Partially updates an existing candidate profile. Send only the fields you want to change: omitting a field leaves the stored value alone, while sending null clears it. This endpoint never creates — an id that does not exist in the caller's organization group returns 404, so a mistyped id cannot silently produce a new candidate (use POST /v1/candidates to create or upsert). Any key in the organization group can patch the candidate; custom fields are validated against the candidate's own organization, never the one the API key defaults to, and a patch never changes which organizations the candidate belongs to. An optional externalOrganizationId must name one of those organizations. A supplied documentUrl or documentBase64 is downloaded during the request, so a failed fetch surfaces as a 502. documentUrl is fetched with the organization group's stored credential when one is registered and unauthenticated when it is not, so a presigned or public URL works; the destination must be an https URL resolving to a public address and is not followed through redirects, and one that is refused is a 400 rather than a 502. CV parsing and vectorization always continue asynchronously afterwards, so a 200 means the fields are stored, never that the CV has been parsed or indexed. Resending a document with the same bytes keeps its parsed data rather than parsing it again; to force a fresh parse use the reparse endpoint.