Profile
The profile endpoints let the authenticated user read and update their own account — as opposed to Users, which manages other accounts and requires elevated roles.
Retrieve your profile
Retrieve the authenticated user's own profile, in the same shape as the User model.
Request
curl https://your-domain.com/api/profile \
-H "Accept: application/json" \
-H "X-XSRF-TOKEN: {token}" \
--cookie "cms_admin_session={session}"
Response
{
"data": {
"id": "1a2b3c4d-5e6f-7890-1a2b-3c4d5e6f7890",
"full_name": "Maria Santos",
"email": "maria.santos@example.com",
"roles": ["Branch of the Court Clerk"],
"avatar_url": null
}
}
Update your profile
Update your own profile fields (name, contact details, address).
Optional attributes
- Name
first_name- Type
- string
- Description
Your first name.
- Name
last_name- Type
- string
- Description
Your last name.
- Name
contact_number- Type
- string
- Description
Contact phone number.
- Name
avatar- Type
- file
- Description
A new avatar image.
Request
curl -X POST https://your-domain.com/api/profile \
-H "Accept: application/json" \
-H "Content-Type: application/json" \
-H "X-XSRF-TOKEN: {token}" \
--cookie "cms_admin_session={session}" \
-d '{"contact_number": "+639171234567"}'
Response
{
"data": {
"id": "1a2b3c4d-5e6f-7890-1a2b-3c4d5e6f7890",
"contact_number": "+639171234567",
"updated_at": "2026-02-20T11:00:00+00:00"
}
}
Change your password
Change the authenticated user's password.
Required attributes
- Name
current_password- Type
- string
- Description
The user's current password.
- Name
password- Type
- string
- Description
The new password, confirmed via
password_confirmation. Minimum 6 characters.
Request
curl -X POST https://your-domain.com/api/profile/change_password \
-H "Accept: application/json" \
-H "Content-Type: application/json" \
-H "X-XSRF-TOKEN: {token}" \
--cookie "cms_admin_session={session}" \
-d '{
"current_password": "OldPass123",
"password": "NewPass456",
"password_confirmation": "NewPass456"
}'
Response
{
"message": "Password updated successfully."
}
Manage your sessions
List, revoke, or bulk-terminate your active login sessions. See Authentication → Sessions for the full flow — every login mints a named Sanctum token recording IP and user agent, which is what these endpoints manage.
Request
curl https://your-domain.com/api/profile/sessions \
-H "Accept: application/json" \
-H "X-XSRF-TOKEN: {token}" \
--cookie "cms_admin_session={session}"
Response
{
"data": [
{
"id": "4d5e6f7a-8b9c-0d1e-4d5e-6f7a8b9c0d1e",
"ip_address": "203.0.113.42",
"user_agent": "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7)",
"last_used_at": "2026-02-20T10:00:00+00:00",
"is_current_device": true
}
]
}
View a public profile
Retrieve the public-facing subset of another user's profile (e.g. a counsel's name and firm, shown to case collaborators).
Path parameters
- Name
id- Type
- string
- Description
The UUID of the user.
Request
curl https://your-domain.com/api/public-profile/1a2b3c4d-5e6f-7890-1a2b-3c4d5e6f7890 \
-H "Accept: application/json" \
-H "X-XSRF-TOKEN: {token}" \
--cookie "cms_admin_session={session}"
Response
{
"data": {
"full_name": "Maria Santos",
"law_firm": null,
"avatar_url": null
}
}