# Export my data

`POST /fapi/v1/me/exports` · called from the environment's sign-in host

Starts an export of the signed-in user's own data (GDPR Articles 15 and 20). The package is prepared in the background; when it is ready the user receives an e-mail in the language of the request, and the file can be downloaded with [Download an export](/docs/api/fapi/me/exports/download) for 7 days.

The package is a ZIP file with one JSON file per kind of data: profile, e-mail addresses and phone numbers, linked identities, authenticators (without secrets), sessions with their IP addresses, organization memberships, OAuth grants, consents and sign-in events. It never contains a password hash, a TOTP seed, recovery codes, tokens or `app_metadata`.

Requires a recent sign-in: if the session was not verified in the last 5 minutes, or the user has a second factor and the session did not use it, the answer is `401 step_up_required` and nothing is started. If an export of the user is still being prepared, that export is returned and no new one starts. A user can request at most 2 exports in 24 hours.

## Request

Headers:

| Header | Required | Description |
| --- | --- | --- |
| `Idp-Client` | yes | SDK identifier. |
| `Origin` | yes | Must be exactly `https://<sign-in host>`. |

Body:

```json
{}
```

## Response

`202 Accepted`:

```json
{"id": "job_01jbx4k6v8m2c9w5s7r3t1q0zy", "status": "queued", "file": null, "failure_reason": null,
 "created_at": "2026-11-03T09:30:00Z", "started_at": null, "completed_at": null, "expires_at": null}
```

## Errors

| Status | Code | When |
| --- | --- | --- |
| 401 | `unauthenticated` | No valid session cookie. |
| 401 | `step_up_required` | Sign-in older than 5 minutes, or a second factor is required; the `WWW-Authenticate` header carries `max_age=300` (and `acr_values` when a second factor is required). |
| 403 | `origin_not_allowed` | `Origin` is missing or wrong. |
| 429 | `export_rate_limited` | Two exports were already requested in the last 24 hours; retry after `Retry-After`. |
| 429 | `rate_limited` | Too many exports are being prepared in the environment; retry after `Retry-After`. |
| 503 | `service_unavailable` | The user directory is temporarily unavailable; retry after `Retry-After`. |

## Example

```bash
curl -X POST https://example.keenauth.app/fapi/v1/me/exports \
  -H "Idp-Client: my-app/1.0.0 (node/22.0.0)" \
  -H "Origin: https://example.keenauth.app" \
  -H "Content-Type: application/json" \
  -d '{}' \
  -b cookies.txt
```

## Personal data

This endpoint carries personal data: privacy requests (the user's own export records). [Personal data in the KeenAuth APIs](/docs/policies/personal-data) describes what is stored, how long it is kept and how it is deleted. Do not send special categories of personal data (health, biometric data, religion, political opinions, sexual orientation) in any field.