Bug Report: PATCH /api/v1/users/{id} fails with "Field required: Email Notifications" in Joomla 6.0.2

Description

When attempting to update a user via the REST API using a PATCH request to /api/index.php/v1/users/{id}, the API consistently returns an error:

{"errors":[{"title":"Field required: Email Notifications"}]}

This error occurs regardless of the payload content, even when including the sendEmail field (which represents "Email Notifications" in the Joomla admin interface).

Environment

• Joomla Version: 6.0.2
• PHP Version: 8.3.30
• Test Site: https://edysma.net/fonderiabertoni/
• API Endpoint: /api/index.php/v1/users/{id}
• HTTP Method: PATCH
• Authentication: X-Joomla-Token header (API token)

Expected Behavior

The PATCH request should update the user's data (e.g., enable/disable the user by changing the block field) when providing valid data.

This bug randomly occurs also on v5 and 4 of the cms

Actual Behavior

Every PATCH request fails with:

{"errors":[{"title":"Field required: Email Notifications"}]}

Steps to Reproduce

1. Create a valid API token in Joomla 6.0.2
2. Execute a GET request to verify user data (this works):

curl -X GET "https://example.com/api/index.php/v1/users/356" \
  -H "Accept: application/vnd.api+json" \
  -H "Content-type: application/json" \
  -H "X-Joomla-Token: YOUR_TOKEN"

Response (successful):

{
  "data": {
    "type": "users",
    "id": "356",
    "attributes": {
      "groups": {"8": 8},
      "id": 356,
      "name": "Test User",
      "username": "testuser",
      "email": "test@example.com",
      "block": 0,
      "sendEmail": 1,
      "registerDate": "2026-01-20 18:06:37",
      "lastvisitDate": null,
      "lastResetTime": null,
      "resetCount": 0
    }
  }
}

3. Attempt to update the user with a PATCH request:

curl -X PATCH "https://example.com/api/index.php/v1/users/356" \
  -H "Accept: application/vnd.api+json" \
  -H "Content-type: application/json" \
  -H "X-Joomla-Token: YOUR_TOKEN" \
  -d '{"block": 1, "sendEmail": 1, "email": "test@example.com", "groups": [8]}'

Response (error):

{"errors":[{"title":"Field required: Email Notifications"}]}

Tested Payloads (All Failed)

Over 20 different payload variations were tested, including:

1. Minimal payload with only the field to update:

{"block": 1}

2. With sendEmail field:

{"block": 1, "sendEmail": 1, "email": "test@example.com", "groups": [8]}

3. Complete user data from GET response:

{
  "name": "Test User",
  "username": "testuser",
  "email": "test@example.com",
  "block": 1,
  "sendEmail": 1,
  "groups": [8]
}

4. With params object (like POST /users):

{
  "name": "Test User",
  "username": "testuser",
  "email": "test@example.com",
  "block": 1,
  "sendEmail": 1,
  "groups": [8],
  "params": {
    "admin_style": "",
    "admin_language": "it_IT",
    "language": "",
    "editor": "tinymce",
    "timezone": "Europe/Rome"
  }
}

5. With groups as object (matching GET structure):

{"block": 1, "sendEmail": 1, "email": "test@example.com", "groups": {"8": 8}}

6. Variations of sendEmail:
   • "sendEmail": 1
   • "sendEmail": 0
   • "sendEmail": "1"
   • "sendEmail": true
   • "sendEmail": false

All variations return the same error.

Additional Context

• No custom fields: The site has no custom user fields named "Email Notifications"
• POST /users works: Creating users via POST to /api/index.php/v1/users works correctly
• GET /users works: Reading user data via GET works correctly
• Joomla 4/5 compatibility: Similar PATCH operations work correctly on Joomla 4.x and 5.x with Authorization: Bearer header

Related Issues

This appears similar to #38277 which discussed PATCH requirements for the user groups array in Joomla 4.x.

The error message references "Email Notifications" which corresponds to the sendEmail field in the user form, as discussed in #29342.

Suggested Fix

Investigation needed to determine:

1. What field is actually missing/incorrectly validated
2. Whether this is a regression in Joomla 6.0.x
3. Why the sendEmail field validation is failing despite being provided in multiple formats

Impact

This bug prevents:

• Remote user management via API
• Enabling/disabling users programmatically
• Third-party applications from managing Joomla 6 users via REST API

Workaround

None currently available. Users must manage user accounts directly through the Joomla admin panel.

Test Date: January 20, 2026
Reporter: External developer managing multiple Joomla sites
Verified on: Production Joomla 6.0.2 installation