---
title: "Export user data (GDPR)"
method: POST
path: "/v1/gdpr/export"
tags: ["gdpr"]
---

# Export user data (GDPR)

`POST /v1/gdpr/export`

## Request

- Base URL: `https://api.brixsignage.com`
- URL: `https://api.brixsignage.com/v1/gdpr/export`
- Auth: HTTP bearer

Same as the GET version of this operation: assembles a data subject access request export for the whole workspace as one JSON file, with secret values withheld. The key or person must have `billing.export` for the whole workspace. Takes no request body.

**Notes.**
- Exports the whole workspace, not one person: every person, screen and piece of content, and the last 365 days of the activity log.
- No `{ data }` envelope: the body is the export file (`Content-Disposition: attachment`).
- Credentials are never exported: their columns are kept with `null` or a `[secret; not exported]` / `[encrypted; not exported]` marker.
- Takes no body; the same export as the GET.

## Response `200`

Success.

- object
  - `schemaVersion` 1, required
  - `generatedAt` string, required: ISO-8601 timestamp (UTC).
  - `subject` object, required
    - `spaceId` string, required: The workspace exported.
    - `requestedByUserId` string, nullable, required: Null for an API key.
  - `limits` object, required
    - `perTable` integer, required: At most this many rows per table.
    - `auditEvents` integer, required: At most this many activity log events.
    - `auditWindowDays` integer, required: Activity log events from this many days back.
  - `truncated` object, required: The tables cut at the limit; empty when none.
  - `complete` boolean, required: False when a table was cut at the limit.
  - `tables` object, required
    - `workspace` object, nullable, required: The workspace record, every column (the Screen Lock PIN hash replaced by `kioskHasGlobalPin` inside `prefs`).
    - `users` object[], required
      - `id` string, required
      - `name` string, required
      - `email` string, required
      - `title` string, nullable, required
      - `phone` string, nullable, required
      - `status` string, required
      - `lastLoginAt` string, nullable, required: ISO-8601 timestamp (UTC).
      - `emailVerifiedAt` string, nullable, required: ISO-8601 timestamp (UTC).
      - `createdAt` string, required: ISO-8601 timestamp (UTC).
      - `updatedAt` string, required: ISO-8601 timestamp (UTC).
      - `deletedAt` string, nullable, required: ISO-8601 timestamp (UTC).
    - `screens` object[], required: Every column; credentials withheld, and `kioskHasCustomPin` / `kioskHasRecovery` added.
    - `media` object[], required
    - `playlists` object[], required
    - `schedules` object[], required
    - `layouts` object[], required
    - `creatives` object[], required
    - `appInstances` object[], required
    - `dataSources` object[], required: `config` is `[encrypted; not exported]` (or null).
    - `banners` object[], required
    - `auditEvents` object[], required: Newest first.

## Other responses

- `401`: Missing, expired or revoked bearer token.
- `403`: You do not hold the permission for the whole workspace (a grant at one location, or in a franchise workspace, is not enough).
- `5XX`: Server error. The body carries a `requestId` to quote to support.

---

[API](https://skmtc.dev/brixsignage/apis/brix-api.md) · [All operations](https://skmtc.dev/brixsignage/apis/brix-api/llms.txt) · [OpenAPI document](https://skmtc.dev/brixsignage/apis/brix-api/revisions/7c2741bcdb16?raw)