---
title: "Export the hidden-service key, sealed to your X25519 key"
method: POST
path: "/platform/deployments/{id}/onion/export"
tags: ["Platform"]
---

# Export the hidden-service key, sealed to your X25519 key

`POST /platform/deployments/{id}/onion/export`

## Request

- Base URL: `https://api.imprezahost.com/v1`
- URL: `https://api.imprezahost.com/v1/platform/deployments/{id}/onion/export`
- Auth: API key in header `X-API-Key` and API key in header `X-API-Secret`

The agent seals the identity bundle on the server to the
customer-supplied recipient X25519 public key (NaCl sealed box);
the plaintext never transits or rests on the platform. The blob
is retrievable EXACTLY ONCE via `/onion/export/{commandId}`.
Requires `manage`, `confirm: true` and an agent announcing
`onion-custody-v1`.

## Path parameters

- `id` string, required

## Request body

- object
  - `recipient_pubkey` string, required: Standard base64 of a 32-byte X25519 public key.
  - `confirm` true, required

## Response `202`

Export command enqueued.

## Other responses

- `400`: Invalid recipient key.
- `401`: Invalid or missing API credentials
- `404`: Resource not found
- `422`: Agent does not announce onion-custody-v1.

---

[API](https://skmtc.dev/imprezahost/apis/impreza-host-public-api.md) · [All operations](https://skmtc.dev/imprezahost/apis/impreza-host-public-api/llms.txt) · [OpenAPI document](https://skmtc.dev/imprezahost/apis/impreza-host-public-api/revisions/db86511f604f?raw)