Export Key File

Endpoint

GET /apiops/projects/{projectName}/keys/{keyName}/export-file/

Info

This is the raw material download. To move a key between Apinizer installations, use Export Key instead — that produces an Apinizer package which Import Key can read back.

Authentication

Requires a Personal API Access Token.

Header

Authorization: Bearer YOUR_TOKEN

Request

Headers

Header	Value	Required
Authorization	Bearer {token}	Yes

Path Parameters

Parameter	Type	Required	Description
projectName	string	Yes	Project name
keyName	string	Yes	Key name

Query Parameters

Parameter	Type	Required	Default	Description
environmentName	string	No	—	Returns only this environment's key file. Without it, every environment's material is returned in one ZIP

Response

Success Response (200 OK)

With environmentName, the response is the key file itself.

• Content-Type: application/x-pem-file
• Content-Disposition: attachment; filename="<keyName>-<environmentName>.pem"

Without it, the response is a ZIP archive.

• Content-Type: application/octet-stream
• Content-Disposition: attachment; filename="<keyName>-keys.zip"
• One entry per environment, named <keyName>-<environmentName>.pem

The file extension follows the file the key was uploaded with, and falls back to .pem when the key was supplied as text.

Error Response (400 Bad Request)

{
  "status": "FAILURE",
  "resultMessage": "Key (name: signing-key) is not found!"
}

or

{
  "status": "FAILURE",
  "resultMessage": "(signing-key) has no material for environment (prod)! Available: test, uat"
}

or

{
  "status": "FAILURE",
  "resultMessage": "(signing-key) carries no environment material to export!"
}

Common Causes

• No key of that name exists in the project
• The requested environment holds no material for this key
• The key exists but has not been given material in any environment

Error Response (401 Unauthorized)

{
  "status": "FAILURE",
  "resultMessage": "Token is not valid!"
}

cURL Example

Example 1: Download One Environment's Key

curl -X GET \
  "https://demo.apinizer.com/apiops/projects/MyProject/keys/signing-key/export-file/?environmentName=Production" \
  -H "Authorization: Bearer YOUR_TOKEN" \
  --output signing-key.pem

Example 2: Download Every Environment's Key

curl -X GET \
  "https://demo.apinizer.com/apiops/projects/MyProject/keys/signing-key/export-file/" \
  -H "Authorization: Bearer YOUR_TOKEN" \
  --output signing-key-keys.zip

Notes and Warnings

• A missing environment is an error, not an empty file: asking for an environment the key has no material in returns 400 and names the environments that do have it, so a pipeline never receives a silently empty download.
• This distributes private key material: the file is the real key, decrypted. Keep the token that can call this endpoint tightly scoped, and store the downloaded file securely.
• No new exposure over the package export: Export Key already writes the same decrypted material into its package. This endpoint changes the container, not the sensitivity.
• Round trip is exact: a key uploaded through Import Key File comes back byte for byte.

Permissions

• User must have SECRETS + EXPORT_IMPORT permission in the project

Related Documentation

• Import Key File - Upload a raw key file
• Export Key - Export as an Apinizer package instead
• Create Key - Create a key from a JSON body