GET
/
api
/
v1
/
me
/
export
Request GDPR data export
curl --request GET \
  --url https://api.example.com/api/v1/me/export
import requests

url = "https://api.example.com/api/v1/me/export"

response = requests.get(url)

print(response.text)
const options = {method: 'GET'};

fetch('https://api.example.com/api/v1/me/export', options)
.then(res => res.json())
.then(res => console.log(res))
.catch(err => console.error(err));
<?php

$curl = curl_init();

curl_setopt_array($curl, [
CURLOPT_URL => "https://api.example.com/api/v1/me/export",
CURLOPT_RETURNTRANSFER => true,
CURLOPT_ENCODING => "",
CURLOPT_MAXREDIRS => 10,
CURLOPT_TIMEOUT => 30,
CURLOPT_HTTP_VERSION => CURL_HTTP_VERSION_1_1,
CURLOPT_CUSTOMREQUEST => "GET",
]);

$response = curl_exec($curl);
$err = curl_error($curl);

curl_close($curl);

if ($err) {
echo "cURL Error #:" . $err;
} else {
echo $response;
}
package main

import (
"fmt"
"net/http"
"io"
)

func main() {

url := "https://api.example.com/api/v1/me/export"

req, _ := http.NewRequest("GET", url, nil)

res, _ := http.DefaultClient.Do(req)

defer res.Body.Close()
body, _ := io.ReadAll(res.Body)

fmt.Println(string(body))

}
HttpResponse<String> response = Unirest.get("https://api.example.com/api/v1/me/export")
.asString();
require 'uri'
require 'net/http'

url = URI("https://api.example.com/api/v1/me/export")

http = Net::HTTP.new(url.host, url.port)
http.use_ssl = true

request = Net::HTTP::Get.new(url)

response = http.request(request)
puts response.read_body

Overview

The user’s GDPR right of access entry point. Calling this enqueues a gdpr-export worker job that walks every collection the user owns, builds a single JSON blob, ZIPs it, uploads it to private object storage, and emails the user a 24-hour signed download link. The job runs out-of-band — this endpoint returns 202 Accepted immediately with a jobId the client can poll via export status. See GDPR data lifecycle for the full story (what’s included, what’s excluded, why we tombstone, the cron timing).
Rate limit: 1 successful export per 24h per user. A user whose latest export job is in PENDING, PROCESSING, or READY and whose requestedAt is within the last 24h will get 429 RATE_LIMITED with a retryAfterSec field. Failed exports (FAILED) do not count — a user whose export failed can retry immediately.

Authentication

Bearer <accessToken> (user scope) required. The route also gates on requireOnboarded — a user mid-onboarding cannot request an export (they have no listing data yet).

Path parameters

None.

Query parameters

None.

Request body

None — this is a GET.

Response — 202 Accepted

FieldTypeNotesExample
jobIdstringThe worker job id. Pass to GET /me/export/:jobId to poll status.665b1c8d9c2b0a0001a4f701
statusstringAlways "PENDING" on a fresh request.PENDING
requestedAtstring (ISO 8601)Server clock at enqueue. Used to compute the 24h rate-limit window.2026-05-23T08:00:00.000Z
{
  "jobId": "665b1c8d9c2b0a0001a4f701",
  "status": "PENDING",
  "requestedAt": "2026-05-23T08:00:00.000Z"
}

Error responses

StatusCodeMeaning
401UNAUTHENTICATEDMissing / malformed / expired token.
403ONBOARDING_INCOMPLETEThe caller has not finished onboarding.
429RATE_LIMITEDThe caller already has a non-FAILED export job within the last 24h. The response body includes retryAfterSec. The Retry-After HTTP header is also set.

Example error — 429 RATE_LIMITED

{
  "type": "https://api.swappr.co.uk/errors/rate-limited",
  "title": "Too many requests",
  "status": 429,
  "code": "RATE_LIMITED",
  "detail": "GDPR export already requested within the last 24h. Try again later.",
  "retryAfterSec": 47213,
  "instance": "/api/v1/me/export",
  "requestId": "01HZQ7K3M4N5P6Q7R8S9T0V1W2"
}

What’s in the ZIP

Listed in full on GDPR data lifecycle. At a glance:
IncludedExcluded
Profile, current-home, preferences, matches, conversations + messages you sent, subscription, push token metadata (token strings redacted), uploads metadata, tenancy verification rows.Tenancy document file contents (metadata only). Other users’ data — matches/messages include the counterpart’s user id but no profile dereference.

Side effects

  • A gdpr_export_jobs row is created (status: PENDING, requestedAt: now).
  • A gdpr-export BullMQ job is enqueued onto the worker queue.
  • When no Redis/queue is wired (dev/test), an in-memory no-op enqueuer is used and the call still returns 202 — but the job will never complete in that mode.
  • On READY, the worker mints a 24h signed URL and emails the user. The polling endpoint will also mint a fresh signed URL on each call as long as the row hasn’t expired.

See also

curl

curl -X GET https://api.swappr.co.uk/api/v1/me/export \
  -H "Authorization: Bearer $ACCESS_TOKEN"

Postman

See docs/postman/swappr.postman_collection.jsonMe → Request Export.