# Update a Customer

`POST /v2/customers/{id}`

Core API v2, Customers.

Update an existing Customer with the provided details

**Authentication:** Send `Authorization: Bearer <token>`. To authenticate, generate a Secret API Key from your ODUS Dashboard and include it in the `Authorization` header as follows: `Authorization: Bearer <YOUR_SECRET_API_KEY>`

## Parameters

### Path parameters

- `id` (string, required)

## Request body

Content type `application/json`, required.

Type: object (UpdateCustomerRequestDTO).

- `metadata` (map of string to string, nullable): Metadata used by merchants to store additional information about the entity.
- `email` (string (email)): The customer's email. Stored lowercased. Example: `user@gmail.com`.
- `name` (string): The customer's name. Example: `John Doe`.
- `phoneNumber` (string): The customer's phone number. Stored in E.164 format (`+` followed by digits) when it can be validated as a phone number; a number without a country code is resolved against the billing or shipping address country. A number that cannot be validated is stored as sent. Example: `+12015550123`.
- `dateOfBirth` (string (date-time)): The customer's date of birth. Example: `2020-01-01`.
- `gender` (string): The customer's gender. One of `male`, `female`, `other`. Example: `male`.
- `billingAddress` (object (CreateAddressDTO))
  - `firstName` (string)
  - `lastName` (string)
  - `companyName` (string)
  - `line1` (string)
  - `line2` (string)
  - `city` (string)
  - `state` (string)
  - `postalCode` (string)
  - `country` (string)
- `shippingAddress` (object (CreateAddressDTO))
  - `firstName` (string)
  - `lastName` (string)
  - `companyName` (string)
  - `line1` (string)
  - `line2` (string)
  - `city` (string)
  - `state` (string)
  - `postalCode` (string)
  - `country` (string)

## Responses

### `200`

OK

Type: object (CustomerDTO).

- `createdAt` (string (date-time), required): The date and time when the entity was created. Example: `2024-02-18T12:00:00Z`.
- `updatedAt` (string (date-time), required, nullable): The date and time when the entity was last updated. Example: `2024-02-21T12:15:00Z`.
- `metadata` (map of string to string, nullable): Metadata used by merchants to store additional information about the entity.
- `id` (string, required): The ID of the customer. Example: `cus_2QC7PqoUeOxQEWscJJt6B3PkvyL`.
- `email` (string, required): The email of the customer. Example: `user@gmail.com`.
- `name` (string, required, nullable): The name of the customer. Example: `John Doe`.
- `phoneNumber` (string, required, nullable): The phone number of the customer. Numbers submitted since normalisation began are stored in E.164 format (`+` followed by digits) when they could be validated; any other number is returned as it was sent. Example: `+12015550123`.
- `dateOfBirth` (string (date), required, nullable): The date of birth of the customer. Pattern `^(?:(?:\d\d[2468][048]|\d\d[13579][26]|\d\d0[48]|[02468][048]00|[13579][26]00)-02-29|\d{4}-(?:(?:0[13578]|1[02])-(?:0[1-9]|[12]\d|3[01])|(?:0[469]|11)-(?:0[1-9]|[12]\d|30)|(?:02)-(?:0[1-9]|1\d|2[0-8])))$`. Example: `2020-01-01`.
- `gender` (string, required, nullable): The gender of the customer. One of `male`, `female`, `other`. Example: `male`.
- `restrictMit` (boolean): Whether the customer is restricted from making merchant-initiated payments. Only available from the dashboard or the API using a secret key. Example: `false`.
- `restrictCit` (boolean): Whether the customer is restricted from making customer-initiated payments. Only available from the dashboard or the API using a secret key. Example: `false`.
- `restrictReason` (string, nullable): Reason for restricting the customer. Only available from the dashboard or the API using a secret key. Example: `Customer restricted due to suspicious activity`.
- `isRestricted` (boolean): Whether the customer has at least one restriction applied (either `restrictMit` or `restrictCit`). Only available from the dashboard or the API using a secret key. Example: `true`.
- `billingAddress` (object, required): The billing address of the customer.
  - `firstName` (string, required, nullable)
  - `lastName` (string, required, nullable)
  - `companyName` (string, required, nullable)
  - `line1` (string, required, nullable)
  - `line2` (string, required, nullable)
  - `city` (string, required, nullable)
  - `state` (string, required, nullable)
  - `postalCode` (string, required, nullable)
  - `country` (string, required, nullable)
- `shippingAddress` (object, required): The shipping address of the customer.
  - `firstName` (string, required, nullable)
  - `lastName` (string, required, nullable)
  - `companyName` (string, required, nullable)
  - `line1` (string, required, nullable)
  - `line2` (string, required, nullable)
  - `city` (string, required, nullable)
  - `state` (string, required, nullable)
  - `postalCode` (string, required, nullable)
  - `country` (string, required, nullable)

### `202`

The merchant is entitled but its environment is not provisioned yet. Provisioning has been kicked off (exactly once) and is in progress; retry the request — it succeeds once the environment is ready. Returned only for identity-token (dashboard) requests bound to a merchant, not for secret-key API calls; any such endpoint can return it while provisioning is underway.

Type: object (ProvisioningInProgress).

- `status` (string, required): Signals the merchant environment is still being provisioned. One of `provisioning`.
- `merchantAccountId` (string, required): The merchant account whose environment is being provisioned. Example: `dAI3aa87ROOeupeBCjNSKCOBOisBCYjB`.

### Errors

- `400`: The request was rejected. `type` is `invalid_request_error` when the request itself is at fault — `errors` then lists every problem found, with field-attributable entries prefixed by the field’s path; or `invalid_state_error` when the request was well-formed but the resource is not in a state that allows it.
- `401`: No API key was supplied, or the key is not valid. `type` is `authentication_error`.
- `403`: The API key is valid but lacks the permission this operation requires. `type` is `permission_error`.
- `404`: No resource exists with the requested identifier. `type` is `not_found_error`.
- `409`: `type` is `conflict_error`. The supplied `X-Idempotency-Key` was already used with a different request body (`code` is `idempotency_conflict`, and retrying will not help), or the resource is being modified by another in-flight request (`code` is `resource_locked`, and retrying with backoff will).
- `429`: Too many requests. A limit applies per operation; requests to other operations are unaffected. `type` is `rate_limit_error`. Use the `Retry-After-global` header to know when to retry.
- `500`: The request could not be completed because of an unexpected error. `type` is `api_error`.
- `503`: The request could not be served right now: the API is temporarily at capacity, or a dependency needed to authorize the request is unavailable — the auth service that verifies credentials, or the entitlement lookup behind it. `type` is `api_error`. It is raised before the operation runs, so the request had no effect, and unlike a plain 500 the condition is transient: retry with backoff.
- `504`: The request exceeded the processing time limit and was abandoned. `type` is `api_error` and `code` is `timeout` — unlike a plain 500 the request may still have taken effect, so retry with the same idempotency key rather than blindly.

Every error response has the same body: see [Errors](https://docs.odus.com/docs/guides/api-features/errors.md).

---

Generated from the Core API v2 OpenAPI document, https://api.odus.com/openapi.v2.json. Interactive page: https://docs.odus.com/docs/api/core/v2/customer-controller-update