Streams up to 1000 visitors as a CSV file using the same filtering options as the visitor list route. The export format is always CSV, and omitted filters behave the same way they do on the visitor list endpoint. Results are ordered by most recent visitor activity first. Authenticate with an organization API key sent in `X-API-Key` or as a Bearer token and carrying the exact `visitors:read` scope. API-key access also requires the Automation & API module (`automation_api`). Authorized dashboard sessions remain supported where the route already permits them. The request is isolated to the authenticated organization. Resource and site/project identifiers must belong to that organization; out-of-scope identifiers are not disclosed. The successful response is a CSV download rather than JSON. Query filters use the same organization boundary as the visitor list; callers should stream the response and honor the `Content-Disposition` filename. Retry behavior: This read-only operation is safe to retry.
/api/visitors/export/csvOrganization API key supplied as Authorization: Bearer convor_sk_....
In: header
application/json
application/json
application/json
application/json
application/json
application/json
application/json
application/json
application/json
"ID,Identifier,Email,Name,City,Country,Sessions,First Seen,Last Seen,Tags,Blocked\n\"visitor_123\",\"[email protected]\",\"[email protected]\",\"Jane Doe\",\"Warsaw\",\"PL\",\"3\",\"2026-06-01T08:00:00.000Z\",\"2026-06-23T09:30:00.000Z\",\"vip\",\"No\""{
"error": {
"code": "string",
"message": "string",
"fields": {
"property1": "string",
"property2": "string"
},
"details": {},
"correlationId": "string"
}
}{
"error": {
"code": "string",
"message": "string",
"fields": {
"property1": "string",
"property2": "string"
},
"details": {},
"correlationId": "string"
}
}{
"error": {
"code": "string",
"message": "string",
"fields": {
"property1": "string",
"property2": "string"
},
"details": {},
"correlationId": "string"
}
}{
"error": {
"code": "string",
"message": "string",
"fields": {
"property1": "string",
"property2": "string"
},
"details": {},
"correlationId": "string"
}
}{
"error": {
"code": "string",
"message": "string",
"fields": {
"property1": "string",
"property2": "string"
},
"details": {},
"correlationId": "string"
}
}{
"error": {
"code": "string",
"message": "string",
"fields": {
"property1": "string",
"property2": "string"
},
"details": {},
"correlationId": "string"
}
}{
"error": {
"code": "string",
"message": "string",
"fields": {
"property1": "string",
"property2": "string"
},
"details": {},
"correlationId": "string"
}
}{
"error": {
"code": "string",
"message": "string",
"fields": {
"property1": "string",
"property2": "string"
},
"details": {},
"correlationId": "string"
}
}curl --request GET \
'https://api.convor.io/api/visitors/export/csv' \
--header 'Accept: application/json' \
--header 'Authorization: Bearer convor_sk_...'const response = await fetch("https://api.convor.io/api/visitors/export/csv", {
method: "GET",
headers: {
"Accept": "application/json",
"Authorization": "Bearer convor_sk_..."
},
});
const contentType = response.headers.get("content-type") ?? "";
const data = response.status === 204
? null
: contentType.includes("json")
? await response.json()
: contentType.startsWith("text/")
? await response.text()
: await response.blob();
if (!response.ok) {
const message = typeof data === "object" && data !== null
&& "error" in data && typeof data.error === "object"
&& data.error !== null && "message" in data.error
? String(data.error.message)
: "Convor API request failed (" + response.status + ")";
throw new Error(message);
}
console.log(data);Was this page helpful?
Edit a visitor note
Updates the text of one existing visitor note and keeps its other note fields, including pin state and author metadata, unchanged. Authenticate with an organization API key sent in `X-API-Key` or as a Bearer token and carrying the exact `visitors:write` scope. API-key access also requires the Automation & API module (`automation_api`). Authorized dashboard sessions remain supported where the route already permits them. The request is isolated to the authenticated organization. Resource and site/project identifiers must belong to that organization; out-of-scope identifiers are not disclosed. Retry behavior: Repeating the same request converges on the same resource state, but a retry may return a conflict or not-found response after the first request succeeds.
Get visitor browsing history
Returns the visitor's recorded page history and computed time spent on each page. Visitor callers can only read their own history. The most recent page keeps `durationMs: null` because there is no later navigation event yet. Authenticate with an organization API key sent in `X-API-Key` or as a Bearer token and carrying the exact `visitors:read` scope. API-key access also requires the Automation & API module (`automation_api`). Authorized dashboard sessions remain supported where the route already permits them. The request is isolated to the authenticated organization. Resource and site/project identifiers must belong to that organization; out-of-scope identifiers are not disclosed. Dashboard sessions and organization API keys can read organization-owned visitor history. Visitor bearer tokens remain limited to their own visitor identity by the route's ownership check. Retry behavior: This read-only operation is safe to retry.