# Party profile HTTP contract

`GET /api/v1/me/profile` and `PUT /api/v1/me/profile` use the current canonical
Party session and the existing acceptable-use gate. Technical operator and CLI
credentials cannot act as a Party. The API forwards the verified Party ID and
authentication generation through its trusted broker caller metadata; Beto
rechecks them before reading or changing the profile.

PUT replaces every editable field. Empty strings clear optional details. The
`Idempotency-Key` UUID names the command and `If-Match` names the profile revision,
including zero for an absent profile. Retrying an uncertain response preserves
both headers and the body. An explicit `X-Correlation-ID` may group attempts.
Authentication generation and profile revision have separate purposes.

`GET /api/v1/parties/{partyId}/profile` is public. Beto returns only profiles whose
owner selected `public`; absent and private profiles both return `not_found`.
The API additionally rejects mismatched identity or unsafe reply data and refuses
to serialise a private profile publicly. Responses contain the canonical Party
ID, profile revision and editable fields. Source AAI attributes, provider IDs,
email and authentication state are excluded.

An absent self profile has revision zero, private visibility and empty fields.
Social fields contain bounded handles or paths for the named provider. Clients
construct links using fixed provider hosts. The website field allows only
absolute HTTP(S) URLs without credentials. Text limits count Unicode code points;
only the biography permits line feeds and tabs. The owner contract defines the
exact [field limits](schemas.json).