# Download a user data export

`GET /v1/jobs/user-exports/{job_id}/download` · permission `users:export`

Gives a single-use link to the package of a completed [user data export](/docs/api/management/users/export). Every call writes a `user_export.downloaded` record to the management audit log before the link is issued.

## Request

| Parameter | In | Required | Description |
|---|---|---|---|
| `job_id` | path | yes | Job id, prefixed `job_`. |

A job created with `include_ip: true` also requires `audit-events:read_ip` on the downloading credential.

## Response

`302 Found` with an empty body. `Location` is a relative link on the same host, `/downloads/user-exports/{environment_id}/{job_id}/{token}`. The response carries `Cache-Control: no-store` and `Referrer-Policy: no-referrer`.

- The link is valid for 15 minutes and works once: the token is spent on the first request, even if the transfer is interrupted. Call this operation again for a new link.
- The link needs no credentials; the token is the only credential. Keep `Location` secret and do not log it.
- The file is encrypted at rest with the environment's key, so no storage presigned URL is used; KeenAuth decrypts and streams it.

Following the link with `GET` returns `200 OK` with `Content-Type: application/zip`, `Content-Length` and `Content-Disposition: attachment; filename="user-export-job_….zip"`. `HEAD` is refused with `405` so that link previews do not spend the token. Compare the SHA-256 of the file with `file.sha256` of the job. If the connection ends before `Content-Length` bytes arrive, the package is incomplete; discard it and request a new link. An invalid, used or expired link returns `404 not_found`.

## Errors

Every error is an `application/problem+json` body with a stable `code`.

| HTTP | `code` | When |
|---|---|---|
| 401 | `unauthenticated` | The API key is missing, invalid or revoked. |
| 403 | `insufficient_permissions` | The key lacks `users:export`, or the job was created with `include_ip` and the key lacks `audit-events:read_ip` (`required_permissions` lists both). |
| 404 | `not_found` | The job does not exist, belongs to another environment, or the id is malformed. On the link: the token is invalid, used or expired. |
| 409 | `conflict` | The job is not completed yet, or its file has expired. |
| 429 | `rate_limited` | The rate limit was exceeded; honor `Retry-After`. The link itself allows 10 requests per minute per IP address. |
| 503 | `service_unavailable` | A dependency is temporarily unavailable; retry later. |

## Example

```bash
curl -L -o user-export.zip \
  https://api.eu.keenauth.com/v1/jobs/user-exports/job_01j9xk3m7q8r2s4t6v8w0y2z4e/download \
  -H "Authorization: Bearer $KEENAUTH_SECRET_KEY"
```

The CLI follows the link itself, writes the package to a file (never to standard output), refuses to overwrite an existing file and prints the size and SHA-256 of what it wrote:

```bash
keenauth jobs user-exports download job_01j9xk3m7q8r2s4t6v8w0y2z4e --file user-export.zip
```

## Personal data

This endpoint carries personal data: end-user profile. [Personal data in the KeenAuth APIs](/docs/policies/personal-data) describes what is stored, how long it is kept and how it is deleted. Do not send special categories of personal data (health, biometric data, religion, political opinions, sexual orientation) in any field.