---
title: "Export the caller's own data as JSON (GDPR portability)"
method: GET
path: "/api/me/export"
tags: ["Users"]
---

# Export the caller's own data as JSON (GDPR portability)

`GET /api/me/export`

## Request

- Base URL: `https://tre-app.com`
- URL: `https://tre-app.com/api/me/export`
- Auth: HTTP bearer

## Response `200`

Success

- AccountExport: The caller's own data: profile, memberships, invitations, authored cards and comments, assignments, API-token metadata (never token secrets), and own-actored activity still on the events ledger. Every content section is scoped to what the account can read TODAY and, for a workspace-bound bearer, to its audience.
  - `exportedAt` string, date-time, required
  - `user` object, required
    - `id` string, uuid, required
    - `email` string, email, required
    - `name` string, nullable, required
    - `image` string, nullable, required
    - `trialStartedAt` string, date-time, nullable, required: When the person's one free trial began (their first workspace on a billing-enabled installation); null while it is still theirs to use, and always null on a self-hosted installation.
    - `createdAt` string, date-time, required
  - `workspaces` object[], required
    - `slug` string, required
    - `name` string, required
    - `role` 'owner' | 'admin' | 'member', required
  - `invitations` object[], required
    - `workspaceSlug` string, required
    - `role` 'owner' | 'admin' | 'member', required
    - `invitedAt` string, date-time, required
    - `acceptedAt` string, date-time, nullable, required
  - `cardsCreated` object[], required
    - `cardKey` string, required
    - `title` string, required
    - `description` string, required
    - `workspaceSlug` string, required
    - `createdAt` string, date-time, required
    - `deletedAt` string, date-time, nullable, required: Set while the card is in the trash; null for a live card.
  - `comments` object[], required
    - `cardKey` string, required
    - `content` string, required
    - `createdAt` string, date-time, required
  - `checklistItemsAssigned` object[], required
    - `cardKey` string, required
    - `text` string, required
    - `completed` boolean, required
  - `cardsAssigned` object[], required
    - `cardKey` string, required
    - `title` string, required
  - `apiTokens` object[], required: Every token row the account owns, personal and OAuth alike; kind and clientId say which application an OAuth row was minted for. Never a secret.
    - `name` string, required
    - `prefix` string, required
    - `kind` 'personal' | 'oauth', required
    - `clientId` string, nullable, required
    - `createdAt` string, date-time, required
    - `lastUsedAt` string, date-time, nullable, required
    - `revokedAt` string, date-time, nullable, required
    - `guidanceGrants` object[], required: Every guidance write grant ever made on the token, revoked ones included, oldest first.
      - `workspaceSlug` string, required
      - `grantedAt` string, date-time, required
      - `expiresAt` string, date-time, required
      - `revokedAt` string, date-time, nullable, required
  - `activity` object[], required: Events the caller themselves actored, oldest first, limited to what is still on the ledger (older activity ages out) and to boards the caller can read today. Another member's events are never here.
    - `at` string, date-time, required
    - `workspaceSlug` string, required
    - `boardSlug` string, required
    - `verb` string, required: Catalog verb, e.g. `card.created`.
    - `cardKey` string, nullable, required: Null for events that name no card (board and list verbs).
    - `via` string, required: The surface the action came through: 'ui', 'rest' or 'mcp'.
    - `token` string, nullable, required: Name of the API token used, snapshotted at write time; null for a session.
    - `by` object, required: Who did it. `user` is null for a deleted account or a member who never set a display name — never fall back to an email here.
      - `user` string, nullable, required
      - `via` string, required
      - `token` string
      - `agent` object: Present when the ledger recorded a token id. The agent name is snapshotted at write time; user remains the delegating human. Historical name-only events have no agent. OAuth tokens also carry `client` (the CIMD URL).
        - `profile` 'ai_agent', required
        - `tokenId` string, uuid, required
        - `name` string, required
        - `kind` 'personal' | 'oauth', required
        - `client` string: CIMD URL when kind is oauth and the token row still names a client.
    - `payload` object, required: The catalogued record as written — excerpts, never whole documents. An event you actored can still quote another member's prose: the removed lines of a description diff, a title, a checklist item's text, a display name. The board-readability filter on this whole section, not the actor column, is what makes that safe to export — do not relax it.

## Other responses

- `400`: Invalid request
- `401`: Unauthenticated
- `403`: Forbidden: insufficient role or token scope; scope denials name the held scope and the operation
- `404`: Not found
- `409`: Conflict
- `429`: Rate limited
- `500`: Internal server error
- `503`: Temporarily unavailable

---

[API](https://skmtc.dev/tre-app/apis/tre-rest-api.md) · [All operations](https://skmtc.dev/tre-app/apis/tre-rest-api/llms.txt) · [OpenAPI document](https://skmtc.dev/tre-app/apis/tre-rest-api/revisions/26a7187a05fc?raw)