Exports
Export the whole tenant or one account as a .tar.gz archive, wait for it to finish, then download and verify it.
An export is a gzip-compressed tar of your tenant's data, or of one account's, built in the background. Request it, wait for export.completed, then download the archive before it expires. All export operations need the admin scope.
Request an export
POST /v1/exports with the body {} exports the tenant. Set accountId to export one account.
curl -X POST "https://api.workwae.com/v1/exports" \
-H "Authorization: Bearer $WORKWAE_API_KEY" \
-H "content-type: application/json" \
-d '{ "accountId": "'"$ACCOUNT_ID"'" }'The call answers 202 with the export in status queued. It can be refused with:
| Reason | Status | When |
|---|---|---|
export_in_progress | 409 | An export of the same scope (the tenant, or the same account) is queued or running. Retry after it completes or fails. |
unknown_account | 422 | The tenant has no account with that accountId; data.ids lists it. |
storage_unavailable | 400 | No object store is configured. |
What the archive holds
| Part | Contents |
|---|---|
manifest.json | Format (workwae-export) and version, the export id, the accounts included and a file count per section. |
accounts/<accountId>/ | The account without secrets, send-as identities and signatures, mailboxes, message metadata as JSON lines, stored bodies as .eml, calendars and events as JSON and .ics, contact folders and contacts, meeting connections and event meetings. |
tenant/ (tenant exports only) | Settings, webhooks without signing secrets, templates, tenant OAuth apps, organization connections and meeting apps. |
Secrets never go into an archive: account credentials, webhook signing secrets, OAuth client secrets and organization connection keys are left out.
Follow its status
Wait for the export.completed or export.failed event, or poll GET /v1/exports/{exportId}. GET /v1/exports lists exports, paged like other lists.
curl "https://api.workwae.com/v1/exports/$EXPORT_ID" \
-H "Authorization: Bearer $WORKWAE_API_KEY"| Status | Meaning |
|---|---|
queued | Accepted, not started. |
running | Being built. It cannot be deleted yet. |
completed | The file is ready. bytes, sha256 and contents (file counts per section) are set; expiresAt is when the file will be deleted. |
failed | Nothing to download. error says why. |
expired | The file was deleted. |
Records of expired and failed exports are deleted 30 days later.
Download and verify
GET /v1/exports/{exportId}/download streams the decrypted .tar.gz as application/gzip. The x-export-sha256 header carries the same hex digest as the export's sha256; compare it with the SHA-256 of the body you received.
curl "https://api.workwae.com/v1/exports/$EXPORT_ID/download" \
-H "Authorization: Bearer $WORKWAE_API_KEY" \
-o export.tar.gz
sha256sum export.tar.gz| Reason | Status | When |
|---|---|---|
export_not_ready | 409 | The export is queued or running. |
export_failed | 409 | The export failed. |
export_expired | 410 | The file was deleted. |
export_corrupt | 500 | A stored part of the export fails its integrity check. |
Delete an export early
DELETE /v1/exports/{exportId} removes the export and its file before expiresAt. A running export answers export_running (409).
Events
Both outcomes are delivered to your webhooks and to the change feed. The event's accountId is null for a tenant export.
| Type | data |
|---|---|
export.completed | exportId, bytes, sha256 and expiresAt. Download before expiresAt. |
export.failed | exportId and error. |
The full envelope is in the event catalog.