> ## Documentation Index
> Fetch the complete documentation index at: https://docs.puffle.ai/llms.txt
> Use this file to discover all available pages before exploring further.

# Update Profile

> Update profile name fields; email and password stay dashboard-session only

**CLI:**

```bash theme={null}
puffle account update --first-name <first-name> --last-name <last-name>
```

## Overview

The public Bearer-token API can update profile name fields (`firstName`, `lastName`) for the current user.

`email` and `password` are browser-session-only fields. Bearer API keys and generated CLI commands cannot change login credentials; those attempts return `403`. A signed-in human must make credential changes through the dashboard session. Email changes also require the human to confirm the verification message before the new login email takes effect.

## AI agent notes

For public API use, send at least one of `firstName` or `lastName`. Read [Get Profile](/api-reference/accounts/get-account) after a successful update and confirm the returned profile value before reporting completion.

Do not attempt `email` or `password` changes with an API key, even if the user asks. Direct the human to the signed-in dashboard. On `403`, do not retry with the same Bearer credential; on `400` or `422`, correct the profile payload only after surfacing the validation message.


## OpenAPI

````yaml patch /api/account
openapi: 3.0.3
info:
  title: Puffle API
  version: 1.0.0
  description: >-
    HTTP API for the Puffle GTM platform - Feed and Lead Finder search
    preparation, campaign-backed Outbound execution, Puffle Agent runs, sender
    management, and Unibox reply workflows. Designed for operation by both
    humans and autonomous AI agents. Agents should start at the [Agent
    Playbook](/guides/agent-playbook) which prescribes a workspace-context check
    (`GET /api/context`) and core user journeys with exact call ordering.
  contact:
    name: Puffle Support
    url: https://puffle.ai
servers:
  - url: https://app.puffle.ai
    description: Production
security:
  - bearerAuth: []
tags:
  - name: Campaigns
    description: >-
      Campaign-backed Outbound execution. These endpoints manage draft,
      launching, active, paused, and completed Outbound runs with sequence
      nodes, contacts, and sender accounts.
  - name: Accounts
    description: Signed-in user account, settings, and workspace context endpoints.
  - name: Billing
    description: Billing customer portal and account billing endpoints.
  - name: Senders
    description: >-
      Connected sender accounts, email inboxes, sending domains, DNS
      verification, warmup, and sender capacity.
  - name: Socials
    description: >-
      Read connected LinkedIn and X accounts, review current and archived posts,
      and reconcile publication status. Creating, editing, scheduling,
      publishing, OAuth connection, analytics, and mentions remain
      dashboard-managed workflows and are not part of the public Bearer-token
      API.
paths:
  /api/account:
    patch:
      tags:
        - Accounts
      summary: Update Profile
      description: >-
        Update the current user's profile name. Email and password fields
        require an authenticated browser session and return 403 to Bearer
        API-key callers; email changes take effect only after verification.
      operationId: updateAccount
      parameters: []
      requestBody:
        required: true
        content:
          application/json:
            schema:
              type: object
              properties:
                email:
                  type: string
                  format: email
                  description: >-
                    New login email. Browser-session only; Bearer API keys
                    receive 403.
                password:
                  type: string
                  minLength: 8
                  description: >-
                    New login password. Browser-session only; Bearer API keys
                    receive 403.
                firstName:
                  description: >-
                    Profile first name. Supported with browser sessions or
                    Bearer API keys.
                  type: string
                  nullable: true
                lastName:
                  description: >-
                    Profile last name. Supported with browser sessions or Bearer
                    API keys.
                  type: string
                  nullable: true
              additionalProperties: false
      responses:
        '200':
          description: Successful response.
        '400':
          description: Bad request.
        '401':
          description: Unauthorized.
        '403':
          description: Forbidden.
        '409':
          description: Email already registered.
        '422':
          description: Auth validation failed.
        '500':
          description: Internal server error.
        '502':
          description: Verification email delivery failed.
components:
  securitySchemes:
    bearerAuth:
      type: http
      scheme: bearer
      bearerFormat: pk_live_...

````