Complete a managed investor's profile

PUT 
/v1/investors/:investorId/profile

PUT semantics — the profile fully replaces the stored profile state; domain value objects validate (IBAN checksum, BIC, birth date) and map failures to 422. The address, bank_account and company sections are each all-or-nothing: omit one entirely to leave it unset, or send it whole. Inside bank_account only iban is required — BIC and institution are derived from it and the account holder defaults to the profile name. consents is REQUIRED on every write: omitting it, or sending a consent as not-given, revokes that consent and erases its recorded capture instant, so re-send each consent as given to leave it untouched. 404 if the investor is not owned by the partner.

Request

Responses

200

OK

Response Headers

RateLimit-Limit

Requests permitted per minute for the authenticated API client.

RateLimit-Remaining

Requests still available in the current window. The bucket refills continuously, so this rises as you go rather than resetting on a boundary.

RateLimit-Reset

Seconds until the budget is back to its full limit. Not the wait for the next single request — that is Retry-After on a 429.

401

Missing or invalid access token.

403

Token lacks a scope this endpoint requires. The body carries code: INSUFFICIENT_SCOPE and a required_scopes array naming what is missing; the response also carries WWW-Authenticate: Bearer error="insufficient_scope", scope="…". A 403 with code: FORBIDDEN is a different failure and adding scopes will not fix it.

404

Not found — the resource does not exist, or does not belong to the calling partner. Acting on an investor another partner owns also returns 404 (no cross-tenant existence oracle).

422

Validation failed. The errors map carries per-field detail.

429

Rate limit exceeded — 600 requests a minute per API client. Unlike every other 4xx here, the request itself is fine: sleep for the Retry-After seconds given and resend it unchanged. See https://docs.valueverde.de/docs/rate-limits.

Response Headers

RateLimit-Limit

Requests permitted per minute for the authenticated API client.

RateLimit-Remaining

Requests still available in the current window. The bucket refills continuously, so this rises as you go rather than resetting on a boundary.

RateLimit-Reset

Seconds until the budget is back to its full limit. Not the wait for the next single request — that is Retry-After on a 429.

Retry-After

Seconds to wait before resending. Always at least 1.