account context overview
The v1 account context (base path /v1/account, audience account) — endpoints and boundaries.
The account context owns the profile itself — the data that is neither about sign-in credentials nor about authorization relationships. Its token audience is account.
Base path: {origin}/v1/account.
Endpoints
| Method | Path | Purpose | Scope |
|---|---|---|---|
GET | /v1/account/me | Read the account profile | account:profile:read |
PATCH | /v1/account/me | Partially update the account profile | account:profile:write |
Field-level detail is in Account profile.
How it differs from auth's profile
| Endpoint | Owns | Audience |
|---|---|---|
/v1/auth/profile, /v1/auth/username | Identity: display name, username | auth |
/v1/auth/userinfo | Identity fields readable by clients | auth |
/v1/account/me | Extended profile: gender, birthdate, age, locale, timezone, bio, metadata | account |
The audience is the hard boundary: third-party clients hold only auth-audience tokens by default, never get an account token, and therefore cannot even reach the door of /me — no extra "is this first party" check is needed.
Authentication
Authorization: Bearer <access_token>, audience account, scope as in the table above.
Error shape
Resource endpoints use the unified envelope { success, code, message, details?, timestamp }. How 401 and 403 are divided, and what a failed recent-authentication check looks like, is in Error codes.