Exports

Start a database export

Queues a new database export for the cluster. The export is generated asynchronously; poll GET /clusters/{cluster_id}/exports/{export_id} until status is completed, then download the archive from download_url before expires_at.

When include_credentials is true, an encryption_password must be provided and the resulting archive will be AES-256-CBC encrypted.

Returns 409 with code export_already_running if an export is already pending or processing for this cluster. Exports older than the two-hour stale threshold do not block new requests; age is measured from start time, or creation time if not started.

Required scope: clusters:exports:write

post/clusters/{cluster_id}/exports

Request

  • Base URL: http://localhost:8000
  • URL: http://localhost:8000/clusters/{cluster_id}/exports
  • Auth: API key in header API-Key

Path parameters

cluster_idstring uuid required

Headers

API-Version'2026-06-01.beta' required

Request body

format'sql' | 'pgdump' required
include_credentialsboolean

Include the Keycloak credential and related tables. Requires encryption_password to be set.

encryption_passwordstring

Password used to encrypt the archive (AES-256-CBC, PBKDF2). Required when include_credentials is true. Never stored; only a hash is retained for verification.

Example request

{
  "format": "pgdump",
  "include_credentials": false
}

Response

Returned when an export has been accepted for processing. Poll the Location URL until status is completed or failed.

idstring uuid required
cluster_idstring uuid required
format'sql' | 'pgdump' required
status'pending' | 'processing' | 'completed' | 'failed' required
expires_atstring date-time nullable required

When the archive will be deleted from storage.

created_atstring date-time required
started_atstring date-time nullable required
completed_atstring date-time nullable required
progressinteger required

Completion percentage of the export job, from 0 to 100.

include_credentialsboolean required

Whether the dump includes the credential and related Keycloak tables.

is_encryptedboolean required

Whether the archive is AES-256-CBC encrypted with the password provided at creation time.

file_size_bytesinteger nullable required

Size of the produced ZIP archive in bytes. Only set once status is completed.

sha256_checksumstring nullable required

SHA-256 checksum of the produced ZIP archive (hex). Only set once status is completed.

download_urlstring uri nullable required

Time-limited presigned URL to download the archive. Only set when status is completed and expires_at is in the future. Returned URLs are valid for at least one hour.

error_messagestring nullable required

Failure description. Only set when status is failed.

Example response

{
  "id": "5fa3e1a0-2c9b-4d2f-9b3a-1e8c4d2f9b3a",
  "cluster_id": "a1b2c3d4-e5f6-7890-abcd-ef1234567890",
  "format": "pgdump",
  "status": "completed",
  "progress": 100,
  "include_credentials": false,
  "is_encrypted": false,
  "file_size_bytes": 4823104,
  "sha256_checksum": "9f86d081884c7d659a2feaa0c55ad015a3bf4f1b2b0b822cd15d6c15b0f00a08",
  "download_url": "https://exports.skycloak.io/.../export.zip?X-Amz-Signature=...",
  "expires_at": "2026-04-29T10:15:00Z",
  "error_message": null,
  "created_at": "2026-04-28T10:00:00Z",
  "started_at": "2026-04-28T10:00:05Z",
  "completed_at": "2026-04-28T10:15:00Z"
}

Changes

No recorded changes to this operation across all 1 revision of this API.