---
title: "Export everything of one user (GDPR)"
method: POST
path: "/apps/{id}/users/{userId}/export"
tags: ["Apps"]
---

# Export everything of one user (GDPR)

`POST /apps/{id}/users/{userId}/export`

## Request

- Base URL: `https://api.hypamoon.com/api/v1`
- URL: `https://api.hypamoon.com/api/v1/apps/{id}/users/{userId}/export`
- Auth: one of:
  - HTTP bearer
  - OAuth 2 (authorization code, authorization URL `https://app.hypamoon.com/oauth/authorize`, token URL `https://api.hypamoon.com/oauth/token`, scopes: `sites:write`)

Everything of one user of the app as JSON: what Hypamoon keeps (account, membership, passkeys without the keys), every row in the per-user tables (set with set_table_owner_column) and every file of theirs with a download link for 15 minutes. unmarked_tables lists the tables that are not per-user: Hypamoon cannot tell which rows there are theirs, so check those yourself. app_tables not_included: the app has no per-user tables at all, so no row of its database is in the export.

## Path parameters

- `id` string, uuid, required
- `userId` string, uuid, required

## Response `200`

The export.

- object: Everything about one user of an app, as JSON, with temporary download links for their files.
  - `app_id` string, uuid, required
  - `user_id` string, uuid, required
  - `exported_at` string, required
  - `account` object, nullable, required: What Hypamoon keeps about the person; null if the account is already gone.
    - `id` string, uuid, required
    - `email` string, required
    - `name` string, nullable, required
    - `created_at` string, required
  - `membership` object, nullable, required: Their place in this app; null if they were removed from it.
    - `role` string, required
    - `created_at` string, required
    - `last_sign_in_at` string, nullable, required
    - `active_sessions` integer, required
  - `passkeys` object[], required: Their passkeys for this app, without the keys themselves.
    - `name` string, nullable, required
    - `rp_id` string, required
    - `created_at` string, required
    - `last_used_at` string, nullable, required
  - `tables` object, required: Per per-user table, every row of this user.
  - `files` object[], required: Every file of this user.
    - `id` string, uuid, required
    - `name` string, required
    - `content_type` string, required
    - `bytes` integer, required
    - `status` 'pending' | 'ready', required
    - `created_at` string, required
    - `download_url` string, nullable, required: Valid for 15 minutes, without signing in; null for a file that never finished uploading.
    - `expires_at` string, nullable, required
  - `app_tables` 'included' | 'not_included' | 'no_database', required: included: the per-user tables (set_table_owner_column) were handled; unmarked_tables may still hold data. not_included: the app has no per-user tables, so no row of the app's own database was exported or deleted; check those tables yourself. no_database: the app has no database.
  - `unmarked_tables` string[], required: Tables that are not marked per-user: Hypamoon cannot tell which rows there belong to this user, so they may still hold data about them.
  - `note` string, nullable, required

## Other responses

- `401`: Unauthorized: unauthorized, missing_api_key, invalid_api_key, api_key_revoked, project_deleted.
- `403`: Forbidden: project_not_enabled, key_mode_mismatch, missing_scope, verification_required.
- `404`: Not Found: not_found.
- `429`: Too Many Requests: rate_limited.
- `500`: Internal Server Error: internal_error.
- `503`: Service Unavailable: service_unavailable.

---

[API](https://skmtc.dev/hypamoon/apis/hypamoon-api.md) · [All operations](https://skmtc.dev/hypamoon/apis/hypamoon-api/llms.txt) · [OpenAPI document](https://skmtc.dev/hypamoon/apis/hypamoon-api/revisions/9f0b90004c06?raw)