Create a delegated encrypted export

POST

/api/replication-backups/{grantId}/exports

Code sample: Shell / cURL

curl --request POST \
  --url https://auth.example.com/api/replication-backups/example/exports \
  --header 'Authorization: Bearer <token>' \
  --header 'Content-Type: application/json' \
  --header 'X-Tenant-Id: example' \
  --data '{ "idempotencyKey": "example" }'

Requires the grant-specific bearer credential and exact X-Tenant-Id. Every request rechecks expiry, revocation and installed source scope. Only exports created by this grant with the fixed issuer and selection are accessible. Audit persistence is required. The idempotency key is scoped to this grant. Selection cannot be supplied or expanded. Returns waiting/unlock; the client then completes the existing key challenge, encrypted envelope acceptance and start sequence. Passphrases remain local to the client.

Authorizations

• replicationExportCredential

Parameters

Path Parameters

grantId

required

string

/^[A-Za-z0-9_.:-]{1,128}$/

Header Parameters

X-Tenant-Id

required

string

/^[A-Za-z0-9_.:-]{1,128}$/

Must match both the installed source deployment and the grant tenant.

Request Body ^required

Media type application/json

object

idempotencyKey

required

string

/^[A-Za-z0-9_.:-]{1,128}$/

key

additional properties

Example ^generated

{
  "idempotencyKey": "example"
}

Responses

201

Operation result. Responses are not cacheable.

Media type application/json

object

id

required

string

/^[A-Za-z0-9_.:-]{1,128}$/

state

required

string

phase

required

string

revision

required

integer

key

additional properties

Example ^generated

{
  "id": "example",
  "state": "example",
  "phase": "example",
  "revision": 1
}

400

Request rejected; no additional capability is granted.

403

Request rejected; no additional capability is granted.

404

Request rejected; no additional capability is granted.

409

Request rejected; no additional capability is granted.

503

Request rejected; no additional capability is granted.