Docs · Features
Data export
A checksummed, access-confined export of a scope's whole object graph, one JSONL file per entity plus a manifest, in a ZIP. It exports only what you can already see, a self-serve export of your visible projects, or a whole-workspace dump for an admin, never includes a secret, and runs as an async job you start, poll and download.
What it does#
Sometimes you need a complete, portable, self-describing copy of a scope's data: to hand to a customer, to load into your own tools, or to archive. Data export walks the whole object graph for a scope you can already see and writes it as one JSONL file per entity in a ZIP, alongside a manifest that names the schema version, the scope, the per-entity row counts, and a checksum of every file.
Two properties make it safe to hand out. It is confined: it contains only rows the caller could already see, and it never crosses a customer, project or organization boundary. And it is secret-free: every credential column is dropped and every free-text field is scrubbed before it is written, with one narrow exception: an admin-only audit slice, when requested on a whole-workspace dump, is emitted raw so its verifiable hash chain stays intact.
Scopes range from your own visible projects, to one customer or one project, up to a whole-workspace dump for an admin, which alone can include the identity group and a verifiable audit slice. Every export also chooses a history depth: current state only, or the full append-only record.
Getting started#
Start an export from the CLI. It defaults to your own visible scope and current state:
export run
export run --scope customer --ref 7 --history fullPoll it to a terminal state, then download the artifact:
export status 3
export download <run_uuid> -o dump.zipEvery ZIP carries a manifest, so a third party can verify the artifact's integrity offline by recomputing each file's checksum. The web UI's Data export page covers the same flow: start, watch, download.
Works with#
- Documents: the document pipeline, projects, documents and segments, is most of what a dump contains.
- Reports: reports aggregate the numbers on your runs; this export dumps the underlying rows themselves, for portability rather than a summary.
- Keys: the key project change feed is the incremental complement, bootstrap a consumer with a full export, then keep it current with the change feed.
Current limits#
Export is asynchronous and staged, never a live stream. A failed job leaves no partial artifact to download.
It is read-only portability, not a backup and not a warehouse feed: it is a point-in-time dump, not a running feed.
A whole-workspace dump, including the identity group and the audit slice, is limited to admin accounts.
It is not exposed as an automated agent action: a full-graph dump is intentionally out of reach of that surface.
On an install that encrypts data at rest, export artifacts stage unencrypted on local disk unless object-store staging is configured, and the product refuses a new export until the operator acknowledges this trade-off.