Workspace export

Workspace owners can select Download workspace export on the workspace page. Members and users outside the workspace cannot export. Wait for active scans and edits to finish first. The download contains private workspace/member information and evidence; store it securely.

Included and excluded data

Owner-confirmed comparison records, when present, are exported separately as outcome_confirmations, linked by tenant/outcome ID. They preserve confirming owner/time, baseline/follow-up scan IDs, change time, workload assertion and the server-generated observation snapshot in comparison_json. They are owner-reported context, not independent proof of causation or monetary value.

The UTF-8 .ndjson file contains one JSON object per line:

1. A type: "manifest" record identifies format project-freedom-export, schema version 1, export ID, tenant ID, start time, revision, and tables.
2. type: "record" lines contain a table name and the corresponding record object.
3. A final type: "complete" record contains the export ID, matching revision, completion time, and per-table counts. A missing completion record means the export is incomplete.

Included: workspace, members and their user profiles, pending workspace invites, safe connection metadata, scope selection, scans and historical targets, normalized evidence, facts and evidence links, referenced immutable rule versions, evaluations and input links, opportunities/history/relations, correctness feedback, outcomes, workspace rescan schedules, and audit events. Database IDs and relations are preserved. Fields with _json suffix retain their JSON-encoded string representation; parse those fields separately when needed. Monetary amounts retain integer minor units and their currency.

Excluded: provider credential envelopes, encryption keys, magic links, sessions, authentication identities, internal workflow/idempotency identifiers, and all other workspaces. The export is an evidence archive, not an importable database backup or a way to restore provider credentials.

The manifest includes current scope_confirmations (cache host/path intent, subscription and edge-function answers, confirming user and time). Historical answers are preserved independently in each scan_targets.context_json snapshot and normalized assessment evidence. Owner answers are customer-confirmed evidence, not provider-observed facts.

Notification-enabled releases also include each member’s scan notices/read state and owner email preferences. Delivery status accepted means the email provider accepted the message, not that it reached the inbox. Internal delivery claim tokens are excluded. Reading a notice or changing its delivery status advances the workspace revision, so wait for these changes to settle before exporting.

Consistency and limits

The start is recorded in the workspace audit log. Database triggers advance a workspace revision whenever exported tenant data or member profile fields change. Each page checks that revision in the same database transaction as its read; the download performs a final check too. A concurrent change causes HTTP 409 and discards the browser’s partial download. It is not a long-lived database snapshot: retry after scans/edits have stopped. Starting another export in the same workspace also changes its audit log and invalidates the first.

Pages use deterministic keyset cursors, at most 25 records, and a 512 KiB record-payload budget, except that one record up to 2,000,000 bytes may be returned alone. Oversized records fail explicitly; they are never silently truncated. The browser limits completed files to 100 MiB to bound memory use; larger archives require a client consuming the same paginated API. Starts are limited to five per workspace per hour. Export does not delete any data or establish a retention policy.

Authenticated paginated API

Use an existing owner session; do not put credentials or session values into chat, command arguments, or shared logs. Use https://plimie.com as the API origin. Same-origin requests are required for POST.

• POST /api/workspaces/:tenantId/export with JSON {} returns the manifest.
• For each manifest table, GET /api/workspaces/:tenantId/export/:table?revision=:revision returns records and nextAfter.
• When nextAfter is a string, send it URL-encoded as the next request’s after query parameter, preserving the revision. Continue until nextAfter is null, including an empty final page when returned. Do not interpret or manufacture cursors.
• After all tables, GET /api/workspaces/:tenantId/export/check?revision=:revision must return complete: true and the same revision. Only then append the completion record and publish the archive. An error at any step means the partial archive must not be labeled complete.

The API has no total record cap. Large clients should write to a temporary file and only rename it to the final archive after successful completion. Deleted workspaces, revoked sessions, and lost owner access fail subsequent reads.

Weekly report records

Weekly reports add report_schedules, reports, report_items, report_preferences, and report_notifications to the owner export. Snapshot items keep their JSON field and source identifiers. Internal delivery claims are excluded. Report amounts remain customer-reported, per record and currency, without a verified-savings total.