Update an account's primary contact

PUT 
/accounts/:accountId/contacts/primary

Replaces the primary contact information on an AWS account: the name, company and postal address AWS holds for the account owner.

This is a replace, not a merge. It maps onto the AWS PutContactInformation call, which overwrites the whole contact record. Send every field you want to keep; a field you omit is cleared, not preserved. Read the current values with POST /accounts/{accountId}/contacts/get first and send them back modified.

Prism validates nothing in the body. It is decoded only far enough to confirm it is valid JSON and then forwarded as sent, so the field rules are AWS's and a body that breaks them fails upstream, reaching you as a 502, not a 400.

This is the only method registered at this exact path. DELETE on it is not a way to clear the primary contact: no delete route is registered for primary, so a DELETE .../contacts/primary falls through to DELETE /accounts/{accountId}/contacts/{type} with type set to primary and is forwarded upstream as an alternate-contact deletion of a type that does not exist. Expect a 502.

Like the other five contacts operations, this one is a proxy to CloudKeeper's ops-service, is present on every deployment, and reports every upstream failure as a 502; see POST /accounts/{accountId}/contacts/get for the full explanation.

Request

Responses

200

The ops-service accepted the update and AWS applied it. The response carries no data (read the contact back if you want to see the stored result), and message is the fixed string Primary contact updated.

400

The request body is not valid JSON. This is the only thing about the body that Prism checks: a well-formed object with missing or nonsense fields is forwarded, and fails upstream as a 502.

401

Authentication failed: the X-API-Token header was missing, malformed, expired or not recognised.

This response is text/plain, not JSON. It is written by http.Error in the authentication middleware, which runs before any handler and therefore before anything that would build a JSON envelope. A client that unconditionally JSON-parses response bodies will fail on this one, so check the status code first.

403

The token is valid, but it is not allowed to act on this tenant.

An API token is minted inside one tenant and stays bound to it for life. Sending it to a path whose tenant segment names a different tenant is refused here, in middleware, before the operation runs, so this says nothing about the resource you asked for, only about which tenant the path named. Check the tenant server variable against the console the token was created in.

404

No tenant matches the tenant segment of the request path. An AWS account that does not exist is a 502, not a 404.

502

The update did not happen. Every upstream outcome lands here: the ops-service is unreachable, this self-hosted install is not paired with CloudKeeper SaaS, the account does not exist, or AWS rejected the contact, most often for a missing required field or a phone number or country code it will not accept. message carries the upstream reason verbatim and is the only way to tell these apart.