On this pageTwo exports
Your data is yours, in formats that need nothing from us to read. Export is on every plan and keeps working even if the organisation is frozen.
Two exports
| Endpoint | Format | Use it for |
|---|---|---|
| `GET /export` | One JSON document, format collecta-dpp-export/1 | Loading into another system or a warehouse. |
| `GET /export/archive` | ZIP, streamed | A complete, verifiable copy — including files. |
What the archive contains
| Path | Contents |
|---|---|
export.json | Organisation, plants, models, items, passports, dynamic events, registry records, declarations, conformity records, components. |
passports/*.jsonld | Each published passport as JSON-LD, with its version number and content hash. |
documents/* | The uploaded files — declarations of conformity, test reports and others. |
qr/*.svg | The QR code of each passport, as vector artwork. |
labels/*.svg | Print-ready label artwork produced for a passport. |
uploads/* | Files suppliers uploaded, with metadata in uploads.json. |
mapping-templates.json | Saved column-mapping templates from imports. |
audit.jsonl | The audit trail, one entry per line. |
manifest.json | Every entry with its size and SHA-256. |
Download the archive
curl "https://dppapi-production.up.railway.app/v1/export/archive" \-H "Authorization: Bearer $DPP_API_KEY"Save it to a file
curl -fSL "https://dppapi-production.up.railway.app/v1/export/archive" \-H "Authorization: Bearer $DPP_API_KEY" \-o collecta-dpp-export.zipVerify it
manifest.json lists every other entry as { path, bytes, sha256 } under files. Recompute each SHA-256 and compare: a truncated or altered archive fails here.
// Node.js 18+. Node has no built-in ZIP reader, so extract with the system unzip first.import { execFileSync } from 'node:child_process';import { createHash } from 'node:crypto';import { readFile } from 'node:fs/promises';import { join } from 'node:path';const dir = 'collecta-dpp-export';execFileSync('unzip', ['-q', '-o', 'collecta-dpp-export.zip', '-d', dir]);const manifest = JSON.parse(await readFile(join(dir, 'manifest.json'), 'utf8'));let failures = 0;for (const entry of manifest.files) {const bytes = await readFile(join(dir, entry.path));const digest = createHash('sha256').update(bytes).digest('hex');const ok = bytes.length === entry.bytes && digest === entry.sha256;if (!ok) failures++;console.log(ok ? 'ok ' : 'MISMATCH', entry.path);}console.log(`${manifest.files.length - failures} of ${manifest.files.length} files verified`);process.exitCode = failures ? 1 : 0;Deliberately not included
- Supplier upload-link tokens — they are live credentials, not data.
- Passwords and session data, in any form.
- Anything belonging to another organisation.
The identifiers
Identifiers are printed on batteries and never change, so an export does not move them: the printed address keeps pointing where it was printed to. Moving to another provider means the new provider takes the identifiers over and the printed address is redirected — arranged between providers. We accept identifiers issued elsewhere for exactly that reason, and the same works in reverse.