Department-only payloads apply in a single call (200 user). Payloads containing first_name / last_name / contact_number enter a two-call OTP flow against update_user: empty code returns a challenge (data.type = "challenge", 201) carrying expiration_at/resend_at/factor; populated code verifies the OTP and applies the patch (data.type = "user", 200). Empty strings on contact_number/department clear the column; empty strings on first_name/last_name are rejected (NOT NULL). A non-empty contact_number must be an E.164 number with any country code (e.g. +639171234567) — anything else returns 422. login_notification is intentionally NOT here — see PATCH /v1/users/login_notification.