Partially updates an existing candidate profile, addressed by the caller's own identifier rather than Popp's. Behaves exactly like PATCH /v1/candidates/{id}: send only the fields you want to change — omitting a field leaves the stored value alone, while sending null clears it — and the endpoint never creates. An externalId with no candidate in the caller's organization group returns 404, so a mistyped identifier cannot silently produce a new candidate (use POST /v1/candidates to create or upsert). Any key in the organization group can patch the candidate; custom fields are validated against the candidate's own organization, never the one the API key defaults to, and a patch never changes which organizations the candidate belongs to. An optional externalOrganizationId must name one of those organizations. A supplied documentUrl or documentBase64 is downloaded during the request, so a failed fetch surfaces as a 502. documentUrl is fetched with the organization group's stored credential when one is registered and unauthenticated when it is not, so a presigned or public URL works; the destination must be an https URL resolving to a public address and is not followed through redirects, and one that is refused is a 400 rather than a 502. CV parsing and vectorization always continue asynchronously afterwards, so a 200 means the fields are stored, never that the CV has been parsed or indexed. Resending a document with the same bytes keeps its parsed data rather than parsing it again; to force a fresh parse use the reparse endpoint.