Exports
Export your workspace's evaluations as a CSV file, with or without their signal assessments.
Exports package your workspace's evaluations into a CSV file for your own analysis, warehouse or review. Each export covers up to the last 90 days. It's produced in the background and stays available for 24 hours after you request it. A data deletion removes every export in the workspace, so download what you need first. For a walkthrough, see Export and delete data.
Examples on this page use a server client:
import { AbuseZero } from "abusezero/server";
const abusezero = new AbuseZero({ key: process.env.ABUSEZERO_SECRET_KEY!, outage: "throw" });The export object
{
"object": "export",
"id": "exp_6e0a2c4b-8d1f-4b3e-9a5c-7f2d4b6e8a01",
"state": "complete",
"failure": null,
"rows": 4812,
"include_evidence": false,
"completed_at": "2026-10-29T12:04:37.000Z",
"expires_at": "2026-10-30T12:03:58.000Z"
}| Field | Type | Description |
|---|---|---|
object | "export" | The object type. |
id | string | The export ID, starting with exp_. |
state | pending, complete or failed | pending is still being produced. complete is ready to download. failed couldn't be produced. |
failure | object or null | Why the export failed, with a code and a message. Present when state is failed, otherwise null. |
rows | integer or null | How many evaluations the file holds. null until the export completes. |
include_evidence | boolean | Whether the file includes signal assessments and device profile status. |
completed_at | string or null | When the export completed or failed. |
expires_at | string | When the export stops being available, 24 hours after it was requested. |
An export holds at most 10,000 evaluations. When the chosen range has more, the export fails with failure.code too_many_rows. Request a shorter range.
failure.code | failure.message |
|---|---|
too_many_rows | This export has over 10,000 evaluations. Request a shorter date range. |
export_failed | AbuseZero couldn't finish this export. Request a new export. |
New codes may be added within v1. Treat a code you don't recognize like export_failed.
File columns
| Column | Description |
|---|---|
evaluation_id | The evaluation ID, starting with eval_. |
created_at | When the evaluation ran. |
benefit | The benefit key. |
result | allow or deny. |
reason_code | The reason code. |
reason | The reason message. |
risk_score | The AbuseZero Risk Score, from 0 to 100, or empty. |
risk_band | low, elevated, high or not_assessed. |
policy_version | The policy version the evaluation ran under. |
claim_id | The claim_id you sent. |
outcome_state | The claim's outcome state. |
With include_evidence, the file adds:
| Column | Description |
|---|---|
identity, device, network, automation, benefit_history | The assessment for each signal family: clear, elevated, high or unavailable. |
device_profile_status | captured when browser data was retained with the evaluation, or not_retained. |
device_profile_expires_at | When the retained browser data expires, or empty. |
Request an export
| Method | Path | Scope | Idempotency-Key |
|---|---|---|---|
POST | /v1/exports | exports:create | Required |
Also available as abusezero exports create in the AbuseZero CLI, abusezero_request_export on the AbuseZero MCP server and requestExport() in the AbuseZero Node.js SDK.
An export with include_evidence also needs the evaluation_evidence:read scope. With an OAuth token, the signed-in member also needs permission to export data, plus permission to reveal evidence when include_evidence is true.
Request body
| Field | Type | Required | Limits | Description |
|---|---|---|---|---|
days | integer | No | 1 to 90, default 30 | Export evaluations from this many recent days. |
include_evidence | boolean | No | Default false | Add the signal assessment and device profile columns. |
Example
const job = await abusezero.requestExport({ days: 30 }, "export-2026-10-29");Response
Returns 202. Retrieve the export at status_url until its state is complete.
{
"object": "export",
"id": "exp_6e0a2c4b-8d1f-4b3e-9a5c-7f2d4b6e8a01",
"status": "pending",
"status_url": "/v1/exports/exp_6e0a2c4b-8d1f-4b3e-9a5c-7f2d4b6e8a01"
}Errors
| Code | Status | Meaning |
|---|---|---|
EVIDENCE_SCOPE_REQUIRED | 403 | include_evidence is true, but the credential doesn't have the evaluation_evidence:read scope. |
PERMISSION_REQUIRED | 403 | With an OAuth token, the signed-in member doesn't have the permission this export needs. Ask the workspace owner. |
For every other code, see REST API errors.
Retrieve an export
| Method | Path | Scope | Idempotency-Key |
|---|---|---|---|
GET | /v1/exports/{id} | exports:read | Not used |
Also available as abusezero exports get in the AbuseZero CLI, abusezero_get_export on the AbuseZero MCP server and call() in the AbuseZero Node.js SDK.
Path parameters
| Parameter | Type | Description |
|---|---|---|
id | string | The export ID, starting with exp_. |
Example
const job = await abusezero.call("/v1/exports/exp_6e0a2c4b-8d1f-4b3e-9a5c-7f2d4b6e8a01");Response
Returns 200 with an export object.
Errors
| Code | Status | Meaning |
|---|---|---|
RESOURCE_NOT_FOUND | 404 | No export with this ID exists in the workspace. |
Download an export
Returns a short-lived link to the export's CSV file.
| Method | Path | Scope | Idempotency-Key |
|---|---|---|---|
GET | /v1/exports/{id}/download | exports:read | Not used |
Also available as abusezero exports download in the AbuseZero CLI, abusezero_get_export_download on the AbuseZero MCP server and call() in the AbuseZero Node.js SDK.
Downloading an export with evidence also needs the evaluation_evidence:read scope and, with an OAuth token, the signed-in member's permission to reveal evidence. Every download is recorded in your audit log.
Path parameters
| Parameter | Type | Description |
|---|---|---|
id | string | The export ID, starting with exp_. |
Example
const download = await abusezero.call(
"/v1/exports/exp_6e0a2c4b-8d1f-4b3e-9a5c-7f2d4b6e8a01/download",
) as { url: string; expires_at: string };
const csv = await fetch(download.url).then((response) => response.text());Response
Returns 200.
{
"object": "export_download",
"url": "https://api.abusezero.com/…",
"expires_at": "2026-10-30T12:03:58.000Z"
}| Field | Type | Description |
|---|---|---|
url | string | The file link. It works for 5 minutes. Request the download again for a new link. A link that fails returns the standard error envelope, for example TRANSFER_EXPIRED once the 5 minutes have passed. |
expires_at | string | When the export itself stops being available. |
Errors
| Code | Status | Meaning |
|---|---|---|
EXPORT_NOT_FOUND | 404 | The export doesn't exist or has expired. Request a new export. |
EXPORT_NOT_READY | 409 | The export isn't complete. If it's pending, wait for it to finish, then download it. If it's failed, request a new export. |
EVIDENCE_SCOPE_REQUIRED | 403 | The export includes evidence, but the credential doesn't have the evaluation_evidence:read scope. |
PERMISSION_REQUIRED | 403 | With an OAuth token, the export includes evidence and the signed-in member doesn't have permission to reveal it. Ask the workspace owner. |
List exports
Returns exports, most recent first.
| Method | Path | Scope | Idempotency-Key |
|---|---|---|---|
GET | /v1/exports | exports:read | Not used |
Query parameters
| Parameter | Type | Required | Limits | Description |
|---|---|---|---|---|
limit | integer | No | 1 to 100, default 50 | How many exports to return. |
cursor | string | No | The next_cursor from the previous page, unchanged. |
Example
const page = await abusezero.exports();Response
Returns 200.
{
"object": "list",
"data": [
{
"object": "export",
"id": "exp_6e0a2c4b-8d1f-4b3e-9a5c-7f2d4b6e8a01",
"state": "complete",
"failure": null,
"rows": 4812,
"include_evidence": false,
"completed_at": "2026-10-29T12:04:37.000Z",
"expires_at": "2026-10-30T12:03:58.000Z"
}
],
"next_cursor": null
}Related
How is this guide?
Last updated on