Exports

Start a realm export

Queues an encrypted export of a single realm (configuration, users, and all credentials). Generated asynchronously by a server-side kc.sh export; poll GET /realm-exports/{export_id} until status is completed, then download from download_url before expires_at. Skycloak does not retain the artifact past expires_at.

Required scope: clusters:exports:write

post/clusters/{cluster_id}/realms/{realm}/exports

Request

  • Base URL: http://localhost:8000
  • URL: http://localhost:8000/clusters/{cluster_id}/realms/{realm}/exports
  • Auth: API key in header API-Key

Path parameters

cluster_idstring uuid required
realmstring required

Headers

API-Version'2026-06-01.beta' required

Request body

scope'full'
encryption_passwordstring required

Password used to encrypt the archive (AES-256-CBC, PBKDF2). Required: every realm export contains credentials. Never stored; only a hash is retained for verification.

Example request

{
  "scope": "full",
  "encryption_password": "a-strong-passphrase"
}

Response

Returned when a realm export has been accepted for processing. Poll the resource until status is completed or failed, then download from download_url.

idstring uuid required
cluster_idstring uuid required
realmstring required

The exported realm's name (Keycloak realm id).

scope'full' required
status'pending' | 'processing' | 'completed' | 'failed' required
progressinteger required

Percent complete, 0-100.

source_versionstring nullable

Keycloak version that produced the export. An import target must run this version or newer. Only set once status is completed.

sha256_checksumstring nullable

SHA-256 checksum of the produced encrypted archive (hex). Only set once status is completed.

download_urlstring uri nullable

Time-limited presigned URL to download the encrypted archive. Only set when status is completed and expires_at is in the future. Skycloak does not retain the artifact past expires_at.

expires_atstring date-time nullable

When the archive is deleted from storage (24h after completion).

error_messagestring nullable

Failure description. Only set when status is failed.

created_atstring date-time required
completed_atstring date-time nullable

Example response

{
  "id": "5fa3e1a0-2c9b-4d2f-9b3a-1e8c4d2f9b3a",
  "cluster_id": "a1b2c3d4-e5f6-7890-abcd-ef1234567890",
  "realm": "cust-brasilia",
  "scope": "full",
  "status": "completed",
  "progress": 100,
  "source_version": "26.6.1",
  "sha256_checksum": "9f86d081884c7d659a2feaa0c55ad015a3bf4f1b2b0b822cd15d6c15b0f00a08",
  "download_url": "https://exports.skycloak.io/.../cust-brasilia.zip.enc?X-Amz-Signature=...",
  "expires_at": "2026-07-20T14:15:00Z",
  "error_message": null,
  "created_at": "2026-07-19T14:00:00Z",
  "completed_at": "2026-07-19T14:12:00Z"
}

Changes

No recorded changes to this operation across all 1 revision of this API.