Profile

Base URL

Every path below is relative to https://api.laksonoteknologi.com/v2.

Applies to every endpoint on this page

• Accept-Language header (or ?lang= query param, which wins if both are sent) picks the response/error locale - optional, falls back to the server's configured default if neither is sent.
• Successful responses are {"response_code":"001", "response_text":"Success", "data": {...}}.

Change Password

PUT/v2/profile/passwordcommand

Changes the caller's own password - requires the current_password to verify identity before setting new_password (min 8 chars). Works for any authenticated human actor (system_owner/merchant/customer). Unlike reset-password, this does not require a separately-issued token, just an active session.

Auth required · any (system_owner, merchant, or customer)

Headers

Authorization: Bearer <token>
Content-Type: application/json
Accept-Language: en (optional - defaults to server config, or use ?lang= instead)

Requires "command": "change-password" in the request body.

Request fields

Field	Source	Type	Required	Validation
data.current_password	body	string	true	required
data.new_password	body	string	true	required,min=8

Example

---

Get Menu

GET/v2/profile/menuquery

Get the caller's own FE sidebar menu tree, pre-filtered to what they're allowed to see (system_owner/merchant share the admin tree, customer gets its own)

Auth required · any (system_owner, merchant, or customer)No body / params

Headers

Authorization: Bearer <token>
Accept-Language: en (optional - defaults to server config, or use ?lang= instead)

Plain query parameters - no request body / command field needed.

Example

---

Get Permissions

GET/v2/profile/permissionsquery

Gets the caller's own effective permission list as a flat array of obj/act strings - the same permission set that unified-login already returns inline, exposed here as its own endpoint for cases where FE needs to re-check permissions later without doing a full re-login (e.g. after an admin grants/revokes something mid-session).

Auth required · any (system_owner, merchant, or customer)No body / params

Headers

Authorization: Bearer <token>
Accept-Language: en (optional - defaults to server config, or use ?lang= instead)

Plain query parameters - no request body / command field needed.

Example

---

Get Profile

GET/v2/profilequery

Gets the caller's own profile, resolved from whichever provider the Bearer token belongs to (system_owner/merchant/customer) - returns identity fields common across providers (parent_role/sub_role/is_root/merchant_id/name/email/phone/is_verified) plus customer-only fields (customer_type/company_name) when applicable. No path/query params - always the authenticated caller's own record, never someone else's.

Auth required · any (system_owner, merchant, or customer)No body / params

Headers

Authorization: Bearer <token>
Accept-Language: en (optional - defaults to server config, or use ?lang= instead)

Plain query parameters - no request body / command field needed.

Example

---

Update Admin Profile

PUT/v2/profilecommand

Updates the caller's own name and/or phone (both optional, only supplied fields change). system_owner/merchant only - email and role/permission fields aren't editable through this endpoint at all.

Auth required · system_owner or merchant

Headers

Authorization: Bearer <token>
Content-Type: application/json
Accept-Language: en (optional - defaults to server config, or use ?lang= instead)

Requires "command": "update-admin-profile" in the request body.

Request fields

Field	Source	Type	Required	Validation
data.name	body	string	false	omitempty
data.phone	body	string	false	omitempty

Example

---

Update Customer Profile

PUT/v2/profile/customercommand

Updates the caller's own customer profile fields - name/phone/customer_type/company_name, all optional, only supplied fields change. This is also where a customer upgrades from 'individual' to 'business' by setting customer_type and filling in company_name, since registration deliberately doesn't collect that. Customer accounts only.

Auth required · customer

Headers

Authorization: Bearer <token>
Content-Type: application/json
Accept-Language: en (optional - defaults to server config, or use ?lang= instead)

Requires "command": "update-customer-profile" in the request body.

Request fields

Field	Source	Type	Required	Validation
data.name	body	string	false	omitempty
data.phone	body	string	false	omitempty
data.customer_type	body	string	false	omitempty,oneof=individual business
data.company_name	body	string	false	omitempty

Example

---