# Download an export

`GET /fapi/v1/me/exports/{export_id}/download` · called from the environment's sign-in host

Returns the ZIP package of one of the signed-in user's completed exports as an attachment (`Content-Type: application/zip`, `Content-Disposition: attachment; filename="user-export-job_….zip"`). Compare the file with `file.sha256` of the export to check it. Each download is recorded in the environment's audit log before the first byte is sent. If the transfer breaks, the connection is closed so a partial file never looks complete; download again.

Requires a recent sign-in, like the request: if the session was not verified in the last 5 minutes, or the user has a second factor and the session did not use it, the answer is `401 step_up_required`. `HEAD` is not supported (`405`).

## Request

Headers:

| Header | Required | Description |
| --- | --- | --- |
| `Idp-Client` | yes | SDK identifier. |

## Response

`200 OK` with the ZIP file as the body.

## Errors

| Status | Code | When |
| --- | --- | --- |
| 401 | `unauthenticated` | No valid session cookie. |
| 401 | `step_up_required` | Sign-in older than 5 minutes, or a second factor is required; the `WWW-Authenticate` header carries `max_age=300` (and `acr_values` when a second factor is required). |
| 404 | `not_found` | No such export of the user. |
| 409 | `conflict` | The export is not completed yet, or its file has expired. |
| 503 | `service_unavailable` | The user directory is temporarily unavailable; retry after `Retry-After`. |

## Example

```bash
curl -OJ https://example.keenauth.app/fapi/v1/me/exports/job_01jbx4k6v8m2c9w5s7r3t1q0zy/download \
  -H "Idp-Client: my-app/1.0.0 (node/22.0.0)" \
  -b cookies.txt
```

## Personal data

This endpoint carries personal data: end-user profile, credentials, linked identities, sessions, organization memberships and invitations, consent records, environment logs and privacy requests (the package holds the user's own data of each of these kinds). [Personal data in the KeenAuth APIs](/docs/policies/personal-data) describes what is stored, how long it is kept and how it is deleted. Do not send special categories of personal data (health, biometric data, religion, political opinions, sexual orientation) in any field.