := io.ReadAll(res.Body)

	fmt.Println(string(body))

}

HttpResponse<String> response = Unirest.patch("https://test-api-kore.kravata.co/api/v1/provider/users/{user_id}")
  .header("Authorization", "Bearer <token>")
  .header("Content-Type", "application/json")
  .body("{\n  \"person\": {\n    \"contactsData\": [\n      {\n        \"dataTypeContact\": \"EMAIL\",\n        \"dataValue\": \"john.doe@example.com\"\n      },\n      {\n        \"dataTypeContact\": \"PHONE\",\n        \"dataValue\": \"+573009876543\"\n      }\n    ]\n  }\n}")
  .asString();

require 'uri'
require 'net/http'

url = URI("https://test-api-kore.kravata.co/api/v1/provider/users/{user_id}")

http = Net::HTTP.new(url.host, url.port)
http.use_ssl = true

request = Net::HTTP::Patch.new(url)
request["Authorization"] = 'Bearer <token>'
request["Content-Type"] = 'application/json'
request.body = "{\n  \"person\": {\n    \"contactsData\": [\n      {\n        \"dataTypeContact\": \"EMAIL\",\n        \"dataValue\": \"john.doe@example.com\"\n      },\n      {\n        \"dataTypeContact\": \"PHONE\",\n        \"dataValue\": \"+573009876543\"\n      }\n    ]\n  }\n}"

response = http.request(request)
puts response.read_body

{
  "id": "3f1a9c2e-7b6d-4e11-9a3f-2c8d6e0b5a17",
  "status": "APPROVED",
  "tradeName": "John Doe",
  "person": {
    "id": "3f1a9c2e-7b6d-4e11-9a3f-2c8d6e0b5a17",
    "firstName": "John",
    "firstSurname": "Doe",
    "identificationType": "CC",
    "identificationNro": "1029384756",
    "contactsData": [
      {
        "dataTypeContact": "EMAIL",
        "dataValue": "john.doe@example.com",
        "isVerified": false
      },
      {
        "dataTypeContact": "PHONE",
        "dataValue": "+573009876543",
        "isVerified": false
      }
    ],
    "additionalInfo": []
  }
}

Authorizations

Authorization

string

header

required

Access token from POST /api/v1/client/token.

Path Parameters

user_id

string<uuid>

required

Identifier of the user.

Body

application/json

tradeName

string

person

object

Show child attributes

Response

200 - application/json

string

status

string

tradeName

string

person

object

Update User

curl --request PATCH \
  --url https://test-api-kore.kravata.co/api/v1/provider/users/{user_id} \
  --header 'Authorization: Bearer <token>' \
  --header 'Content-Type: application/json' \
  --data '
{
  "person": {
    "contactsData": [
      {
        "dataTypeContact": "EMAIL",
        "dataValue": "john.doe@example.com"
      },
      {
        "dataTypeContact": "PHONE",
        "dataValue": "+573009876543"
      }
    ]
  }
}
'

import requests

url = "https://test-api-kore.kravata.co/api/v1/provider/users/{user_id}"

payload = { "person": { "contactsData": [
            {
                "dataTypeContact": "EMAIL",
                "dataValue": "john.doe@example.com"
            },
            {
                "dataTypeContact": "PHONE",
                "dataValue": "+573009876543"
            }
        ] } }
headers = {
    "Authorization": "Bearer <token>",
    "Content-Type": "application/json"
}

response = requests.patch(url, json=payload, headers=headers)

print(response.text)

const options = {
  method: 'PATCH',
  headers: {Authorization: 'Bearer <token>', 'Content-Type': 'application/json'},
  body: JSON.stringify({
    person: {
      contactsData: [
        {dataTypeContact: 'EMAIL', dataValue: 'john.doe@example.com'},
        {dataTypeContact: 'PHONE', dataValue: '+573009876543'}
      ]
    }
  })
};

fetch('https://test-api-kore.kravata.co/api/v1/provider/users/{user_id}', options)
  .then(res => res.json())
  .then(res => console.log(res))
  .catch(err => console.error(err));

<?php

$curl = curl_init();

curl_setopt_array($curl, [
  CURLOPT_URL => "https://test-api-kore.kravata.co/api/v1/provider/users/{user_id}",
  CURLOPT_RETURNTRANSFER => true,
  CURLOPT_ENCODING => "",
  CURLOPT_MAXREDIRS => 10,
  CURLOPT_TIMEOUT => 30,
  CURLOPT_HTTP_VERSION => CURL_HTTP_VERSION_1_1,
  CURLOPT_CUSTOMREQUEST => "PATCH",
  CURLOPT_POSTFIELDS => json_encode([
    'person' => [
        'contactsData' => [
                [
                                'dataTypeContact' => 'EMAIL',
                                'dataValue' => 'john.doe@example.com'
                ],
                [
                                'dataTypeContact' => 'PHONE',
                                'dataValue' => '+573009876543'
                ]
        ]
    ]
  ]),
  CURLOPT_HTTPHEADER => [
    "Authorization: Bearer <token>",
    "Content-Type: application/json"
  ],
]);

$response = curl_exec($curl);
$err = curl_error($curl);

curl_close($curl);

if ($err) {
  echo "cURL Error #:" . $err;
} else {
  echo $response;
}

package main

import (
	"fmt"
	"strings"
	"net/http"
	"io"
)

func main() {

	url := "https://test-api-kore.kravata.co/api/v1/provider/users/{user_id}"

	payload := strings.NewReader("{\n  \"person\": {\n    \"contactsData\": [\n      {\n        \"dataTypeContact\": \"EMAIL\",\n        \"dataValue\": \"john.doe@example.com\"\n      },\n      {\n        \"dataTypeContact\": \"PHONE\",\n        \"dataValue\": \"+573009876543\"\n      }\n    ]\n  }\n}")

	req, _ := http.NewRequest("PATCH", url, payload)

	req.Header.Add("Authorization", "Bearer <token>")
	req.Header.Add("Content-Type", "application/json")

	res, _ := http.DefaultClient.Do(req)

	defer res.Body.Close()
	body, _ := io.ReadAll(res.Body)

	fmt.Println(string(body))

}

HttpResponse<String> response = Unirest.patch("https://test-api-kore.kravata.co/api/v1/provider/users/{user_id}")
  .header("Authorization", "Bearer <token>")
  .header("Content-Type", "application/json")
  .body("{\n  \"person\": {\n    \"contactsData\": [\n      {\n        \"dataTypeContact\": \"EMAIL\",\n        \"dataValue\": \"john.doe@example.com\"\n      },\n      {\n        \"dataTypeContact\": \"PHONE\",\n        \"dataValue\": \"+573009876543\"\n      }\n    ]\n  }\n}")
  .asString();

require 'uri'
require 'net/http'

url = URI("https://test-api-kore.kravata.co/api/v1/provider/users/{user_id}")

http = Net::HTTP.new(url.host, url.port)
http.use_ssl = true

request = Net::HTTP::Patch.new(url)
request["Authorization"] = 'Bearer <token>'
request["Content-Type"] = 'application/json'
request.body = "{\n  \"person\": {\n    \"contactsData\": [\n      {\n        \"dataTypeContact\": \"EMAIL\",\n        \"dataValue\": \"john.doe@example.com\"\n      },\n      {\n        \"dataTypeContact\": \"PHONE\",\n        \"dataValue\": \"+573009876543\"\n      }\n    ]\n  }\n}"

response = http.request(request)
puts response.read_body

{
  "id": "3f1a9c2e-7b6d-4e11-9a3f-2c8d6e0b5a17",
  "status": "APPROVED",
  "tradeName": "John Doe",
  "person": {
    "id": "3f1a9c2e-7b6d-4e11-9a3f-2c8d6e0b5a17",
    "firstName": "John",
    "firstSurname": "Doe",
    "identificationType": "CC",
    "identificationNro": "1029384756",
    "contactsData": [
      {
        "dataTypeContact": "EMAIL",
        "dataValue": "john.doe@example.com",
        "isVerified": false
      },
      {
        "dataTypeContact": "PHONE",
        "dataValue": "+573009876543",
        "isVerified": false
      }
    ],
    "additionalInfo": []
  }
}

Guides

API reference

Update User

Request

Request body

How the update works

Response

Errors

Authorizations

Path Parameters

Body

Response