---
title: "Export PCAP for Multiple Sessions"
method: GET
path: "/v3/sessions/export"
tags: ["Sessions"]
---

# Export PCAP for Multiple Sessions

`GET /v3/sessions/export`

Returns a PCAP file containing packets from sessions matching the query criteria.
The response is a binary PCAP file suitable for analysis with tools like Wireshark.

Not available when `scope=demo` (returns 403).

## Query parameters

- `scope` 'workspace' | 'demo'
- `start_time` string, date-time, required
- `end_time` string, date-time, required
- `query` string
- `mode` 'page' | 'all'
- `page` integer
- `page_size` integer
- `sort_by` string
- `sort_desc` 'true' | 'false'

## Response `200`

PCAP file containing matching session packets.

## Other responses

- `400` — Bad request - request syntax is invalid for the specified endpoint. Verify request syntax and try again.
- `401` — Unauthorized. Please check your API key.
- `403` — Forbidden - request is not authorized due to an invalid API key or plan limitations. If due to plan limitations, contact sales@greynoise.io to upgrade your plan and unlock full results.
- `404` — Resource not found.
- `429` — Too many requests. You've hit the rate-limit.
- `500` — Unexpected error

---

[API](https://skmtc.dev/greynoise/apis/greynoise-api.md) · [All operations](https://skmtc.dev/greynoise/apis/greynoise-api/llms.txt) · [OpenAPI document](https://skmtc-service-production.skmtc.workers.dev/v1/apis/greynoise/greynoise-api/revisions/30942574656d/schema)