Create a managed profile

Production

POST

/v1/managed-profiles

Creates one headless individual or business child for the authenticated active manager. externalSubjectId, normalized contactEmail, and customerType are immutable. An exact retry for the same external subject is idempotent and returns the existing active child with 200; the first creation returns 201. Reusing either reserved identifier with different data returns 409, including after deletion. No corridor grant is accepted.

Auth: controlling manager Supabase Bearer session or secret API key. Public API keys and direct managed-child credentials are rejected.

Request

Authorization

API Key

Add parameter in header

X-API-Key

Example:

X-API-Key: ********************

Bearer Token

Provide your bearer token in the

Authorization

header when making requests to protected resources.

Example:

Authorization: Bearer ********************

Body Params application/jsonRequired

Examples

Responses

🟢200

application/json

Idempotent retry returned the existing active managed profile.

Bodyapplication/json

🟢201

🟠400

🟠401

🟠403

🟠409

🔴500

Request Example

Shell

JavaScript

Java

Swift

curl --location '/v1/managed-profiles' \
--header 'X-API-Key: <api-key>' \
--header 'Content-Type: application/json' \
--data-raw '{
    "contactEmail": "user@example.com",
    "customerType": "individual",
    "externalSubjectId": "string"
}'

Response Example

200 - Example 1

{
    "managedProfile": {
        "contactEmail": "user@example.com",
        "createdAt": "2019-08-24T14:15:22.123Z",
        "creationSource": "manager",
        "customerType": "individual",
        "deletedAt": "2019-08-24T14:15:22.123Z",
        "externalSubjectId": "string",
        "profileId": "faebe71b-2bf8-4bdb-9b67-258e4d6aa00a",
        "status": "active",
        "updatedAt": "2019-08-24T14:15:22.123Z"
    }
}

Modified at 2026-08-19 18:12:57

List managed profiles

Delete a managed profile