Update a TuKit User Profile — TuKit API

This endpoint allows an authenticated user to update their own profile information. Currently, the only mutable field exposed through this endpoint is userName. The user document is located by the userId path parameter, and as a safety check the controller also verifies that the resolved document’s _id matches the supplied userId — a mismatch returns a 403 error. Users can only modify their own account; updating another user’s profile requires no separate permission check beyond the ID match, so ensure the userId in the URL corresponds to the token owner’s ID. POST /api/user/update-user/:userId

Authentication

token-access

string

required

A valid JWT obtained from the Login endpoint. The middleware verifies this token before the controller logic runs.

Path Parameters

userId

string

required

The MongoDB ObjectId of the user account to update. Must match the _id of the authenticated user’s account.

Request Body

userName

string

The new display name to set on the account. If omitted, the existing userName is preserved unchanged.

Response

200 — Success

msj

string

Human-readable confirmation that the update was applied ("Usuario actualizado correctamente").

status

boolean

Always true on success.

updateUser

object

The full updated user document as returned by Mongoose after .save().

Show updateUser fields

_id

string

MongoDB ObjectId of the user.

userName

string

The updated display name.

string

The user’s lowercased email address (unchanged).

roles

array

The user’s current roles array (unchanged by this endpoint).

activate

array

The user’s current activation status (unchanged by this endpoint).

updatedAt

string

ISO 8601 timestamp of the update.

Error Responses

Status	Cause
`404`	No user document found for the provided `userId`.
`403`	The `userId` in the URL does not match the `_id` of the located user document.
`500`	Unexpected server or database error.

To update other account properties such as password or roles, use the dedicated Update Roles endpoint or the Recovery Password and Update Password sections below.

Example

curl -X POST https://your-tukit-api.com/api/user/update-user/64f1a2b3c4d5e6f7a8b9c0d1 \
  -H "Content-Type: application/json" \
  -H "token-access: eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9..." \
  -d '{
    "userName": "MarcosNewName"
  }'

Success response:

{
  "msj": "Usuario actualizado correctamente",
  "status": true,
  "updateUser": {
    "_id": "64f1a2b3c4d5e6f7a8b9c0d1",
    "userName": "MarcosNewName",
    "email": "marcos@example.com",
    "roles": [{ "name": "Usuario", "value": "1" }],
    "activate": [{ "name": "Activado", "value": "1" }],
    "updatedAt": "2024-06-02T09:30:00.000Z"
  }
}

Error — user not found:

{
  "msj": "Usuario no encontrado",
  "status": false
}

Error — ID mismatch:

{
  "msj": "No tienes permitido hacer esta función",
  "status": false
}

Recovery Password

Initiates a password-reset flow for an existing account. The controller generates a random 5-digit code, stores it as code_newpass on the user document, and dispatches it to the account’s registered email address via Nodemailer. The code must then be submitted to the Update Password endpoint below to complete the reset. POST /api/user/recovery-password

Authentication

token-access

string

required

A valid JWT obtained from the Login endpoint. The Token middleware validates this header before the controller runs.

Request Body

string

required

The registered email address of the account whose password should be reset. If no account is found for this address, the request is rejected with a 203 response.

Response

200 — Success

msj

string

Confirmation that the 5-digit reset code has been sent: "Te hemos enviado un código de 5 dígitos a tu correo para verificar el cambio de contraseña".

status

boolean

Always true on success.

The reset code is stored in the code_newpass field on the user document. It is not returned in the response — it is delivered exclusively by email (via Nodemailer). Do not expose or cache this value client-side.

Error Responses

Status	Cause
`203`	No user document was found for the provided `email` address.
`500`	Unexpected server or database error.

Example

curl -X POST https://your-tukit-api.com/api/user/recovery-password \
  -H "Content-Type: application/json" \
  -H "token-access: eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9..." \
  -d '{
    "email": "marcos@example.com"
  }'

Success response:

{
  "msj": "Te hemos enviado un código de 5 dígitos a tu correo para verificar el cambio de contraseña",
  "status": true
}

Error — email not found:

{
  "msj": "Correo no encontrado. Por favor, ingresa un correo válido",
  "status": false
}

Update Password

Completes the password-reset flow. The caller supplies the 5-digit code that was emailed by the Recovery Password endpoint along with the desired new password. If the code matches the code_newpass stored on the user document, the password is hashed with bcrypt and saved, and both code fields are cleared from the document. POST /api/user/update-password/:email

Authentication

token-access

string

required

A valid JWT obtained from the Login endpoint. The Token middleware validates this header before the controller runs.

Path Parameters

string

required

The registered email address of the account whose password is being reset.

Request Body

code_confirm_pass

string

required

The 5-digit verification code that was sent to the user’s email by the Recovery Password endpoint. Must match the code_newpass field stored on the user document.

newPassword

string

required

The new plain-text password to set on the account. It is hashed with bcrypt (cost factor 10) before storage.

Response

200 — Success

msj

string

Confirmation that the password was changed: "Contraseña actualizada correctamente".

status

boolean

Always true on success.

On success the code_newpass and code_confirm_pass fields on the user document are both cleared to an empty string, invalidating the one-time reset code immediately.

Error Responses

Status	Cause
`404`	No user document was found for the provided `:email` path parameter.
`203`	The supplied `code_confirm_pass` does not match the `code_newpass` stored on the user document.
`500`	Unexpected server or database error.

Example

curl -X POST https://your-tukit-api.com/api/user/update-password/marcos@example.com \
  -H "Content-Type: application/json" \
  -H "token-access: eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9..." \
  -d '{
    "code_confirm_pass": "34512",
    "newPassword": "NewSecret456"
  }'

Success response:

{
  "msj": "Contraseña actualizada correctamente",
  "status": true
}

Error — wrong code:

{
  "msj": "Código de verificación incorrecto. Por favor, ingresa nuevamente el código",
  "status": false
}

Error — email not found:

{
  "msj": "Correo no encontrado. Por favor, ingresa un correo válido",
  "status": false
}

Users

Products

Shopping Cart

Update a TuKit User Profile — TuKit API

Authentication

Path Parameters

Request Body

Response

200 — Success

Error Responses

Example

Recovery Password

Authentication

Request Body

Response

200 — Success

Error Responses

Example

Update Password

Authentication

Path Parameters

Request Body

Response

200 — Success

Error Responses

Example

Build docs developers (and LLMs) love

Users

Products

Shopping Cart

Documentation Index

​Authentication

​Path Parameters

​Request Body

​Response

​200 — Success

​Error Responses

​Example

​Recovery Password

​Authentication

​Request Body

​Response

​200 — Success

​Error Responses

​Example

​Update Password

​Authentication

​Path Parameters

​Request Body

​Response

​200 — Success

​Error Responses

​Example

Build docs developers (and LLMs) love

Authentication

Path Parameters

Request Body

Response

200 — Success

Error Responses

Example

Recovery Password

Authentication

Request Body

Response

200 — Success

Error Responses

Example

Update Password

Authentication

Path Parameters

Request Body

Response

200 — Success

Error Responses

Example