Export Objects

Endpoint

POST /apiops/projects/{projectName}/export-import/{type}/export/

Authentication

Requires a Personal API Access Token.

Header

Authorization: Bearer YOUR_TOKEN

Request

Headers

Header	Value	Required
Authorization	Bearer {token}	Yes
Content-Type	application/json	Yes
X-Apinizer-Package-Passphrase	Base64 of the UTF-8 passphrase	Only when encrypt=true

Path Parameters

Parameter	Type	Required	Description
projectName	string	Yes	Project name
type	string	Yes	Export/import type, case-insensitive. See List Supported Types

Query Parameters

Parameter	Type	Required	Default	Description
encrypt	boolean	No	false	When true, encrypts the entire package — including object names — with the passphrase supplied in the X-Apinizer-Package-Passphrase header
withDependencies	boolean	No	false	When true, the package also carries every object the selection references, which the import binds to same-named objects in the target project

Request Body

Field	Type	Required	Description
names	array of string	Yes	Names of the objects to export. At least one is required
kind	string	No	For the types that cover several kinds of object (CERTIFICATE, API_CREATOR, IDENTITY_SERVICE), which kind the names refer to

{
  "names": ["openai-prod", "anthropic-prod"]
}

With a kind, for a type that covers several kinds of object:

{
  "names": ["apinizer"],
  "kind": "KEY_STORE"
}

Response

Success Response (200 OK)

The response is a ZIP file containing the export package.

Headers

• Content-Type: application/octet-stream
• Content-Disposition: attachment; filename="<objectName>.zip" when a single object was exported
• Content-Disposition: attachment; filename="<type>-export.zip" when several objects were exported

ZIP File Contents

• One JSON file per exported object, named after the object
• With withDependencies=true, one JSON file per referenced object as well

Error Response (400 Bad Request)

{
  "status": "FAILURE",
  "resultMessage": "LLM_PROVIDER object(s) not found in this project: openai-staging"
}

or

{
  "status": "FAILURE",
  "resultMessage": "names value can not be empty!"
}

or

{
  "status": "FAILURE",
  "resultMessage": "2 CERTIFICATE objects are named (apinizer) in this project with different kinds (CERTIFICATE, KEY_STORE); set \"kind\" in the request body to say which one you mean!"
}

or

{
  "status": "FAILURE",
  "resultMessage": "14 GLOBAL_POLICY objects are named (11) in this project; APIops addresses objects by name, so give them distinct names to make this one exportable."
}

or

{
  "status": "FAILURE",
  "resultMessage": "Unknown kind (IP_GROUP) for type CERTIFICATE! Supported kinds: CERTIFICATE, KEY_STORE, CRYPTO_KEY_INFO, JWK"
}

or

{
  "status": "FAILURE",
  "resultMessage": "User does not have required EXPORT_IMPORT permission for IDENTITY (object: partner-credential)!"
}

or

{
  "status": "FAILURE",
  "resultMessage": "Package encryption requested but no passphrase was supplied."
}

Common Causes

• A name in the names list does not exist in the project
• The same name belongs to more than one object — pass kind, or rename the objects when they share a kind
• withDependencies=true and the token lacks EXPORT_IMPORT on the asset category of one of the referenced objects
• encrypt=true was requested but the X-Apinizer-Package-Passphrase header was not provided

Error Response (401 Unauthorized)

{
  "status": "FAILURE",
  "resultMessage": "Token is not valid!"
}

cURL Example

Example 1: Export a Single Object

curl -X POST \
  "https://demo.apinizer.com/apiops/projects/MyProject/export-import/LLM_PROVIDER/export/" \
  -H "Authorization: Bearer YOUR_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{"names": ["openai-prod"]}' \
  --output openai-prod.zip

Example 2: Export Several Objects at Once

curl -X POST \
  "https://demo.apinizer.com/apiops/projects/MyProject/export-import/IP_GROUP/export/" \
  -H "Authorization: Bearer YOUR_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{"names": ["internal-ranges", "partner-ranges"]}' \
  --output ip-groups.zip

Example 3: Export with Dependencies

curl -X POST \
  "https://demo.apinizer.com/apiops/projects/MyProject/export-import/KNOWLEDGE_BASE/export/?withDependencies=true" \
  -H "Authorization: Bearer YOUR_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{"names": ["product-docs"]}' \
  --output product-docs.zip

Example 4: Export an Encrypted Package

curl -X POST \
  "https://demo.apinizer.com/apiops/projects/MyProject/export-import/CREDENTIAL/export/?encrypt=true" \
  -H "Authorization: Bearer YOUR_TOKEN" \
  -H "Content-Type: application/json" \
  -H "X-Apinizer-Package-Passphrase: $(printf '%s' 'my-passphrase' | base64)" \
  -d '{"names": ["partner-credential"]}' \
  --output partner-credential.zip

Example 5: Select One Kind Behind a Multi-Kind Type

curl -X POST \
  "https://demo.apinizer.com/apiops/projects/MyProject/export-import/CERTIFICATE/export/" \
  -H "Authorization: Bearer YOUR_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{"names": ["apinizer"], "kind": "KEY_STORE"}' \
  --output apinizer-keystore.zip

Notes and Warnings

• Unknown names fail the call: an object that cannot be found is never skipped. A pipeline therefore cannot ship a package that is quietly missing part of what it asked for.
• One type per call: to move several types, call the endpoint once per type. The packages can be imported in any order, as long as an object's dependencies exist by the time it is used.
• No dependency selection: with withDependencies=true, everything the resolver finds is packaged. A partially selected package would silently produce broken objects in the target project.
• Dependencies widen the permission check: each object entering the package is checked against its own asset category. A token that only holds permission on the exported type cannot export a package that carries other kinds of object.
• Secrets: an unencrypted package is a plain ZIP file that may contain sensitive configuration. Store it securely, and prefer encrypt=true when the package travels outside the installation.
• Passphrase recovery: the passphrase is never stored and cannot be recovered. If it is lost, the encrypted package can no longer be opened.
• File naming: object names are sanitized for use as file names, so a name containing a slash or another reserved character still produces a valid download.
• Every package carries an integrity record: alongside the object files, the package contains apinizer-transfer-manifest.json — a list of the files in the package with a fingerprint of each. Import verifies it (see Import Objects), so a package must be shipped exactly as this endpoint produced it; a pipeline that unzips, edits and re-zips a package will have it refused on import. That file name is reserved: if an exported object's name resolves to it, the call fails with 400 Bad Request naming the object, rather than dropping either the object or the record.
• Objects that could not be written are recorded: if an object cannot be written into the package, the response is unchanged, but the object's name is listed in the package's integrity record instead of disappearing silently.

Permissions

• User must have the type's own asset category + EXPORT_IMPORT, or PROJECT_MANAGEMENT + EXPORT_IMPORT, in the project
• With withDependencies=true, additionally EXPORT_IMPORT on the asset category of every object the package carries

Related Documentation

• Export / Import API - Overview and shared concepts
• List Objects of a Type - Discover the names to export
• Import Objects - Import the package produced here