Export and erasure
Export the organization's dev data as a signed archive, or erase it after a 24-hour grace.
List exports
The organisation's newest exports, without download urls.
The organisation's exports, newest first: 20 unless limit says otherwise, 50 at most, and no cursor (has_more says whether older ones exist). An entry never carries download: only dev.org.export.get mints the 15-minute url and records it.
Parameters
| Name | Type | Required | Description |
|---|---|---|---|
limit | integer | Optional | clamped to 1 to 50 |
Response
data- newest first; download is always null
data[].bytes- the archive's size
data[].completed_atdata[].download- on dev.org.export.get of a ready export only
data[].download.expires_atdata[].download.urldata[].error- why a failed export failed
data[].expires_at- when the archive is deleted
data[].id- devexp_<32 hex>, with the cell's prefix
data[].requested_atdata[].requested_by- the person who asked for it
data[].rows- the rows of each file
data[].sha256- the archive's sha-256, hex
data[].state- One of
pending,running,ready,failed,expired has_more- older exports exist past limit
next_cursor- always absent; the list has no cursor
Errors
- 403an error
curl "$CIRESK_API/v1/dev/exports" \
-H "Authorization: Bearer $CIRESK_KEY"Create an export
Export the organisation's dev data as a signed archive.
A person with dev:org.export asks for an export of everything dev holds for the organisation that retention has not yet deleted: its sessions with their writers, device grants, members, needs, ci records and web handoffs, every session's journal, every policy version, template versions, promotions and files, egress decisions, connection windows, the usage ledger, workers, session secrets' names and bindings (never a value), erasures, exports, and every dev audit record as dev.audit.list shows it. One JSONL file per table in a zip with manifest.json (each file's sha-256 and row count) and manifest.sig, a dvx_ assertion over the manifest's sha-256 by the cell's signing key (GET /v1/dev/keys). The export is built in the background; a pending or running export of the organisation answers that one. Recorded as dev.org.export at request and dev.org.exported or dev.org.export.failed at the end. Without the installation's object store it answers 503 export_unavailable.
Response
bytes- the archive's size
completed_atdownload- on dev.org.export.get of a ready export only
download.expires_atdownload.urlerror- why a failed export failed
expires_at- when the archive is deleted
id- devexp_<32 hex>, with the cell's prefix
requested_atrequested_by- the person who asked for it
rows- the rows of each file
sha256- the archive's sha-256, hex
state- One of
pending,running,ready,failed,expired
curl -X POST "$CIRESK_API/v1/dev/exports" \
-H "Authorization: Bearer $CIRESK_KEY"Get an export
An export of the organisation, with a download url once it is ready.
A ready export carries download, a GET url valid 15 minutes, minted at each read and recorded as dev.org.export.downloaded. The archive is deleted 7 days after it was built (state expired) and with the organisation's erasure.
Parameters
| Name | Type | Required | Description |
|---|---|---|---|
export_id | string | Required | The export's ID. |
Response
bytes- the archive's size
completed_atdownload- on dev.org.export.get of a ready export only
download.expires_atdownload.urlerror- why a failed export failed
expires_at- when the archive is deleted
id- devexp_<32 hex>, with the cell's prefix
requested_atrequested_by- the person who asked for it
rows- the rows of each file
sha256- the archive's sha-256, hex
state- One of
pending,running,ready,failed,expired
curl "$CIRESK_API/v1/dev/exports/591b4a91-0807-456c-a866-7ebbca042b12" \
-H "Authorization: Bearer $CIRESK_KEY"Get the latest erasure
Response
checkpoints- the checkpoint objects and versions deleted, once erased; null when the installation has no store configured and the bucket's 30-day rule removes them
completed_at- when it was erased or cancelled
erase_after- the end of the 24-hour grace
killed- the live sessions the request stopped
requested_atrows- the dev rows deleted, once erased
state- cancelled: dev.org.erasure.cancel within the grace; the sessions the request killed stay endedOne of
erasing,erased,cancelled subjects- the audit subjects erased, once erased
Errors
- 404an error
curl "$CIRESK_API/v1/dev/erasure" \
-H "Authorization: Bearer $CIRESK_KEY"Erase the organization's data
Erase the organisation's dev data after a 24-hour grace.
A person with dev:org.erase types the organisation's id back. Every live session is killed at once (the kill switch, reason org_erasure) and dev.sessions.up answers 409 org_erasing until the erasure completes. After erase_after (24 hours on) the sweeper deletes every dev row of the organisation, its checkpoint objects when the installation configured the store, and erases every subject its audit records name (the records stay, pseudonymised); the erasure is recorded as dev.org.erase at request and dev.org.erased at the end. A request while one is pending answers that one.
Request body
confirm- the organisation's id, typed back
Response
checkpoints- the checkpoint objects and versions deleted, once erased; null when the installation has no store configured and the bucket's 30-day rule removes them
completed_at- when it was erased or cancelled
erase_after- the end of the 24-hour grace
killed- the live sessions the request stopped
requested_atrows- the dev rows deleted, once erased
state- cancelled: dev.org.erasure.cancel within the grace; the sessions the request killed stay endedOne of
erasing,erased,cancelled subjects- the audit subjects erased, once erased
curl -X POST "$CIRESK_API/v1/dev/erasure" \
-H "Authorization: Bearer $CIRESK_KEY" \
-H "Content-Type: application/json" \
-d '{
"confirm": "acme/platform"
}'Cancel the pending erasure
Cancel the organisation's pending erasure within its 24-hour grace.
A person with dev:org.erase cancels the pending erasure while erase_after is still ahead: its state becomes cancelled with completed_at set, the row stays as the evidence, and dev.sessions.up works again. The sessions the request killed stay ended. Recorded as dev.org.erasure.cancelled. A cancel of an erasure already cancelled answers it as it is; once erase_after has passed the sweeper may be deleting and the cancel answers 409 erasure_started; with no erasure pending or cancelled, 404 erasure_not_found.
Response
checkpoints- the checkpoint objects and versions deleted, once erased; null when the installation has no store configured and the bucket's 30-day rule removes them
completed_at- when it was erased or cancelled
erase_after- the end of the 24-hour grace
killed- the live sessions the request stopped
requested_atrows- the dev rows deleted, once erased
state- cancelled: dev.org.erasure.cancel within the grace; the sessions the request killed stay endedOne of
erasing,erased,cancelled subjects- the audit subjects erased, once erased
curl -X DELETE "$CIRESK_API/v1/dev/erasure" \
-H "Authorization: Bearer $CIRESK_KEY"