---
title: "Exporting Form Submissions to CSV via POST"
method: POST
path: "/v1/projects/{projectId}/forms/{xmlFormId}/submissions.csv.zip"
tags: ["Submissions"]
---

# Exporting Form Submissions to CSV via POST

`POST /v1/projects/{projectId}/forms/{xmlFormId}/submissions.csv.zip`

This non-REST-compliant endpoint is provided for use with [Project Managed Encryption](/central-api-encryption). In every respect, it behaves identically to the `GET` endpoint described in the previous section, except that it works over `POST`. This is necessary because for browser-based applications, it is a dangerous idea to simply link the user to `/submissions.csv.zip?2=supersecretpassphrase` because the browser will remember this route in its history and thus the passphrase will become exposed. This is especially dangerous as there are techniques for quickly learning browser-visited URLs of any arbitrary domain.

You can exclude the media attachments from the ZIP file by specifying `?attachments=false`.

And so, for this `POST` version of the Submission CSV export endpoint, the passphrases may be provided via `POST` body rather than querystring. Two formats are supported: form URL encoding (`application/x-www-form-urlencoded`) and JSON. In either case, the keys should be the `keyId`s and the values should be the `passphrase`s, as with the `GET` version above.

## Path parameters

- `projectId` number, required
- `xmlFormId` string, required

## Query parameters

- `attachments` boolean
- `$filter` string
- `groupPaths` boolean
- `deletedFields` boolean
- `splitSelectMultiples` boolean

## Response `200`

OK

## Other responses

- `400` — Bad Request

## Changes

- **2025-12-20** `022694254f0d` — 1 info
  - api operation id `Exporting Form Submissions to CSV via POST` removed and replaced with `exportFormSubmissionsToCsvViaPost`
- **2025-10-27** `b11b54eea487` — 2 info
  - added the media type `application/zip` for the response with the status `200`
  - removed the non-success response with the status `403`
- **2025-03-13** `e8c2858fd4eb` — 1 breaking, 2 info
  - removed the media type `application/zip` for the response with the status `200`
  - api operation id `exportFormSubmissionsToCsvViaPost` removed and replaced with `Exporting Form Submissions to CSV via POST`
  - added the non-success response with the status `403`

[Change history](https://skmtc.dev/getodk/apis/odk-central-api/changes/v1/projects/:projectId/forms/:xmlFormId/submissions.csv.zip/post.md)

---

[API](https://skmtc.dev/getodk/apis/odk-central-api.md) · [All operations](https://skmtc.dev/getodk/apis/odk-central-api/llms.txt) · [OpenAPI document](https://skmtc-service-production.skmtc.workers.dev/v1/apis/getodk/odk-central-api/revisions/d4f5ba77f644/schema)