DELETE V1/addresses/:addressId - This Rest API is not working with Customer Token

Question

delete /V1/addresses/{addressId}

This is the Delete Address REST API in Magento 2.

It works with admin tokens, but not with customer tokens.

I think it should be working with custom tokens as customers should have the right to delete their own addresses stored.

This API has access permission for Resource: Magento_Customer::manage

This resource permission should be working with customer token, isn't it?

Does anybody have the same issue?

Answer 1

Customer token CANNOT access customerAddressRepositoryV1 so your API doesn't work on customer token. This is how swagger looks after inserting a customer token:

If customer wants to modify/delete customer address, we can use PUT /V1/customer/me. Although it doesn't list on swagger(Confirmed: it's a bug), it tested and successful on my 2.1.7 EE + POSTMAN. Here is a sample JSON for using PUT /V1/customer/me:

{
  "customer": {
    "email": "your_email",
    "firstname": "your_firstname",
    "lastname": "your_lastname",
    "website_id": 1,
    "addresses": [

    ],
    ...
   }
}

Of course, you have to add token on header.