Export / Import API

Endpoints

• List Supported Types - List every object type that can be exported and imported
• List Objects of a Type - List the objects of a type, with the names the export call expects
• Export Objects - Export the named objects of a type as a package
• Import Objects - Import a package into a project

Supported Object Types

One call handles one type. The {type} path variable is case-insensitive and accepts any of the values below; the authoritative list for a given installation always comes from the List Supported Types endpoint.

Area	Types
API layer	API_PROXY, PROXY_GROUP, API_CREATOR, GLOBAL_POLICY, POLICY_GROUP, SETTINGS_GROUP
Environment & identity	ENV_VARIABLE, GLOBAL_VARIABLE, IP_GROUP, CREDENTIAL, CREDENTIAL_ROLE, IDENTITY_SERVICE, REGISTERED_ORGANIZATION
Secrets	CERTIFICATE
AI Gateway	LLM_PROVIDER, MODEL_DEFINITION, MCP_INBOUND, MCP_OUTBOUND, A2A_INBOUND, CONNECTION_CONFIG_A2A, VECTOR_DB, KNOWLEDGE_BASE, FAILOVER_TEMPLATE, PII_PATTERN, PROMPT_GUARD_PATTERN, DLP_PATTERN
Observability & automation	CUSTOM_QUERY, CUSTOM_QUERY_FILTER, REPORT_CONF, UPTIME_MONITOR, ANOMALY_DETECTOR, TASK_FLOW_MANAGER, TEST_COLLECTION

How Objects Are Addressed

Objects are addressed by name, the same convention every other APIops endpoint follows.

• An unknown name fails the call instead of being skipped, so a pipeline can never ship a package that is quietly missing an object.
• Some types cover several kinds of object behind one type key — CERTIFICATE covers certificates, keystores, crypto keys and JWKs; API_CREATOR covers database, script and mock creators; IDENTITY_SERVICE covers LDAP, database and API authentication services. Two objects of different kinds may legally share a name there, so the export call takes a kind field to say which one is meant. The listing endpoint reports each object's kind.
• When several objects of the same kind share a name, the name cannot address any of them. Give them distinct names to make them exportable.

Dependencies

Every object an export references — global policies, certificates, credentials, connections, AI providers, environment variables and more — can travel in the same package with withDependencies=true.

There is no dependency selection step: whatever the resolver finds is packaged. A partially selected package would silently produce broken objects in the target project, and an automated call has nobody to ask.

On import, every packaged dependency that already exists in the target project under the same name is bound to it; everything else is created. This is the automatic form of the "map to existing by name" step in the Apinizer interface.

Authentication

All endpoints require authentication using a Personal API Access Token.

Permissions

Each call is authorized against the asset category of its type, or against project-wide permission.

Operation	Required Permission
List types / list objects	Read access to the project (the type's asset category, when it has one)
Export / Import	The type's own asset category + EXPORT_IMPORT, or PROJECT_MANAGEMENT + EXPORT_IMPORT
Export / Import with withDependencies=true	Additionally, EXPORT_IMPORT on the asset category of every object the package carries

not

A package that carries dependencies creates objects in other asset categories in the target project, so the import checks each of those categories against the target project before anything is written.

Package Encryption

A package can be encrypted end to end, including object names, with a passphrase supplied in the X-Apinizer-Package-Passphrase header (Base64 of the UTF-8 passphrase). The same passphrase is required to import it. Encryption is optional; without it the package is a plain ZIP file.

Related Documentation

• Authentication Guide - How to obtain and use API tokens
• Error Handling - Error response formats
• Export API Proxy - The API Proxy specific export endpoint
• Import API Proxy - The API Proxy specific import endpoint