Partially update passenger, contact, frequent-flyer, company, billing-contact, and consent details. Only provided fields are written.

Assistance and dietary needs: each passenger may carry accessibilityNeeds and dietaryNeeds in the profile's shapes; invalid codes return a field-level 422. They are special-category data: stored encrypted, never logged, and copied to the profile created at account creation only when specialNeedsProfileConsent is true. passengers replaces the whole list, needs included.

Guest session token: accepted while the session is draft or details_captured. Any later state returns an uncoded 409.

Contact email is locked once a magic link has been sent: the address the first magic link is emailed to is the identity the account is created for, and nothing proves the owner of that address agreed to a replacement. A link_sent session therefore answers an uncoded 409 to a contactEmail that differs from the stored one (re-sending the stored address is accepted as a no-op), so every later magic-link send and resend goes to the same address. Correct a mistyped address by changing contactEmail before the first send; once a link has been sent, start a new checkout session instead.

Account bearer (consumer HMAC + BearerToken): lets a traveler who created their account from guest checkout correct what they entered as a guest before paying. The session is resolved from the traveler's account_id and user_id, exactly as GET does, so another traveler on the same account cannot read or write it. Only an account_created session with no bookingId is editable; any other state, or a session that already has a booking, returns 409 CHECKOUT_DETAILS_LOCKED. Editable fields are passengers, contactPhone, frequentFlyer, company and billingContact; contactEmail (the account identity), consents (already recorded), specialNeedsProfileConsent and verticalDetail return 422. The status, the held selection (lockedSelectionId) and the hold expiry are never changed, and a later booking is created from the values the session now holds.