Partially updates an existing candidate profile, addressed by the caller's own identifier rather than Popp's. Behaves exactly like PATCH /v1/candidates/{id}: send only the fields you want to change — omitting a field leaves the stored value alone, while sending null clears it — and the endpoint never creates. An externalId with no candidate in the caller's organization group returns 404, so a mistyped identifier cannot silently produce a new candidate (use POST /v1/candidates to create or upsert). Organization context is taken from the authenticated API key, never from the body. A supplied documentUrl or documentBase64 is downloaded during the request, so a failed fetch surfaces as a 502. documentUrl is fetched with the organization group's stored credential when one is registered and unauthenticated when it is not, so a presigned or public URL works; the destination must be an https URL resolving to a public address and is not followed through redirects, and one that is refused is a 400 rather than a 502. CV parsing and vectorization always continue asynchronously afterwards, so a 200 means the fields are stored, never that the CV has been parsed or indexed.