Data export (EU/GDPR)

Beyond template backup, you can export a second, distinct archive: a record of your organization's account data. It bundles everything a genuine EU/GDPR data-portability or data-access request would need — audit history, usage records, API key metadata, member list, and organization details — into one .zip.

This works in the web UI (Account → Data) and over the HTTP API. Like everything else, it is scoped to your active organization (see Organizations).

What's in the archive

The zip contains seven files, always written in this order:

manifest.json
organization.json
members.json
audit_log.json
usage_log.json
api_keys.json
render_outputs.json

• organization.json — a single object: id, name, slug, created_at, updated_at.
• members.json — every member of the org: user_id, email, display_name, role, joined_at.
• audit_log.json — the organization's complete audit trail (not paginated or narrowed to one user, unlike the in-app GET /api/audit view) — timestamp, acting user, API key prefix, action, target, status code, duration, IP address, user agent, error, and metadata for every logged request.
• usage_log.json — every recorded API usage row: timestamp, API key prefix and environment (live/test), endpoint, status code, duration, and bytes out.
• api_keys.json — key metadata only: id, environment, prefix, created_at, last_used_at, revoked_at. The key secret itself is never recoverable after generation and is never part of any export.
• render_outputs.json — metadata for stored render outputs: id, content_type, size_bytes, created_at, expires_at (the internal storage key/path is omitted).

manifest.json describes the archive and names everything it contains:

{
  "manifest_version": 1,
  "generated_at": "2026-06-23T10:00:00Z",
  "organization": {
    "id": "org-1718000000000-a1b2c3d4",
    "name": "Acme Inc",
    "slug": "acme-inc"
  },
  "contents": [
    "organization.json",
    "members.json",
    "audit_log.json",
    "usage_log.json",
    "api_keys.json",
    "render_outputs.json"
  ],
  "excluded": [
    {
      "item": "signing_certs",
      "reason": "Signing certificate private key material and passwords are never included in any export, for any user — including the organization member who uploaded them. This is a security boundary, not a compliance scoping choice."
    }
  ]
}

Exporting

In the UI, open Account → Data and choose Export data record; your browser downloads calco-data-export-<org>.zip. Over the API:

curl -X GET https://your-instance.example.com/api/data-export \
  -H "Cookie: <your session cookie>" \
  -o calco-data-export.zip

Export is restricted to organization owners and admins — stricter than template backup, which any member can export — because this archive bundles member emails, the full audit trail, and usage data.

There is no corresponding "import" for this archive: it is a read-only record for compliance and portability, not a restore mechanism.

How this differs from template backup

Template backup (GET /api/templates/export) and this data export cover different concerns and are not interchangeable:

API reference