client/write or administrator/write OAuth scope. Partial update: omitted fields are unchanged. person.email can also be updated (subject to the per-client uniqueness check). metadata is SHALLOW-merged — top-level keys you send are added/overwritten, other top-level keys are kept, but a nested object you send replaces the previous nested object entirely.