curl --request POST \
--url https://api-uat.dimetrades.com/api/users/profile \
--header 'Authorization: Bearer <token>' \
--header 'Content-Type: multipart/form-data' \
--header 'X-API-Key: <api-key>' \
--form firstName=John \
--form lastName=Doe \
--form 'phone=+12025550123' \
--form profileImage=@example-fileimport requests
url = "https://api-uat.dimetrades.com/api/users/profile"
files = { "profileImage": ("example-file", open("example-file", "rb")) }
payload = {
"firstName": "John",
"lastName": "Doe",
"phone": "+12025550123"
}
headers = {
"Authorization": "Bearer <token>",
"X-API-Key": "<api-key>"
}
response = requests.post(url, data=payload, files=files, headers=headers)
print(response.text)const form = new FormData();
form.append('firstName', 'John');
form.append('lastName', 'Doe');
form.append('phone', '+12025550123');
form.append('profileImage', '{
"fileName": "example-file"
}');
const options = {
method: 'POST',
headers: {Authorization: 'Bearer <token>', 'X-API-Key': '<api-key>'}
};
options.body = form;
fetch('https://api-uat.dimetrades.com/api/users/profile', options)
.then(res => res.json())
.then(res => console.log(res))
.catch(err => console.error(err));<?php
$curl = curl_init();
curl_setopt_array($curl, [
CURLOPT_URL => "https://api-uat.dimetrades.com/api/users/profile",
CURLOPT_RETURNTRANSFER => true,
CURLOPT_ENCODING => "",
CURLOPT_MAXREDIRS => 10,
CURLOPT_TIMEOUT => 30,
CURLOPT_HTTP_VERSION => CURL_HTTP_VERSION_1_1,
CURLOPT_CUSTOMREQUEST => "POST",
CURLOPT_POSTFIELDS => "-----011000010111000001101001\r\nContent-Disposition: form-data; name=\"firstName\"\r\n\r\nJohn\r\n-----011000010111000001101001\r\nContent-Disposition: form-data; name=\"lastName\"\r\n\r\nDoe\r\n-----011000010111000001101001\r\nContent-Disposition: form-data; name=\"phone\"\r\n\r\n+12025550123\r\n-----011000010111000001101001\r\nContent-Disposition: form-data; name=\"profileImage\"; filename=\"example-file\"\r\nContent-Type: application/octet-stream\r\n\r\n{\r\n \"fileName\": \"example-file\"\r\n}\r\n-----011000010111000001101001--",
CURLOPT_HTTPHEADER => [
"Authorization: Bearer <token>",
"Content-Type: multipart/form-data",
"X-API-Key: <api-key>"
],
]);
$response = curl_exec($curl);
$err = curl_error($curl);
curl_close($curl);
if ($err) {
echo "cURL Error #:" . $err;
} else {
echo $response;
}package main
import (
"fmt"
"strings"
"net/http"
"io"
)
func main() {
url := "https://api-uat.dimetrades.com/api/users/profile"
payload := strings.NewReader("-----011000010111000001101001\r\nContent-Disposition: form-data; name=\"firstName\"\r\n\r\nJohn\r\n-----011000010111000001101001\r\nContent-Disposition: form-data; name=\"lastName\"\r\n\r\nDoe\r\n-----011000010111000001101001\r\nContent-Disposition: form-data; name=\"phone\"\r\n\r\n+12025550123\r\n-----011000010111000001101001\r\nContent-Disposition: form-data; name=\"profileImage\"; filename=\"example-file\"\r\nContent-Type: application/octet-stream\r\n\r\n{\r\n \"fileName\": \"example-file\"\r\n}\r\n-----011000010111000001101001--")
req, _ := http.NewRequest("POST", url, payload)
req.Header.Add("Authorization", "Bearer <token>")
req.Header.Add("X-API-Key", "<api-key>")
res, _ := http.DefaultClient.Do(req)
defer res.Body.Close()
body, _ := io.ReadAll(res.Body)
fmt.Println(string(body))
}HttpResponse<String> response = Unirest.post("https://api-uat.dimetrades.com/api/users/profile")
.header("Authorization", "Bearer <token>")
.header("X-API-Key", "<api-key>")
.body("-----011000010111000001101001\r\nContent-Disposition: form-data; name=\"firstName\"\r\n\r\nJohn\r\n-----011000010111000001101001\r\nContent-Disposition: form-data; name=\"lastName\"\r\n\r\nDoe\r\n-----011000010111000001101001\r\nContent-Disposition: form-data; name=\"phone\"\r\n\r\n+12025550123\r\n-----011000010111000001101001\r\nContent-Disposition: form-data; name=\"profileImage\"; filename=\"example-file\"\r\nContent-Type: application/octet-stream\r\n\r\n{\r\n \"fileName\": \"example-file\"\r\n}\r\n-----011000010111000001101001--")
.asString();require 'uri'
require 'net/http'
url = URI("https://api-uat.dimetrades.com/api/users/profile")
http = Net::HTTP.new(url.host, url.port)
http.use_ssl = true
request = Net::HTTP::Post.new(url)
request["Authorization"] = 'Bearer <token>'
request["X-API-Key"] = '<api-key>'
request.body = "-----011000010111000001101001\r\nContent-Disposition: form-data; name=\"firstName\"\r\n\r\nJohn\r\n-----011000010111000001101001\r\nContent-Disposition: form-data; name=\"lastName\"\r\n\r\nDoe\r\n-----011000010111000001101001\r\nContent-Disposition: form-data; name=\"phone\"\r\n\r\n+12025550123\r\n-----011000010111000001101001\r\nContent-Disposition: form-data; name=\"profileImage\"; filename=\"example-file\"\r\nContent-Type: application/octet-stream\r\n\r\n{\r\n \"fileName\": \"example-file\"\r\n}\r\n-----011000010111000001101001--"
response = http.request(request)
puts response.read_body{
"data": {
"message": "Profile updated successfully"
},
"errors": []
}{
"data": {},
"errors": {
"statusCode": 400,
"error": "RequestValidationError",
"message": "email must match format \"email\"",
"code": 1002,
"explanation": "The request input did not pass validation checks."
}
}{
"data": {},
"errors": {
"statusCode": 400,
"error": "RequestValidationError",
"message": "email must match format \"email\"",
"code": 1002,
"explanation": "The request input did not pass validation checks."
}
}{
"data": {},
"errors": {
"statusCode": 400,
"error": "RequestValidationError",
"message": "email must match format \"email\"",
"code": 1002,
"explanation": "The request input did not pass validation checks."
}
}{
"data": {},
"errors": {
"statusCode": 400,
"error": "RequestValidationError",
"message": "email must match format \"email\"",
"code": 1002,
"explanation": "The request input did not pass validation checks."
}
}{
"data": {},
"errors": {
"statusCode": 400,
"error": "RequestValidationError",
"message": "email must match format \"email\"",
"code": 1002,
"explanation": "The request input did not pass validation checks."
}
}{
"data": {},
"errors": {
"statusCode": 500,
"error": "InternalError",
"message": "Internal Server Error",
"code": 1003,
"explanation": "An unexpected error occurred on the server, Please try again later."
}
}Update user profile
Updates the authenticated user’s profile. This is the existing user endpoint (POST /users/profile, served by UpdateUserProfileService) that external / partner customers can also call with the session token minted by POST /partner/customers/login. Only the fields you send are changed.
The X-API-Key header identifies the platform; the Authorization: Bearer <token> header identifies which of your users is being updated.
Profile images are sent as a multipart/form-data file under the profileImage field; all other fields are regular form fields. Same validation as the native flow: age 18+, unique username / phone / SSN, valid state code.
curl --request POST \
--url https://api-uat.dimetrades.com/api/users/profile \
--header 'Authorization: Bearer <token>' \
--header 'Content-Type: multipart/form-data' \
--header 'X-API-Key: <api-key>' \
--form firstName=John \
--form lastName=Doe \
--form 'phone=+12025550123' \
--form profileImage=@example-fileimport requests
url = "https://api-uat.dimetrades.com/api/users/profile"
files = { "profileImage": ("example-file", open("example-file", "rb")) }
payload = {
"firstName": "John",
"lastName": "Doe",
"phone": "+12025550123"
}
headers = {
"Authorization": "Bearer <token>",
"X-API-Key": "<api-key>"
}
response = requests.post(url, data=payload, files=files, headers=headers)
print(response.text)const form = new FormData();
form.append('firstName', 'John');
form.append('lastName', 'Doe');
form.append('phone', '+12025550123');
form.append('profileImage', '{
"fileName": "example-file"
}');
const options = {
method: 'POST',
headers: {Authorization: 'Bearer <token>', 'X-API-Key': '<api-key>'}
};
options.body = form;
fetch('https://api-uat.dimetrades.com/api/users/profile', options)
.then(res => res.json())
.then(res => console.log(res))
.catch(err => console.error(err));<?php
$curl = curl_init();
curl_setopt_array($curl, [
CURLOPT_URL => "https://api-uat.dimetrades.com/api/users/profile",
CURLOPT_RETURNTRANSFER => true,
CURLOPT_ENCODING => "",
CURLOPT_MAXREDIRS => 10,
CURLOPT_TIMEOUT => 30,
CURLOPT_HTTP_VERSION => CURL_HTTP_VERSION_1_1,
CURLOPT_CUSTOMREQUEST => "POST",
CURLOPT_POSTFIELDS => "-----011000010111000001101001\r\nContent-Disposition: form-data; name=\"firstName\"\r\n\r\nJohn\r\n-----011000010111000001101001\r\nContent-Disposition: form-data; name=\"lastName\"\r\n\r\nDoe\r\n-----011000010111000001101001\r\nContent-Disposition: form-data; name=\"phone\"\r\n\r\n+12025550123\r\n-----011000010111000001101001\r\nContent-Disposition: form-data; name=\"profileImage\"; filename=\"example-file\"\r\nContent-Type: application/octet-stream\r\n\r\n{\r\n \"fileName\": \"example-file\"\r\n}\r\n-----011000010111000001101001--",
CURLOPT_HTTPHEADER => [
"Authorization: Bearer <token>",
"Content-Type: multipart/form-data",
"X-API-Key: <api-key>"
],
]);
$response = curl_exec($curl);
$err = curl_error($curl);
curl_close($curl);
if ($err) {
echo "cURL Error #:" . $err;
} else {
echo $response;
}package main
import (
"fmt"
"strings"
"net/http"
"io"
)
func main() {
url := "https://api-uat.dimetrades.com/api/users/profile"
payload := strings.NewReader("-----011000010111000001101001\r\nContent-Disposition: form-data; name=\"firstName\"\r\n\r\nJohn\r\n-----011000010111000001101001\r\nContent-Disposition: form-data; name=\"lastName\"\r\n\r\nDoe\r\n-----011000010111000001101001\r\nContent-Disposition: form-data; name=\"phone\"\r\n\r\n+12025550123\r\n-----011000010111000001101001\r\nContent-Disposition: form-data; name=\"profileImage\"; filename=\"example-file\"\r\nContent-Type: application/octet-stream\r\n\r\n{\r\n \"fileName\": \"example-file\"\r\n}\r\n-----011000010111000001101001--")
req, _ := http.NewRequest("POST", url, payload)
req.Header.Add("Authorization", "Bearer <token>")
req.Header.Add("X-API-Key", "<api-key>")
res, _ := http.DefaultClient.Do(req)
defer res.Body.Close()
body, _ := io.ReadAll(res.Body)
fmt.Println(string(body))
}HttpResponse<String> response = Unirest.post("https://api-uat.dimetrades.com/api/users/profile")
.header("Authorization", "Bearer <token>")
.header("X-API-Key", "<api-key>")
.body("-----011000010111000001101001\r\nContent-Disposition: form-data; name=\"firstName\"\r\n\r\nJohn\r\n-----011000010111000001101001\r\nContent-Disposition: form-data; name=\"lastName\"\r\n\r\nDoe\r\n-----011000010111000001101001\r\nContent-Disposition: form-data; name=\"phone\"\r\n\r\n+12025550123\r\n-----011000010111000001101001\r\nContent-Disposition: form-data; name=\"profileImage\"; filename=\"example-file\"\r\nContent-Type: application/octet-stream\r\n\r\n{\r\n \"fileName\": \"example-file\"\r\n}\r\n-----011000010111000001101001--")
.asString();require 'uri'
require 'net/http'
url = URI("https://api-uat.dimetrades.com/api/users/profile")
http = Net::HTTP.new(url.host, url.port)
http.use_ssl = true
request = Net::HTTP::Post.new(url)
request["Authorization"] = 'Bearer <token>'
request["X-API-Key"] = '<api-key>'
request.body = "-----011000010111000001101001\r\nContent-Disposition: form-data; name=\"firstName\"\r\n\r\nJohn\r\n-----011000010111000001101001\r\nContent-Disposition: form-data; name=\"lastName\"\r\n\r\nDoe\r\n-----011000010111000001101001\r\nContent-Disposition: form-data; name=\"phone\"\r\n\r\n+12025550123\r\n-----011000010111000001101001\r\nContent-Disposition: form-data; name=\"profileImage\"; filename=\"example-file\"\r\nContent-Type: application/octet-stream\r\n\r\n{\r\n \"fileName\": \"example-file\"\r\n}\r\n-----011000010111000001101001--"
response = http.request(request)
puts response.read_body{
"data": {
"message": "Profile updated successfully"
},
"errors": []
}{
"data": {},
"errors": {
"statusCode": 400,
"error": "RequestValidationError",
"message": "email must match format \"email\"",
"code": 1002,
"explanation": "The request input did not pass validation checks."
}
}{
"data": {},
"errors": {
"statusCode": 400,
"error": "RequestValidationError",
"message": "email must match format \"email\"",
"code": 1002,
"explanation": "The request input did not pass validation checks."
}
}{
"data": {},
"errors": {
"statusCode": 400,
"error": "RequestValidationError",
"message": "email must match format \"email\"",
"code": 1002,
"explanation": "The request input did not pass validation checks."
}
}{
"data": {},
"errors": {
"statusCode": 400,
"error": "RequestValidationError",
"message": "email must match format \"email\"",
"code": 1002,
"explanation": "The request input did not pass validation checks."
}
}{
"data": {},
"errors": {
"statusCode": 400,
"error": "RequestValidationError",
"message": "email must match format \"email\"",
"code": 1002,
"explanation": "The request input did not pass validation checks."
}
}{
"data": {},
"errors": {
"statusCode": 500,
"error": "InternalError",
"message": "Internal Server Error",
"code": 1003,
"explanation": "An unexpected error occurred on the server, Please try again later."
}
}Authorizations
The end user's JWT access token, sent as Authorization: Bearer <token>.
Obtain one from POST /partner/customers or POST /partner/customers/login
— both return it as token. It identifies which of your users a call
is made for, and is sent alongside your X-API-Key on every authenticated
endpoint.
Event discovery, categories, subcategories and scores are public and need no token.
ISV / partner credential — public half. Required on every request.
Identifies the integration partner (ISV) making the call. Issued by Dime
Trades when the ISV is onboarded and sent on every /partner/* endpoint:
X-API-Key: dt_pk_live_7f3c9a2e5b18
- On the two partner endpoints that create accounts or issue tokens (
POST /partner/customers,POST /partner/customers/login), it is accompanied byX-API-Secretand is the only authentication — there is no user token yet. - On every other partner endpoint it is sent alongside the user's
Authorization: Bearer <token>: the API key says which platform is calling, the bearer token says which user it is calling for.
Credentials are scoped to one or more brands; using a key with a brandId outside that scope returns 403. Staging and production keys are separate.
The key identifies your platform — treat it as a backend credential.
Body
New username. Letters and numbers only; must be unique across Dime Trades.
1^[a-zA-Z0-9]+$"johndoe123"
2 - 50^[a-zA-Z ]+$"John"
50^[a-zA-Z]+$"Doe"
YYYY-MM-DD. Users under 18 rejected with 400.
"1990-01-01"
US state code.
"US"
"123 Market St"
30"New York"
"10001"
Encrypted at rest; 409 if already used by another approved account.
5"en"
150x >= 0Must not already be verified on another account.
20"+12025550123"
10"+1"
Set true to accept the participant agreement.
Profile image file (multipart). Validated by content (magic bytes), uploaded to S3.
