---
title: "User Export"
method: GET
path: "/api/user/export"
tags: ["settings", "sync", "ai", "Account"]
---

# User Export

`GET /api/user/export`

## Request

- Base URL: `https://www.oxfordledge.com` (the document declares no server; this is the origin it was published from)
- URL: `https://www.oxfordledge.com/api/user/export`
- Auth: none declared

GDPR Article 20 / CCPA §1798.100 — Data Subject Access Request (DSAR).

Returns a JSON dump of every row associated with the requesting user
across the tables we control. Stripe data is referenced but not
duplicated (Stripe is a separate controller — see Privacy §5).
Server-side AI conversation history IS included as of 2026-05-11
(COUNSEL/CISO audit P0-2 fix): `ai_conversation_messages` was
landed in v63 (NH11 multi-turn persistence) but the DSAR export
+ cascade-delete were never updated, leaving stored prompts +
responses orphaned in PG after account deletion (GDPR Art. 17
violation). Privacy policy §8 also updated to reflect the actual
persistence state (was factually incorrect).

Squad Compliance P1: previously the only DSAR path was account
deletion; users had no machine-readable export.

## Response `200`

Successful Response

- UserDataResponse: Loose response_model for user-data routes (export, delete, consent, preferences). Multiple shape variants per action.

---

[API](https://skmtc.dev/oxfordledge/apis/oxford-ledge-api.md) · [All operations](https://skmtc.dev/oxfordledge/apis/oxford-ledge-api/llms.txt) · [OpenAPI document](https://skmtc.dev/oxfordledge/apis/oxford-ledge-api/revisions/e832a1260f0b?raw)