Why does Stripe use POST for customer updates instead of PATCH or PUT?

Sometimes, it's simply a matter of "because they can." There isn't always a deeper rationale behind these decisions beyond the fact that they're doing it their way.

I've heard security auditors raise concerns about using anything other than GET and POST for API calls. If Stripe has to work with government systems, they might have to adhere to these standards for security reasons. I’m not saying I fully agree with them, but they can have a big influence on API choices.

It's possible that Stripe's choice is just about maintaining compatibility, especially if their API has been around for a while and needs to support older integrations.

A lot of APIs don't strictly follow REST principles. Many just use GET for retrieving data and POST for changing it. Honestly, the other methods like PUT and PATCH can be useful for clarity, but many developers don't feel the need to enforce them. It's often more about practicality than adherence to technical rules.

It's interesting that you find it unconventional. Remember, API operations are fundamentally about formatted text. In the past, verbs weren't as important; POST was used extensively. Now, we often get caught up in following the rules too strictly but at the end of the day, it's just a name for an operation.