Export Key

Endpoint

GET /apiops/projects/{projectName}/keys/{keyName}/export/

Authentication

Requires a Personal API Access Token.

Header

Authorization: Bearer YOUR_TOKEN

Request

Headers

Header	Value	Required
Authorization	Bearer {token}	Yes
X-Apinizer-Package-Passphrase	Base64 encoding of the UTF-8 passphrase	Only when encrypt=true

Path Parameters

Parameter	Type	Required	Description
projectName	string	Yes	Project name
keyName	string	Yes	Name of the key to export

Query Parameters

Parameter	Type	Required	Description
encrypt	boolean	No	Whether to encrypt the exported package with a passphrase. Defaults to false. When true, the X-Apinizer-Package-Passphrase header is required.

Response

Success Response (200 OK)

The response is a ZIP file containing the key export.

Headers

• Content-Type: application/octet-stream
• Content-Disposition: attachment; filename="<keyName>.zip"

Response Body

• Binary ZIP file containing:
  • A single JSON entry with the key definition

ZIP File Contents

• One JSON entry describing the key
• When encrypt=false, the archive is a plain ZIP file, byte-compatible with older Apinizer versions
• When encrypt=true, the whole package — including entry names — is encrypted with the supplied passphrase; nothing about its contents can be observed from the outside

uyarı

Without a passphrase (encrypt=false), the exported package carries the key's secret values (the key content and its password) in a readable form so they can be carried over on import. Treat unencrypted key export files as highly sensitive, and prefer encrypt=true whenever the file will be stored or transferred outside a fully trusted channel.

Error Response (400 Bad Request)

{
  "status": "FAILURE",
  "resultMessage": "projectName value can not be empty!"
}

or

{
  "status": "FAILURE",
  "resultMessage": "keyName value can not be empty!"
}

or

{
  "status": "FAILURE",
  "resultMessage": "Key (name: MyKey) is not found!"
}

or

{
  "status": "FAILURE",
  "resultMessage": "Package encryption requested but no passphrase was supplied."
}

or

{
  "status": "FAILURE",
  "resultMessage": "Export package could not be encrypted."
}

Common Causes

• Empty projectName or keyName
• Key does not exist in the project
• encrypt=true but the X-Apinizer-Package-Passphrase header was not provided
• The package could not be encrypted

Error Response (401 Unauthorized)

{
  "status": "FAILURE",
  "resultMessage": "Token is not valid!"
}

cURL Example

Example 1: Export Key (Unencrypted)

curl -X GET \
  "https://demo.apinizer.com/apiops/projects/MyProject/keys/MyKey/export/" \
  -H "Authorization: Bearer YOUR_TOKEN" \
  --output keyExportFile.zip

Example 2: Export Key (Encrypted with Passphrase)

curl -X GET \
  "https://demo.apinizer.com/apiops/projects/MyProject/keys/MyKey/export/?encrypt=true" \
  -H "Authorization: Bearer YOUR_TOKEN" \
  -H "X-Apinizer-Package-Passphrase: $(printf '%s' 'MyStrongPassphrase' | base64)" \
  --output keyExportFile.zip

Notes and Warnings

• Optional Encryption:

  • Encryption is opt-in via the encrypt query parameter, default false
  • Unencrypted exports remain byte-compatible with older Apinizer versions
  • Encrypted exports protect the entire package, including object names

• Passphrase Handling:

  • The passphrase is never stored anywhere and cannot be recovered
  • If the passphrase is lost, the encrypted package can never be opened again
  • The encryption key is derived from the passphrase; the passphrase itself is not written into the package

• Header Encoding:

  • X-Apinizer-Package-Passphrase carries the Base64 encoding of the UTF-8 passphrase
  • Base64 is a transport encoding only, not a protection mechanism — the header relies on TLS for confidentiality
  • Base64 encoding exists so that non-ASCII passphrase characters survive header transport without corruption

• File Naming:

  • The download is named after the key, for example signing-key.zip
  • The name is sanitized, so a key whose name contains a slash or another reserved character still produces a valid file name
  • You can rename the downloaded file as needed

Permissions

• User must have SECRETS + EXPORT_IMPORT permission in the project
• Alternatively, user can have project admin role

Related Documentation

• Import Key - Import a key from an exported ZIP file
• Get Key - Get key details
• List Keys - List all keys