Source: https://ailoot.ai/docs/cabinet/profile/ Canonical: https://ailoot.ai/docs/en/cabinet/profile/ Language: en [Dashboard API](https://ailoot.ai/docs/en/) # Profile and security [Markdown](https://ailoot.ai/docs/en/cabinet/profile/index.md) Methods, request fields, and responses. This section contains 6 methods. Open a method to view access requirements, request fields, and the response. | Method and path | Description | Access | | --- | --- | --- | | `PUT /api/v1/user` | Update profile | Dashboard token | | `GET /api/v1/user/passkeys` | List passkeys | Dashboard token | | `PUT /api/v1/user/password` | Change password | Dashboard token | | `GET /api/v1/user/profile` | Profile, balance, and bindings | Dashboard token | | `GET /api/v1/user/totp/status` | 2FA status (TOTP) | Dashboard token | | `GET /api/v1/user/totp/verification-method` | TOTP verification method | Dashboard token | **PUT /api/v1/user** — Update profile Access: Dashboard token PUT`/api/v1/user` ## JSON / form fields | The field | Type | Required | Validation / description | | --- | --- | --- | --- | | `username` | `string` | no | ; may be null | | `avatar_url` | `string` | no | ; may be null | | `balance_notify_enabled` | `boolean` | no | ; may be null | | `balance_notify_threshold` | `number` | no | ; may be null | Request body template ```json { "username": "PLACEHOLDER_USERNAME (string)", "avatar_url": "PLACEHOLDER_AVATAR_URL (string)", "balance_notify_enabled": "PLACEHOLDER_BALANCE_NOTIFY_ENABLED (boolean)", "balance_notify_threshold": "PLACEHOLDER_BALANCE_NOTIFY_THRESHOLD (number)" } ``` PLACEHOLDER represents your input and its type. Replace the values and keep only the optional fields you need. Do not send string placeholders in place of numbers, booleans, objects, or arrays. Request schema: `UpdateProfileRequest` ## Response The JSON response contains code, message, and data. The data contents are described in the schemas below. Response data schemas: `User`, `UserProfileResponse`. See the Data schemas pages for fields and types. Response schema with illustrative values ```json { "code": 0, "message": "success", "data": { "id": "PLACEHOLDER_ID (integer)", "email": "PLACEHOLDER_EMAIL (string)", "username": "PLACEHOLDER_USERNAME (string)", "role": "PLACEHOLDER_ROLE (string)", "balance": "PLACEHOLDER_BALANCE (number)", "frozen_balance": "PLACEHOLDER_FROZEN_BALANCE (number)", "concurrency": "PLACEHOLDER_CONCURRENCY (integer)", "status": "PLACEHOLDER_STATUS (string)", "last_active_at": "PLACEHOLDER_LAST_ACTIVE_AT (string)", "created_at": "PLACEHOLDER_CREATED_AT (string)", "updated_at": "PLACEHOLDER_UPDATED_AT (string)", "deleted_at": "PLACEHOLDER_DELETED_AT (string)", "balance_notify_enabled": "PLACEHOLDER_BALANCE_NOTIFY_ENABLED (boolean)", "balance_notify_threshold_type": "PLACEHOLDER_BALANCE_NOTIFY_THRESHOLD_TYPE (string)", "balance_notify_threshold": "PLACEHOLDER_BALANCE_NOTIFY_THRESHOLD (number)", "balance_notify_extra_emails": "PLACEHOLDER_BALANCE_NOTIFY_EXTRA_EMAILS (array)", "total_recharged": "PLACEHOLDER_TOTAL_RECHARGED (number)", "rpm_limit": "PLACEHOLDER_RPM_LIMIT (integer)", "api_keys": "PLACEHOLDER_API_KEYS (array)", "avatar_url": "PLACEHOLDER_AVATAR_URL (string)", "email_bound": "PLACEHOLDER_EMAIL_BOUND (boolean)" } } ``` Note: all personal data and objects are scoped to the JWT subject. Note: this operation changes state or continues a one-time authentication flow. The example describes the contract and is not executed. Note: key spending limits (quota, quota\_used) are returned in key responses, not in the profile. frozen\_balance is the reserved amount; do not treat it as available balance. This method changes data. Resending is safe only where the method specifies Idempotency-Key. If the response is lost, first check the result—for example, the key list—before deciding whether to resend the request. **GET /api/v1/user/passkeys** — List passkeys Access: Dashboard token GET`/api/v1/user/passkeys` Read operation; use an ID from your previous response ```bash curl --fail-with-body "https://ailoot.ai/api/v1/user/passkeys" \ -H "Authorization: Bearer $TOKEN" ``` No request body is required. Send the parameters listed above in the URL. ## Response The JSON response contains code, message, and data. The data contents are described in the schemas below. Response data schemas: `PasskeyCredentialSummary`. See the Data schemas pages for fields and types. Response schema with illustrative values ```json { "code": 0, "message": "success", "data": { "id": "PLACEHOLDER_ID (integer)", "name": "PLACEHOLDER_NAME (string)", "created_at": "PLACEHOLDER_CREATED_AT (string)", "last_used_at": "PLACEHOLDER_LAST_USED_AT (string)", "backup": "PLACEHOLDER_BACKUP (boolean)" } } ``` Note: all personal data and objects are scoped to the JWT subject. Note: credential comes from navigator.credentials; session\_token comes from begin. The finish body must be \<=65536 bytes. Registration and deletion require a password. **PUT /api/v1/user/password** — Change password Access: Dashboard token PUT`/api/v1/user/password` ## JSON / form fields | The field | Type | Required | Validation / description | | --- | --- | --- | --- | | `old_password` | `string` | yes | required | | `new_password` | `string` | yes | required,min=6 | Request body template ```json { "old_password": "PLACEHOLDER_OLD_PASSWORD (string)", "new_password": "PLACEHOLDER_NEW_PASSWORD (string)" } ``` PLACEHOLDER represents your input and its type. Replace the values and keep only the optional fields you need. Do not send string placeholders in place of numbers, booleans, objects, or arrays. Request schema: `ChangePasswordRequest` ## Response The JSON response contains code, message, and data. The data contents are described in the schemas below. Response schema with illustrative values ```json { "code": 0, "message": "success", "data": { "message": "VALUE_FROM_RESPONSE" } } ``` Note: all personal data and objects are scoped to the JWT subject. Note: this operation changes state or continues a one-time authentication flow. The example describes the contract and is not executed. This method changes data. Resending is safe only where the method specifies Idempotency-Key. If the response is lost, first check the result—for example, the key list—before deciding whether to resend the request. **GET /api/v1/user/profile** — Profile, balance, and bindings Access: Dashboard token GET`/api/v1/user/profile` Read operation; use an ID from your previous response ```bash curl --fail-with-body "https://ailoot.ai/api/v1/user/profile" \ -H "Authorization: Bearer $TOKEN" ``` No request body is required. Send the parameters listed above in the URL. ## Response The JSON response contains code, message, and data. The data contents are described in the schemas below. Response data schemas: `User`, `UserProfileResponse`. See the Data schemas pages for fields and types. Response schema with illustrative values ```json { "code": 0, "message": "success", "data": { "id": "PLACEHOLDER_ID (integer)", "email": "PLACEHOLDER_EMAIL (string)", "username": "PLACEHOLDER_USERNAME (string)", "role": "PLACEHOLDER_ROLE (string)", "balance": "PLACEHOLDER_BALANCE (number)", "frozen_balance": "PLACEHOLDER_FROZEN_BALANCE (number)", "concurrency": "PLACEHOLDER_CONCURRENCY (integer)", "status": "PLACEHOLDER_STATUS (string)", "last_active_at": "PLACEHOLDER_LAST_ACTIVE_AT (string)", "created_at": "PLACEHOLDER_CREATED_AT (string)", "updated_at": "PLACEHOLDER_UPDATED_AT (string)", "deleted_at": "PLACEHOLDER_DELETED_AT (string)", "balance_notify_enabled": "PLACEHOLDER_BALANCE_NOTIFY_ENABLED (boolean)", "balance_notify_threshold_type": "PLACEHOLDER_BALANCE_NOTIFY_THRESHOLD_TYPE (string)", "balance_notify_threshold": "PLACEHOLDER_BALANCE_NOTIFY_THRESHOLD (number)", "balance_notify_extra_emails": "PLACEHOLDER_BALANCE_NOTIFY_EXTRA_EMAILS (array)", "total_recharged": "PLACEHOLDER_TOTAL_RECHARGED (number)", "rpm_limit": "PLACEHOLDER_RPM_LIMIT (integer)", "api_keys": "PLACEHOLDER_API_KEYS (array)", "avatar_url": "PLACEHOLDER_AVATAR_URL (string)", "email_bound": "PLACEHOLDER_EMAIL_BOUND (boolean)" } } ``` Note: all personal data and objects are scoped to the JWT subject. Note: key spending limits (quota, quota\_used) are returned in key responses, not in the profile. frozen\_balance is the reserved amount; do not treat it as available balance. **GET /api/v1/user/totp/status** — 2FA status (TOTP) Access: Dashboard token GET`/api/v1/user/totp/status` Read operation; use an ID from your previous response ```bash curl --fail-with-body "https://ailoot.ai/api/v1/user/totp/status" \ -H "Authorization: Bearer $TOKEN" ``` No request body is required. Send the parameters listed above in the URL. ## Response The JSON response contains code, message, and data. The data contents are described in the schemas below. Response data schemas: `TotpStatusResponse`. See the Data schemas pages for fields and types. Response schema with illustrative values ```json { "code": 0, "message": "success", "data": { "enabled": "PLACEHOLDER_ENABLED (boolean)", "enabled_at": "PLACEHOLDER_ENABLED_AT (integer)", "feature_enabled": "PLACEHOLDER_FEATURE_ENABLED (boolean)" } } ``` Note: all personal data and objects are scoped to the JWT subject. Note: secret and setup\_token are secrets. Verification depends on the TOTP and user settings. **GET /api/v1/user/totp/verification-method** — TOTP verification method Access: Dashboard token GET`/api/v1/user/totp/verification-method` Read operation; use an ID from your previous response ```bash curl --fail-with-body "https://ailoot.ai/api/v1/user/totp/verification-method" \ -H "Authorization: Bearer $TOKEN" ``` No request body is required. Send the parameters listed above in the URL. ## Response The JSON response contains code, message, and data. The data contents are described in the schemas below. Response schema with illustrative values ```json { "code": 0, "message": "success", "data": { "method": "email" } } ``` Note: all personal data and objects are scoped to the JWT subject. Note: secret and setup\_token are secrets. Verification depends on the TOTP and user settings. ## TotpVerificationMethod ```json { "type": "object", "required": [ "method" ], "properties": { "method": { "type": "string", "enum": [ "email", "password" ] } } } ``` Still have questions? Send your Request ID and a description — we'll help you troubleshoot.[Contact support](mailto:support@ailoot.ai) ## Ailoot · The company and its project portfolio Ailoot combines established operating experience, a large client base, stable service and ongoing KPI control. The company and its project portfolio: millions of customers; monthly sales in the billions. Ailoot brings that operating experience to API access for AI features in customer products, agents, applications and automations.