Update an investor
/investors/{id}Changes the fields you send and returns the investor; omitted fields stay. status, sso_id and key_contact_id are read-only. A new email also rewrites the sign-in username; one another investor holds returns 422 unique, one over 53 characters 422. data_capture references must exist, else 422 exists. Emits investor.updated with the changed fields and the legacy user.* events; sends no email. Sending the old values undoes it.
Path parameters
The investor's id, a uuid. An unknown investor, or one outside the token's organisation and its client organisations, returns 404.
Query parameters
Validate and run the call without committing it, returning what the real call would return with
meta.dry_runset.
Headers
Makes a retry safe. Send a new UUID for each new request and reuse it only to retry that request; the first response is replayed for 24 hours.
Request body
application/json, required · InvestorUpdate
The investor's new email. At most 53 characters. Another investor's email returns 422
unique. It also rewrites the sign-in username.Optional title, such as Mr, Ms or Dr.
The investor's first name.
The investor's last name.
The investor's id in your own system.
Answers to your custom user data fields, keyed by field
reference. Every reference must exist, else 422exists.
{
"title": "Ms",
"first_name": "Augusta",
"last_name": "King",
"external_id": "CRM-2026-0042",
"data_capture": {
"tax_residency": "GB"
}
}Responses
{
"data": {
"id": "6f1c2e8a-1b2c-4d5e-8f90-1a2b3c4d5e6f",
"first_name": "Augusta",
"last_name": "King",
"title": "Ms",
"email": "ada.lovelace@example.com",
"status": "active",
"external_id": "CRM-1042",
"sso_id": null,
"key_contact_id": "1a2b3c4d-5e6f-4708-9a0b-1c2d3e4f5061",
"invite": null,
"two_factor_enabled": false,
"last_login": "2026-06-16T09:12:00Z",
"created_at": "2026-06-15T10:30:00Z",
"updated_at": "2026-06-18T16:20:00Z"
}
}Authorization failed. error.code is one of org_disabled,
ip_blocked, missing_scope, scope_disabled, user_disabled.
The request can't be processed (HTTP 422): validation_failed with one ErrorDetail per
problem, or a code documented on the operation.
Examples
curl -X PATCH https://your-org-domain/kong/core/api/v2/investors/{id}\
-H "Authorization: Bearer $HELM_API_KEY"\
-H "Content-Type: application/json"\
-d '{
"title": "Ms",
"first_name": "Augusta",
"last_name": "King",
"external_id": "CRM-2026-0042",
"data_capture": {
"tax_residency": "GB"
}
}'