Request GDPR data export
Me
Request GDPR data export
User-facing right-of-access entry point. Enqueues a worker job; the user receives a 24h signed download link by email when the ZIP is ready.
GET
Request GDPR data export
Overview
The user’s GDPR right of access entry point. Calling this enqueues agdpr-export worker job that walks every collection the user owns, builds a single JSON blob, ZIPs it, uploads it to private object storage, and emails the user a 24-hour signed download link. The job runs out-of-band — this endpoint returns 202 Accepted immediately with a jobId the client can poll via export status.
See GDPR data lifecycle for the full story (what’s included, what’s excluded, why we tombstone, the cron timing).
Rate limit: 1 successful export per 24h per user. A user whose latest export job is in
PENDING, PROCESSING, or READY and whose requestedAt is within the last 24h will get 429 RATE_LIMITED with a retryAfterSec field. Failed exports (FAILED) do not count — a user whose export failed can retry immediately.Authentication
Bearer <accessToken> (user scope) required. The route also gates on requireOnboarded — a user mid-onboarding cannot request an export (they have no listing data yet).
Path parameters
None.Query parameters
None.Request body
None — this is aGET.
Response — 202 Accepted
| Field | Type | Notes | Example |
|---|---|---|---|
jobId | string | The worker job id. Pass to GET /me/export/:jobId to poll status. | 665b1c8d9c2b0a0001a4f701 |
status | string | Always "PENDING" on a fresh request. | PENDING |
requestedAt | string (ISO 8601) | Server clock at enqueue. Used to compute the 24h rate-limit window. | 2026-05-23T08:00:00.000Z |
Error responses
| Status | Code | Meaning |
|---|---|---|
| 401 | UNAUTHENTICATED | Missing / malformed / expired token. |
| 403 | ONBOARDING_INCOMPLETE | The caller has not finished onboarding. |
| 429 | RATE_LIMITED | The caller already has a non-FAILED export job within the last 24h. The response body includes retryAfterSec. The Retry-After HTTP header is also set. |
Example error — 429 RATE_LIMITED
What’s in the ZIP
Listed in full on GDPR data lifecycle. At a glance:| Included | Excluded |
|---|---|
| Profile, current-home, preferences, matches, conversations + messages you sent, subscription, push token metadata (token strings redacted), uploads metadata, tenancy verification rows. | Tenancy document file contents (metadata only). Other users’ data — matches/messages include the counterpart’s user id but no profile dereference. |
Side effects
- A
gdpr_export_jobsrow is created (status: PENDING,requestedAt: now). - A
gdpr-exportBullMQ job is enqueued onto the worker queue. - When no Redis/queue is wired (dev/test), an in-memory no-op enqueuer is used and the call still returns
202— but the job will never complete in that mode. - On READY, the worker mints a 24h signed URL and emails the user. The polling endpoint will also mint a fresh signed URL on each call as long as the row hasn’t expired.
See also
- Get export status — poll the
jobId, get the signed download URL when READY. - Delete account — the right-to-erasure counterpart.
- GDPR data lifecycle — full lifecycle, carve-outs, mermaid diagrams.
curl
Postman
Seedocs/postman/swappr.postman_collection.json → Me → Request Export.