Keep control beyond the database.

Understand this website’s resources

ExportAPI.com provides public articles and sample downloads. The supplied samples contain fictional customer records and do not require an account. The site does not accept production datasets for processing, and the illustrative API patterns do not establish a hosted service security boundary.

Use the samples to inspect formats. Evaluate the controls in your own application separately before exporting private, confidential, or regulated information.

Authorize the dataset and the artifact

Check whether the requester may access the selected account, record types, and fields. Apply that boundary during selection, then control who may retrieve the generated artifact. A successful job should not turn a private dataset into a public file merely because generation has finished.

Choose how access changes affect an existing export. A download permission, a job status permission, and an operator’s diagnostic access are separate concerns. Keep their scope explicit rather than relying on a hard-to-guess filename.

Manage lifetime and exposure

Decide where temporary and completed files are stored, how recipients obtain them, and when they expire. Treat download links as potentially shareable information. Avoid copying private links or raw record contents into logs, notifications, and support messages unnecessarily.

Keep the status record distinct from artifact availability so an expired download has a clear explanation. Retention should reflect the actual purpose of the export and the sensitivity of its contents.

Verify the completed file and the notification

Validate the exported representation before making it available. For spreadsheet outputs, examine how untrusted text is interpreted by the receiving application. For completion events, define verification, duplicate handling, and recovery after a receiver failure.

Continue with secure export delivery, data validation, and webhook retries and idempotency for the detailed design considerations.

Report a concern

Contact [email protected] about a security concern affecting this website or its public resources. Describe the affected location and the observed behavior. Keep credentials, private datasets, and other people’s information out of the initial message.