Export a user's data

POST /v1/users/{user_id}:export · permission users:export

Starts a job that packages the personal data KeenAuth holds about one user, for a data subject access or portability request (GDPR Articles 15 and 20). The job runs in the background: poll Get a user data export job until status is completed, then download the package. The end user is not emailed; delivering the package to them is your responsibility.

Request

Parameter In Required Description
user_id path yes User id, prefixed usr_.
Idempotency-Key header no 16–64 characters [A-Za-z0-9_-]. The same key from the same credential returns the same job.
include_ip body no true adds session and event IP addresses to the package. Requires audit-events:read_ip as well. Default false.

The body is optional; send {} or no body for an export without IP addresses.

{ "include_ip": false }

Response

202 Accepted with the job. A replayed request with the same Idempotency-Key returns the original job and Idempotent-Replayed: true.

{
  "id": "job_01j9xk3m7q8r2s4t6v8w0y2z4e",
  "kind": "subject",
  "source": "management_api",
  "user_id": "usr_01j9xk3m7q8r2s4t6v8w0y2z4a",
  "status": "queued",
  "include_app_metadata": true,
  "include_ip": false,
  "file": null,
  "failure_reason": null,
  "requested_by": { "type": "api_key", "id": "key_01j9xk3m7q8r2s4t6v8w0y2z4b" },
  "created_at": "2026-10-28T09:00:00Z",
  "started_at": null,
  "completed_at": null,
  "expires_at": null
}

The package is a ZIP file:

File Contents
manifest.json Schema version, job and user ids, creation time, source, and the SHA-256 and record count of every other file.
profile.json, emails.json, phones.json Profile fields, email addresses and phone numbers.
metadata.json user_metadata and app_metadata.
identities.json Linked social and enterprise identities.
authenticators.json, sessions.json Passkeys and other authenticators (no secrets), and sessions.
organizations.json, oauth_grants.json, consents.json Organization memberships, OAuth grants and consent records.
auth_events.ndjson Authentication events, one JSON object per line.

Password hashes, TOTP seeds, recovery codes, session tokens and raw SAML or ID tokens are never included. The package is kept for 7 days after the job completes.

Errors

Every error is an application/problem+json body with a stable code.

HTTP code When
400 malformed_request The body or the Idempotency-Key header is malformed.
401 unauthenticated The API key is missing, invalid or revoked.
403 insufficient_permissions The key lacks users:export, or include_ip is true and the key lacks audit-events:read_ip (required_permissions lists both).
404 not_found The user does not exist in this environment, or the id is malformed.
422 idempotency_key_reuse The Idempotency-Key was used with a different request.
429 rate_limited Too many export jobs are queued or running in this environment, or the rate limit was exceeded; honor Retry-After.
503 service_unavailable A dependency is temporarily unavailable; retry later.

Example

curl -X POST https://api.eu.keenauth.com/v1/users/usr_01j9xk3m7q8r2s4t6v8w0y2z4a:export \
  -H "Authorization: Bearer $KEENAUTH_SECRET_KEY" \
  -H "Idempotency-Key: dsar-2026-10-28-0001" \
  -H "Content-Type: application/json" \
  -d '{"include_ip": false}'

CLI: keenauth users export usr_01j9xk3m7q8r2s4t6v8w0y2z4a

Personal data

This endpoint carries personal data: end-user profile. Personal data in the KeenAuth APIs describes what is stored, how long it is kept and how it is deleted. Do not send special categories of personal data (health, biometric data, religion, political opinions, sexual orientation) in any field.