Skip to content
Authrim

Read independent verification metadata for a published encrypted backup

GET
/api/admin/tenant-backups/{operationId}/export-receipt
Code sample: Shell / cURL 
curl --request GET \
  --url https://auth.example.com/api/admin/tenant-backups/example/export-receipt \
  --header 'Authorization: Bearer <token>'

Requires backup read and export permissions and fresh human administrator MFA authentication within five minutes. Sensitive-log exports also require the sensitive-backup permission. Returns only a ready, sealed, unexpired publication and its source-owned manifest metadata. This receipt is obtained independently of the encrypted artifact. The parts array defines the exact order, byte lengths, and SHA-256 digests of encrypted segments in the concatenated download response; clients must verify every segment and reject extra or missing bytes. An audit event must be persisted before returning metadata. No content keys, object addresses, exported rows, or machine delegation are returned.

Authorizations

Section titled “Authorizations ”

Parameters

Section titled “ Parameters ”

Path Parameters

Section titled “Path Parameters ”
operationId
required
string
/^[A-Za-z0-9_.:-]{1,256}$/

Responses

Section titled “ Responses ”

200

Section titled “200 ”

Source-authenticated publication metadata. Responses must not be cached.

Media type application/json
object
formatVersion
required
integer
Allowed values: 1
operationId
required
string
expiresAt
required

Publication expiry as Unix milliseconds.

integer
byteCount
required
integer
>= 1
boundaryUnixMs
required

Source snapshot boundary as Unix milliseconds.

integer
receipt
required
object
source
required
object
tenantId
required
string
issuer
required
string format: uri
productVersion
required
string
key
additional properties
bundleId
required
string
/^[a-f0-9]{32}$/
snapshotId
required
string
inventoryDigestSha256
required
string
/^[a-f0-9]{64}$/
parts
required
Array<object>
>= 1 items <= 10001 items
object
size
required
integer
>= 1
sha256
required
string
/^[a-f0-9]{64}$/
key
additional properties
key
additional properties
selection
required
object
settings
required
boolean
users
required
boolean
admin
required
boolean
artifacts
required
boolean
logs
required
object
audit
required
boolean
other
required
boolean
sensitive
required
boolean
period
required
One of:
integer
Allowed values: 7 30 90
key
additional properties
key
additional properties
datasets
required

The source operation’s pinned installed dataset inventory, obtained independently of the artifact.

Array<object>
>= 1 items <= 4096 items
object
id
required
string
module
required
string
kind
required
string
store
required
string
Allowed values: database kv durable_object object environment
schemaVersion
required
integer
>= 1
disposition
required
string
Allowed values: include rebuild external
key
additional properties
key
additional properties
Example 
{
  "formatVersion": 1,
  "selection": {
    "logs": {
      "period": 7
    }
  },
  "datasets": [
    {
      "store": "database",
      "disposition": "include"
    }
  ]
}

400

Section titled “400 ”

Invalid operation identifier

403

Section titled “403 ”

Missing permission, tenant scope, or fresh human MFA authentication

404

Section titled “404 ”

Operation not found in the current tenant

409

Section titled “409 ”

Publication is not ready, has expired, or its verification metadata is unavailable

503

Section titled “503 ”

Audit persistence is unavailable