Guides

User profiles and erasure

Store profile fields on your users, validate them against your signup flow, and erase them on request.

Besides the phone number and your external_id, a user can carry an extended profile. It is optional: you only send the fields you need.

Field	Format
`email`	An email address.
`first_name`, `last_name`	Text.
`birth_date`	`YYYY-MM-DD`.
`country`	ISO 3166-1 alpha-2 code, such as `FR`.
`referral_code`	Text.
`terms_acceptance`	`{ "version": "…", "accepted_at": "…" }`
`tagname`	The user's public handle, unique in your project and environment (case-insensitive).

Write and read a profile#

Send the fields when you create a user, then change them with Update a user (PATCH). A PATCH only validates and changes the fields you send; send null to clear one. The phone number and external_id cannot be changed.

curl -X PATCH "https://sdk.tilt-pay.com/v1/users/4821" \
  -H "Authorization: Bearer $TILT_PAY_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{"first_name": "Ada", "last_name": "Lovelace", "country": "FR"}'

Retrieve a user and PATCH return a UserDetail: the user plus a profile object (null when nothing was collected).

Warning A profile is personal data. It is returned only by GET /v1/users/{id} and PATCH /v1/users/{id}. It never appears in lists, events, webhooks or in the response of POST /v1/users, so it is not stored in idempotency replays either. Keep it that way in your own logs.

Fields are checked against the signup flow you published:

While nothing is published (version 0), only the formats are checked.
Once a flow is published, a field belonging to a disabled module is refused, a required module must be provided at creation and cannot be cleared, and min_age and allowed_countries are enforced.
Errors are 422 validation_error with param naming the field (terms_acceptance.version for a sub-field). A tagname already taken answers 409 tagname_already_taken.

Right to erasure#

Delete a user profile (DELETE /v1/users/{id}/profile) permanently erases the whole profile: email, names, birth date, country, referral code, terms acceptance and tagname.

curl -X DELETE "https://sdk.tilt-pay.com/v1/users/4821/profile" \
  -H "Authorization: Bearer $TILT_PAY_API_KEY"

It is idempotent: deleted is false when there was nothing to delete.
It does not delete the account. The user, the phone number and your external_id are kept. To stop the user from transacting, suspend them separately.
Responses remembered for idempotency never contain a profile, so nothing remains there.
Erasing the data you hold about a person in your own systems stays your responsibility.

User profiles and erasure

Write and read a profile#

Validation follows your signup flow#

Right to erasure#