Client API: Account settings

Change the address you sign in with, choose which optional emails you get, and close your account.

Base URL: https://api.coritan.com/api/v1. Paths below are complete.

To try these requests in the browser, open the interactive Client API reference.

GET /api/v1/auth/me/billing-profile

Who the account's invoices are made out to: a legal name, a postal address and a VAT ID. Every field is null until someone saves one, and updated_at is null while there is no profile. tax_enabled says whether we charge tax on invoices; while it is false, a VAT ID changes no amount. vat_id_checked is false until we have checked the VAT ID. A team member with the Billing or Admin role reads the profile of the account they act for.

Authentication: an access token, sent as Authorization: Bearer <token>.

PUT /api/v1/auth/me/billing-profile

Replace the account's billing profile. A field left out or empty is cleared, and every field empty removes the profile. With any field set, address_line1, city and country (ISO 3166-1 alpha-2) are required. The VAT ID loses its spaces, dots and hyphens and is stored in capitals, and a new or changed one reads vat_id_checked: false. The fields the GET adds may be sent back and are ignored; any other field is a 422. A wrong value answers 422 with one entry per field, and more than BILLING_PROFILE_SAVES saves in an hour answer 429. Team members with the Billing or Admin role save the profile of the account they act for.

Authentication: an access token, sent as Authorization: Bearer <token>.

application/json (required)

GET /api/v1/auth/me/close

Whether the account can close now, and what to do first if not.

Authentication: an access token, sent as Authorization: Bearer <token>.

POST /api/v1/auth/me/close

Close the account. Refused (409, with what to do first) while a service is still running or due to end, an invoice is unpaid, a refund request waits for a decision, or anything else is still live. Closing signs out every device and switches off every API key; staff can reopen the account.

Authentication: an access token, sent as Authorization: Bearer <token>.

application/json (required)

GET /api/v1/auth/me/email

The sign-in address, and the new one waiting to be confirmed, if any.

Authentication: an access token, sent as Authorization: Bearer <token>.

POST /api/v1/auth/me/email

Ask to sign in with another address. We email a link to the new address, which works for EMAIL_CHANGE_HOURS hours, and tell the old address about the request. Nothing changes until the link is opened; a new request replaces the one before it.

Authentication: an access token, sent as Authorization: Bearer <token>.

application/json (required)

POST /api/v1/auth/me/email/cancel

Withdraw the address change waiting to be confirmed.

Authentication: an access token, sent as Authorization: Bearer <token>.

POST /api/v1/auth/me/email/confirm

Switch to the new address, from the link we emailed to it. The link works only for the account that asked, signed in.

Authentication: an access token, sent as Authorization: Bearer <token>.

application/json (required)

GET /api/v1/auth/me/notifications

Which optional emails the account gets. security and billing are always true.

Authentication: an access token, sent as Authorization: Bearer <token>.

PUT /api/v1/auth/me/notifications

Turn optional emails on or off. A field left out keeps its value.

Authentication: an access token, sent as Authorization: Bearer <token>.

application/json (required)