# Set User Profile Details
## Endpoint
`/api/user/profile/set`
## Method
GET
## Description
Allows changing user account profile values such as the display name and session timeout.
## Parameters
| `token` | string | Yes | - | The session token generated **only** by the `login` call (API tokens from `createToken` cannot be used). |
| `displayName` | string | No | - | The display name to set for the user account. |
| `sessionTimeoutSeconds` | integer | No | - | The session timeout value to set in seconds for the user account. |
## Authentication
Requires a session token from the `login` call ONLY. API tokens from `createToken` are not permitted (consistent with the restriction that API tokens cannot update user profile details).
## Response Fields
The response returns the full user profile (same structure as `/api/user/profile/get`):
| `response.displayName` | string | The (updated) display name of the user account. |
| `response.username` | string | The username of the user account. |
| `response.totpEnabled` | boolean | Whether 2FA is enabled on this account. |
| `response.disabled` | boolean | Whether the user account is disabled. |
| `response.previousSessionLoggedOn` | string | ISO 8601 timestamp of the previous session login. |
| `response.previousSessionRemoteAddress` | string | IP address from which the previous session was initiated. |
| `response.recentSessionLoggedOn` | string | ISO 8601 timestamp of the most recent session login. |
| `response.recentSessionRemoteAddress` | string | IP address from which the most recent session was initiated. |
| `response.sessionTimeoutSeconds` | integer | The (updated) session timeout value in seconds. |
| `response.memberOfGroups` | array of strings | List of group names the user belongs to. |
| `response.sessions` | array of objects | List of active sessions for this user (same structure as profile/get). |
## Conditional Logic Notes
- Both `displayName` and `sessionTimeoutSeconds` are optional. You can update one, both, or neither (though calling with no optional params would be a no-op).
- API tokens (from `createToken`) are explicitly blocked from using this endpoint.
- The response returns the full updated profile, allowing the caller to verify the changes took effect.
## Edge Cases
- Calling this endpoint with no optional parameters set is technically valid but results in no changes.
- The response structure is identical to `/api/user/profile/get`, providing the full profile after updates are applied.
- The `sessionTimeoutSeconds` value affects when login session tokens expire due to inactivity, but does not affect API tokens (which never expire).