Ory is the largest open source community in the world for cloud software application security. We maintain advanced open source security software solving authentication, authorization, access control, application network security, and delegation. Ory implements a variety of industry and best-practice standards including OAuth 2.0 / OAuth 2.1, OpenID Connect, Zero Trust Networking, Google Zanzibar Policy Framework, FIDO2 U2F, WebAuthn, TOTP, and more.

Ory Community

The <https://www.ory.sh/docs/reference/api#tag/identity/operation/updateIdentity|Update an Identity> route overwrites the `public_metadata` back to `null` if no value is provided in the payload. This seems like a bug since it is an optional value. I would expect it to leave the existing value unchanged if no value is provided. Should I log a bug, or is this the expected behaviour?

This is expected behavior: `PUT` replaces the exisitng entity in it’s entirety with a new one.

Except it doesn’t overwrite the `credentials`. So the behaviour is a bit inconsistent.

And some of the “required” properties e.g. `schema_id` can be omitted.

I think the behaviour is fine, but the documentation could be a bit a more clear.