#Data Exports

Client Admins can request, track, cancel, and download account-level data exports from the deep-link-only /settings?section=data-exports section, which is not shown in the Settings sidebar. While the panel is open, the Settings navigation shows a "Viewing: Data Exports" caption so you can still tell where you are. Client Managers and Client Staff do not receive this section; if they open the direct route, the portal resolves to the first Settings section allowed for their role instead.

The browser talks only to portal BFF routes under /api/account-exports; those route handlers enforce the current session and client_admin role, then forward the user's server-side bearer token to aidial_api. Browser-supplied X-API-Key headers are not forwarded.

Signed-out requests receive an unauthorised response. Non-admin sessions and out-of-scope export IDs receive non-enumerating not-found responses, and the portal returns them without calling aidial_api. Create and cancel requests are CSRF protected.

#Supported Export Categories

• Users
• Configuration summaries
• Audit events
• Support tickets

The request dialog lists each category with its description and a summary of what is excluded from it, loaded from the server rather than hard-coded in the portal.

The current account export feature is separate from the calls CSV export. Calls remain exported from the Calls page.

#Requesting an Export

1. Open /settings?section=data-exports. The panel loads the category catalogue, your current limits, and your organisation's export history.
2. Select Request export.
3. Tick at least one category. The request cannot be submitted with nothing selected.
4. Select Request export in the dialog. The job is accepted in Queued status and appears at the top of the history.

#Tracking, Cancelling, and Downloading

• Each history row shows the selected categories, the requested date, the expiry date once one is set, the current status, a progress counter (categories generated out of categories selected), and the available actions.
• Use the refresh control to re-read the catalogue and history. Use Load more when the history has more pages.
• Cancel is offered while a job is Queued or Running.
• Download is offered once a job is Completed and still inside its download window. The artifact downloads as a JSON attachment named account-export-<job id>.json.
• When a job fails, the failure message returned by the server is shown inline on that row.

#Portal Routes

#Limits

• 3 accepted export requests per user in a rolling 24-hour window
• 10 accepted export requests per tenant in a rolling 24-hour window
• 1 queued or running export at a time per user within the tenant
• Completed artifacts are downloadable for 7 days
• History pages return up to 20 jobs by default and 50 at most

When a limit blocks a request, the portal surfaces the server's response: a conflict if you already have a queued or running export, or a rate-limit response carrying a retry hint when a 24-hour limit is reached.

#Statuses

#Download Rules

Downloads are rechecked against current tenant access, role, category permission, and redaction policy, and the stored artifact's checksum is recalculated before the file is released. If access or policy has changed since the artifact was generated, or the stored artifact no longer matches its recorded checksum, the download is blocked and a new export is required. Expired jobs are rejected rather than served.

The artifact is returned as a JSON attachment with no-store, nosniff, and restrictive content-security-policy headers, and carries the export ID and artifact checksum as response headers.

Exports include a manifest with selected categories, read timestamps, row counts, projection and policy versions, policy digests, expiry time, checksum, and any warnings. The checksum is calculated over canonical artifact JSON with the manifest checksum field blanked before hashing. Fields whose names indicate transcripts, phone numbers, secrets, API keys, bearer tokens, secret-management references, encrypted material, or storage internals are replaced with a redaction marker; configuration is exported as customer-safe summaries rather than raw configuration files. Spreadsheet formula-leading values are neutralised.

#Audit Evidence

Request, blocked request, completion, failure, cancellation, download, and expiry outcomes are written to the tenant audit log with safe metadata. Worker-owned completion, failure, and expiry evidence retains a system/API actor for provenance while the Activity Log can use the stored requester email for the customer-facing actor label. Cancellation keeps the requesting user as its request-side actor; worker reconciliation uses system/API provenance only when that durable cancellation evidence is missing.

#Common Issues

• I cannot find the Data Exports section. It is not listed in the Settings sidebar. Open it directly at /settings?section=data-exports. Only Client Admins can open it.
• The request will not submit. Select at least one category. If you already have a queued or running export, wait for it to finish or cancel it first.
• I have hit a request limit. Each user may have 3 accepted requests and each organisation 10 accepted requests in any rolling 24-hour window. Wait for the window to clear before requesting again.
• The download is refused. The artifact expires 7 days after completion, and a download is also blocked when access or redaction policy has changed since it was generated. Request a new export.
• The list will not load. The panel shows an error with a Retry action. Select Retry to load the catalogue and history again.

#Related Pages

• Data Deletion Requests
• Data Governance
• Exporting and Downloading Calls
• Activity Log