Skip to content
Convor
Convor Docs
API ReferenceGDPR

Export visitor data (GDPR data subject access request)

Exports the complete project-scoped dataset associated with a visitor as a JSON attachment.

POST/api/gdpr/visitors/{visitorId}/export

Exports the complete project-scoped dataset associated with a visitor as a JSON attachment. Access requires data-export read permission. The export contains the visitor profile, every conversation, the full message transcript (all sender types, not only visitor-authored rows), surveys, CSAT responses, visitor sessions, visitor page views, private attachment metadata with a signed read URL, legacy file metadata, and every AI response trace attributable to that visitor. Every collection is fetched without a silent row cap and is deterministically ordered; the response manifest declares per-collection counts and explicitly names any bounded collection (there are none today) so truncation is never silent. The gdpr_requests entry is recorded with status completed because the response is the exhaustive declared dataset.

Endpoint requirements

Credentials
Use either Bearer API key or X-API-Key header.
Required scope
export:read
Module
Automation & API module (api_access)
Organization and site scope
Requests can access only resources owned by the authenticated organization. The API does not reveal whether an identifier belongs to another organization or site.
Retry behavior
Safe read: You can safely retry this read-only request after a transport failure. It does not change resource state.

Path Parameters

visitorId*string

Path parameter. Unique identifier of the related visitor.

Match^([0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[1-8][0-9a-fA-F]{3}-[89abAB][0-9a-fA-F]{3}-[0-9a-fA-F]{12}|00000000-0000-0000-0000-000000000000|ffffffff-ffff-ffff-ffff-ffffffffffff)$
Formatuuid

Header Parameters

X-Project-Id?|

DA-4035: selects the active site (project) for project-scoped operations. Accepts a site UUID, or the literal all to aggregate across every accessible site on read-only aggregate routes (single-or-all-read). Mutations and single-site routes reject all. Path-owned project routes (/api/projects/{projectId}/…) resolve the site from the URL and ignore this header. Conflicting selectors across header/query/body/path return PROJECT_CONTEXT_CONFLICT (400); an archived site returns PROJECT_ARCHIVED (410).

Response Body

application/json

application/json

application/json

application/json

application/json

application/json

application/json

application/json

application/json

application/json

application/json

{  "exportedAt": "2026-06-23T17:00:00.000Z",  "manifest": {    "complete": true,    "scope": {      "orgId": "11111111-1111-4111-8111-111111111111",      "projectId": "33333333-3333-4333-8333-333333333333",      "visitorId": "22222222-2222-4222-8222-222222222222"    },    "counts": {      "conversations": 0,      "messages": 0,      "surveys": 0,      "csatResponses": 0,      "visitorSessions": 0,      "visitorPageViews": 0,      "privateAttachments": 0,      "files": 0,      "aiTraces": 0    },    "bounded": [],    "ordering": {      "conversations": "createdAt,id",      "messages": "Example customer-support message.",      "surveys": "example",      "csatResponses": "example",      "visitorSessions": "example",      "visitorPageViews": "example",      "privateAttachments": "example",      "files": "example"    },    "version": 2  },  "visitor": {    "id": "22222222-2222-4222-8222-222222222222",    "identifier": "[email protected]",    "firstSeenAt": "2026-06-01T09:00:00.000Z",    "lastSeenAt": "2026-06-23T16:45:00.000Z",    "totalSessions": 4,    "geoCountry": "PL",    "geoCity": "Warsaw",    "metadata": {      "source": "widget"    }  },  "conversations": [],  "messages": [],  "surveys": [],  "csatResponses": [],  "visitorSessions": [],  "visitorPageViews": [],  "privateAttachments": [],  "files": [],  "aiTraces": []}

Request examples

curl

curl --request POST \
  'https://api.convor.io/api/gdpr/visitors/22222222-2222-4222-8222-222222222222/export' \
  --header 'Accept: application/json' \
  --header 'Authorization: Bearer convor_sk_...'

JavaScript

const response = await fetch("https://api.convor.io/api/gdpr/visitors/22222222-2222-4222-8222-222222222222/export", {
  method: "POST",
  headers: {
    "Accept": "application/json",
    "Authorization": "Bearer convor_sk_..."
  },
});

const contentType = response.headers.get("content-type") ?? "";
const data = response.status === 204
  ? null
  : contentType.includes("json")
    ? await response.json()
    : contentType.startsWith("text/")
      ? await response.text()
      : await response.blob();

if (!response.ok) {
  const message = typeof data === "object" && data !== null
    && "error" in data && typeof data.error === "object"
    && data.error !== null && "message" in data.error
      ? String(data.error.message)
      : "Convor API request failed (" + response.status + ")";
  throw new Error(message);
}

console.log(data);

Was this page helpful?

GDPR

GDPR data management

SLA

Service Level Agreement management

On this page

Request examplescurlJavaScript