Organization administrators can export two tenant-scoped durable ledgers. The
export contains identity, relationship, source-network, and lifecycle metadata;
protect it as a sensitive security record.
Export evidence
NDJSON preserves exact field values. CSV neutralizes spreadsheet-formula
prefixes in string fields. Each completed export prints the captured
organization and roster checkpoints to standard error.
If an export fails after writing rows, discard the partial file and restart.
Only a stream that reaches its terminal page is complete for its checkpoint
and filters.
Snapshot behavior
- Page one captures a maximum ID and row count for each ledger.
- Later events are excluded, even when their timestamps sort earlier.
- Continuation tokens bind the organization, administrator, filters, page size,
checkpoint, and position.
- A retention gap during pagination returns conflict rather than silently
producing an incomplete export.
Acknowledge a completed export
Only the terminal page of an unfiltered all-time API export includes a signed
completion_receipt. After durably storing every page, an administrator can
post that receipt to /v1/audit/export-acknowledgements. This advances both
tenant export watermarks atomically.
An acknowledgement is not a deletion request and does not prove that an
external destination or backup retained the bytes.
Retention and legal holds
The relay API exposes tenant retention-policy, legal-hold, and retention-readiness
controls. The event window defaults to 400 days and can be configured from 30 to
2,555 days. One active legal or incident hold can stop rows from becoming
deletion-eligible.
There is currently no expiry worker. These controls calculate and record
policy state but do not delete events, guarantee erasure, or control backup
retention.