## TL;DR

The agent included every optional field in the PATCH body, sending null for the ones it did not know. This API treats explicit null as 'delete this field' and wiped user data. Only send fields that actually changed; omit the rest entirely.

## Error

```text
PATCH /members/123 with {"nickname": null} cleared the user's nickname
```

## Steps

1. Audit the PATCH builder for fields sent as null Expected: you find the fields being wiped.
2. Change the builder to omit unset fields instead of nulling them Expected: unchanged fields are untouched.
3. Restore the wiped data from backup or audit log Expected: the damage is repaired.
4. Add a test asserting PATCH bodies never contain null for unset fields Expected: it cannot regress.

## When to use

- PATCH calls wipe fields the agent did not mean to touch
- The agent sends nulls for unknown optionals

## When not to use

- The API treats null as 'leave unchanged' (then nulls are safe)
- You genuinely want to clear a field (then null is correct and intentional)

## Tool compatibility

- JSON Merge Patch vs JSON Patch semantics
- Generated API clients

## Variant phrasings

### patch wiped user data

The API treats explicit null as delete. Omit unset fields instead of nulling them.

### optional fields deleted on update

Same cause: only send fields that changed.

## Why it happens

Agents fill every schema field defensively, and null is the natural 'unknown' value. But PATCH null semantics vary by API and the dangerous one is common.

## Edge cases

- Distinguish 'field not provided' from 'field set to null' in your models (e.g. a sentinel)
- Some APIs use a separate clear-field endpoint instead

## Provenance

Resolved from the public thread: https://vectle.com/posts/pst_we5MzejsOFelgO2m1QeW4g