Update profile

Live

PATCH/api/v1/profile

Update the member's contact info (email / LINE ID / avatar). Full name, phone, and the bank account can only be changed by staff.

Only email / line_id / avatar_url are editable — any other field rejects the whole request (4001). selected_promotion_id is changed via the promotions module.

Headers

Field	Type	Required	Description
Authorization	string	Yes	Used — send Bearer <member access_token>
X-Api-Key	string	Yes	Agent API key (ak_…) from the bo screen
X-Timestamp	string	Yes	Signing time in unix milliseconds (±300s skew allowed)
X-Nonce	string	Yes	Unique per-request value (UUIDv4) for replay protection
X-Signature	string	Yes	hex(HMAC-SHA256(secret, canonical)) — see the Authentication page
X-Player-IP	string	—	The player's real IP (IPv4/IPv6) — recommended (used in login history)
X-Player-UA	string	—	The player's User-Agent (optional — recorded in login history)
X-Request-Id	string	—	Your correlation id — echoed back as request_uuid (recommended)
x-lang	string	—	th (default) or en — the language of message

Request bodyapplication/json

Field	Type	Required	Description
email	string	—	Email (must be a valid email address)
line_id	string	—	LINE ID (max 50 characters)
avatar_url	string	—	Avatar URL (max 500 characters)

Request example

{
  "email": "somchai@example.com",
  "line_id": "somchai_jd"
}

Response

Fields in data

Field	Type	Required	Description
id	string	—	Member id (uuid)
username	string	—	Username (agent prefix + phone)
phone	string \| null	—	Mobile number
full_name	string \| null	—	Full name
email	string \| null	—	Email (updated value)
line_id	string \| null	—	LINE ID (updated value)
avatar_url	string \| null	—	Avatar URL (updated value)
member_tier	string \| null	—	Member tierNEW \| BRONZE \| SILVER \| GOLD \| VIP
status	string	—	Account statusACTIVE \| LOCKED \| BANNED \| PENDING_VERIFICATION
selected_promotion_id	string \| null	—	Deposit bonus the member selected (null = no bonus)
agent_id	string \| null	—	Owning agent id
created_at	string (ISO 8601)	—	Signup time
last_login_at	string (ISO 8601) \| null	—	Last login time
bank	object \| null	—	The bound bank account (read-only)
└ bank_code	string	—	Bank code, e.g. KBANK
└ bank_name	string	—	Bank name (Thai)
└ account_number	string	—	Account number
└ account_name	string	—	Account holder name

Response example

{
  "success": true,
  "code": 0,
  "message": "สำเร็จ",
  "data": {
    "id": "0f1e2d3c-4b5a-6978-8796-a5b4c3d2e1f0",
    "username": "abc0812345678",
    "phone": "0812345678",
    "full_name": "สมชาย ใจดี",
    "email": "somchai@example.com",
    "line_id": "somchai_jd",
    "avatar_url": null,
    "member_tier": "BRONZE",
    "status": "ACTIVE",
    "selected_promotion_id": null,
    "agent_id": "7a6b5c4d-3e2f-4a19-b7c6-d5e4f3a2b1c0",
    "created_at": "2026-06-01T04:12:33.000Z",
    "last_login_at": "2026-07-05T02:41:07.000Z",
    "bank": {
      "bank_code": "KBANK",
      "bank_name": "ธนาคารกสิกรไทย",
      "account_number": "1234567890",
      "account_name": "สมชาย ใจดี"
    }
  },
  "request_uuid": "2e6c9b48-0d75-4f13-a8b2-7c4e1f9d5a36"
}

Possible error codes

code	Name	HTTP	Message
1001	UNAUTHORIZED	401	UnauthorizedMissing Authorization: Bearer header
1007	TOKEN_INVALID	401	Token invalidInvalid/expired access token, or the session was revoked (logout)
1002	FORBIDDEN	403	ForbiddenThe session is a read-only impersonation session — mutations are forbidden
4001	VALIDATION_ERROR	400	Validation errorInvalid field format, or a field other than email / line_id / avatar_url was sent