---
title: "Start a realm export"
method: POST
path: "/clusters/{cluster_id}/realms/{realm}/exports"
tags: ["Exports"]
---

# Start a realm export

`POST /clusters/{cluster_id}/realms/{realm}/exports`

## Request

- Base URL: `http://localhost:8000`
- URL: `http://localhost:8000/clusters/{cluster_id}/realms/{realm}/exports`
- Auth: API key in header `API-Key`

Queues an encrypted export of a single realm (configuration, users, and all credentials).
Generated asynchronously by a server-side `kc.sh export`; poll
`GET /realm-exports/{export_id}` until `status` is `completed`, then download from
`download_url` before `expires_at`. Skycloak does not retain the artifact past `expires_at`.

Required scope: `clusters:exports:write`

## Path parameters

- `cluster_id` string, uuid, required
- `realm` string, required

## Headers

- `API-Version` '2026-06-01.beta', required

## Request body

- CreateRealmExportRequest
  - `scope` 'full'
  - `encryption_password` string, required: Password used to encrypt the archive (AES-256-CBC, PBKDF2). Required: every realm export contains credentials. Never stored; only a hash is retained for verification.

## Response `202`

Returned when a realm export has been accepted for processing. Poll the resource until `status` is `completed` or `failed`, then download from `download_url`.

- RealmExport
  - `id` string, uuid, required
  - `cluster_id` string, uuid, required
  - `realm` string, required: The exported realm's name (Keycloak realm id).
  - `scope` 'full', required
  - `status` 'pending' | 'processing' | 'completed' | 'failed', required
  - `progress` integer, required: Percent complete, 0-100.
  - `source_version` string, nullable: Keycloak version that produced the export. An import target must run this version or newer. Only set once `status` is `completed`.
  - `sha256_checksum` string, nullable: SHA-256 checksum of the produced encrypted archive (hex). Only set once `status` is `completed`.
  - `download_url` string, uri, nullable: Time-limited presigned URL to download the encrypted archive. Only set when `status` is `completed` and `expires_at` is in the future. Skycloak does not retain the artifact past `expires_at`.
  - `expires_at` string, date-time, nullable: When the archive is deleted from storage (24h after completion).
  - `error_message` string, nullable: Failure description. Only set when `status` is `failed`.
  - `created_at` string, date-time, required
  - `completed_at` string, date-time, nullable

## Other responses

- `400`: The server could not understand the request due to invalid syntax.
- `401`: Access is unauthorized.
- `402`: Client error
- `403`: Access is forbidden.
- `404`: The server cannot find the requested resource.
- `422`: Client error
- `429`: Client error
- `500`: Server error
- `501`: Server error

---

[API](https://skmtc.dev/skycloak/apis/skycloak-public-api.md) · [All operations](https://skmtc.dev/skycloak/apis/skycloak-public-api/llms.txt) · [OpenAPI document](https://skmtc.dev/skycloak/apis/skycloak-public-api/revisions/33a69e2ce35f?raw)