Thank you for reaching out to Constant Contact's API Support.
When a contact is listed as express permission inside of the Constant Contact account then it can only be updated by that contact themselves. Express permission basically says the contact has verified the information is correct and that any changes to the information made by someone other than the contact would make the information no longer correct.
When submitting information through the API the way you tell the system that it is the contact who is making the change to the information is by using the query parameter ACTION_BY_VISITOR. Please keep in mind even a small change such as altering the first name from Robert to Bob can technically be against some of the data laws such as CASL and/or GDPR; unless the action was truly initiated by the contact directly or by permission of the contact.
... View more