Export my data
POST /fapi/v1/me/exports · called from the environment's sign-in host
Starts an export of the signed-in user's own data (GDPR Articles 15 and 20). The package is prepared in the background; when it is ready the user receives an e-mail in the language of the request, and the file can be downloaded with Download an export for 7 days.
The package is a ZIP file with one JSON file per kind of data: profile, e-mail addresses and phone numbers, linked identities, authenticators (without secrets), sessions with their IP addresses, organization memberships, OAuth grants, consents and sign-in events. It never contains a password hash, a TOTP seed, recovery codes, tokens or app_metadata.
Requires a recent sign-in: if the session was not verified in the last 5 minutes, or the user has a second factor and the session did not use it, the answer is 401 step_up_required and nothing is started. If an export of the user is still being prepared, that export is returned and no new one starts. A user can request at most 2 exports in 24 hours.
Request
Headers:
| Header | Required | Description |
|---|---|---|
Idp-Client |
yes | SDK identifier. |
Origin |
yes | Must be exactly https://<sign-in host>. |
Body:
{}
Response
202 Accepted:
{"id": "job_01jbx4k6v8m2c9w5s7r3t1q0zy", "status": "queued", "file": null, "failure_reason": null,
"created_at": "2026-11-03T09:30:00Z", "started_at": null, "completed_at": null, "expires_at": null}
Errors
| Status | Code | When |
|---|---|---|
| 401 | unauthenticated |
No valid session cookie. |
| 401 | step_up_required |
Sign-in older than 5 minutes, or a second factor is required; the WWW-Authenticate header carries max_age=300 (and acr_values when a second factor is required). |
| 403 | origin_not_allowed |
Origin is missing or wrong. |
| 429 | export_rate_limited |
Two exports were already requested in the last 24 hours; retry after Retry-After. |
| 429 | rate_limited |
Too many exports are being prepared in the environment; retry after Retry-After. |
| 503 | service_unavailable |
The user directory is temporarily unavailable; retry after Retry-After. |
Example
curl -X POST https://example.keenauth.app/fapi/v1/me/exports \
-H "Idp-Client: my-app/1.0.0 (node/22.0.0)" \
-H "Origin: https://example.keenauth.app" \
-H "Content-Type: application/json" \
-d '{}' \
-b cookies.txt
Personal data
This endpoint carries personal data: privacy requests (the user's own export records). Personal data in the KeenAuth APIs describes what is stored, how long it is kept and how it is deleted. Do not send special categories of personal data (health, biometric data, religion, political opinions, sexual orientation) in any field.