---
title: "Export the versioned member recovery bundle"
method: GET
path: "/agent/v1/source-access/recovery-bundle"
tags: ["Org"]
---

# Export the versioned member recovery bundle

`GET /agent/v1/source-access/recovery-bundle`

## Request

- Base URL: `https://api.run402.com`
- URL: `https://api.run402.com/agent/v1/source-access/recovery-bundle`
- Auth: one of:
  - API key in header `SIGN-IN-WITH-X`
  - HTTP bearer

The member's own offline-recovery export (`r402s-member-recovery-bundle/v1`): the active key identity + every ACTIVE wrapper's ciphertext, to be kept in the member's OWN storage — SEPARATELY from the source recovery code (together they are equivalent to the private key). A server-side wrapper row alone is NOT offline backup: recovery with no run402 server needs this bundle + the vault mirror + its recovery-receipt pin + the code. Reading it stamps the wrapper-export evidence used by recovery posture. Owner-only; the platform still cannot open anything in it.

## Headers

- `SIGN-IN-WITH-X` string, required

## Response `200`

The bundle

- object
  - `format` 'r402s-member-recovery-bundle/v1'
  - `exported_at` string, date-time
  - `principal_id` string, uuid
  - `encryption_key_id` string, uuid
  - `ek_fingerprint` string
  - `public_key` string
  - `suite` string
  - `custody_scheme` string
  - `wrappers` object[]
  - `note` string

## Other responses

- `409`: NO_ACTIVE_ENCRYPTION_KEY

---

[API](https://skmtc.dev/run402/apis/run402-api.md) · [All operations](https://skmtc.dev/run402/apis/run402-api/llms.txt) · [OpenAPI document](https://skmtc.dev/run402/apis/run402-api/revisions/893607557f50?raw)