The Account Behind the Key

const res = await fetch('https://panel.example.com/api/v1/client/me', {
  headers: { Authorization: `Bearer ${clientKey}` },
});

const { data, meta } = await res.json();
renderForm(data, meta.editable, meta.required);

$ch = curl_init('https://panel.example.com/api/v1/client/me');
curl_setopt_array($ch, [
    CURLOPT_RETURNTRANSFER => true,
    CURLOPT_HTTPHEADER     => ['Authorization: Bearer ' . $clientKey],
]);

$body = json_decode(curl_exec($ch), true);
curl_close($ch);

// Build the form from meta.editable: a field the operator closed gives 422 rather than passing quietly.
$r = Kernel::internal('client:Account/GetMe', ['owner_id' => $uid]);
$form = array_intersect_key($r['data'], array_flip($r['meta']['editable']));

const res = await fetch('https://panel.example.com/api/v1/client/me', {
  method: 'PATCH',
  headers: {
    Authorization: `Bearer ${clientKey}`,
    'Content-Type': 'application/json',
  },
  body: JSON.stringify({ timezone: 'Europe/Istanbul' }),
});

const { meta } = await res.json();
console.log(meta.changed);

$ch = curl_init('https://panel.example.com/api/v1/client/me');
curl_setopt_array($ch, [
    CURLOPT_RETURNTRANSFER => true,
    CURLOPT_CUSTOMREQUEST  => 'PATCH',
    CURLOPT_HTTPHEADER     => [
        'Authorization: Bearer ' . $clientKey,
        'Content-Type: application/json',
    ],
    CURLOPT_POSTFIELDS => json_encode(['timezone' => 'Europe/Istanbul']),
]);

$body = json_decode(curl_exec($ch), true);
curl_close($ch);

// The E-MAIL and PASSWORD do not change here: both want a verification flow and stay in the panel.
$r = Kernel::internal('client:Account/UpdateMe', ['owner_id' => $uid, 'timezone' => $tz]);
$written = $r['meta']['changed'];

const res = await fetch('https://panel.example.com/api/v1/client/me/notifications', {
  headers: { Authorization: `Bearer ${clientKey}` },
});

const { data } = await res.json();
const editable = data.categories.filter((c) => ! c.locked);

$ch = curl_init('https://panel.example.com/api/v1/client/me/notifications');
curl_setopt_array($ch, [
    CURLOPT_RETURNTRANSFER => true,
    CURLOPT_HTTPHEADER     => ['Authorization: Bearer ' . $clientKey],
]);

$body = json_decode(curl_exec($ch), true);
curl_close($ch);

// Read BEFORE writing: the write is a FULL REPLACE and a category left out closes on both channels.
$cur = Kernel::internal('client:Account/GetNotifications', ['owner_id' => $uid])['data'];

const cur = await fetch('https://panel.example.com/api/v1/client/me/notifications', {
  headers: { Authorization: `Bearer ${clientKey}` },
}).then((r) => r.json());

const body = {};
for (const c of cur.data.categories)
  if (! c.locked) body[c.category] = { email: c.email, sms: c.sms };

body.marketing = { email: false, sms: false };

await fetch('https://panel.example.com/api/v1/client/me/notifications', {
  method: 'PUT',
  headers: {
    Authorization: `Bearer ${clientKey}`,
    'Content-Type': 'application/json',
  },
  body: JSON.stringify(body),
});

$ch = curl_init('https://panel.example.com/api/v1/client/me/notifications');
curl_setopt_array($ch, [
    CURLOPT_RETURNTRANSFER => true,
    CURLOPT_CUSTOMREQUEST  => 'PUT',
    CURLOPT_HTTPHEADER     => [
        'Authorization: Bearer ' . $clientKey,
        'Content-Type: application/json',
    ],
    CURLOPT_POSTFIELDS => json_encode($prefs),
]);

$body = json_decode(curl_exec($ch), true);
curl_close($ch);

// A category you leave out CLOSES: send the full set even to change one choice.
$cur = Kernel::internal('client:Account/GetNotifications', ['owner_id' => $uid])['data'];
$body = [];
foreach ($cur['categories'] as $c)
    if (! $c['locked']) $body[$c['category']] = ['email' => $c['email'], 'sms' => $c['sms']];

$body['marketing'] = ['email' => false, 'sms' => false];
Kernel::internal('client:Account/UpdateNotifications', ['owner_id' => $uid] + $body);

const res = await fetch('https://panel.example.com/api/v1/client/me/security', {
  headers: { Authorization: `Bearer ${clientKey}` },
});

const { data } = await res.json();
if (! data.two_factor.enabled) nudgeToEnable();

$ch = curl_init('https://panel.example.com/api/v1/client/me/security');
curl_setopt_array($ch, [
    CURLOPT_RETURNTRANSFER => true,
    CURLOPT_HTTPHEADER     => ['Authorization: Bearer ' . $clientKey],
]);

$body = json_decode(curl_exec($ch), true);
curl_close($ch);

// It is READ ONLY: signing a session out, the password and setting two-step up are ABSENT here and stay in the panel.
$sec = Kernel::internal('client:Account/GetSecurity', ['owner_id' => $uid])['data'];
$stale = array_filter($sec['sessions'], fn ($s) => $s['country_code'] !== $home);