/api/v1/customer/export-gdpr

Returns an application/zip archive with every personal data point the organisation holds about the customer identified by identityId — profile, addresses, company record, additional e-mails, consent audit trail, orders, invoices, subscriptions, comments, and the system activity log. Companion README.md and index.html are rendered in the customer’s preferred language. Internal identifiers, hashes and other non-personal data are deliberately omitted.

How to call this endpoint safely

The apiKey is an organisation-wide secret — exposing it in the browser would let anyone export anyone’s data. Treat this endpoint as server-to-server only:

1. The customer authenticates against your application (e.g. via /customer/login or /customer/magic-auth) and you obtain their short-lived identityId.
2. When the customer requests their data export, your backend (never the browser) calls this endpoint with the secret apiKey and the customer’s identityId.
3. The endpoint verifies that the identity belongs to a customer in the same organisation as the API key — a mismatch is logged as a critical security event and the request is rejected.
4. Your backend then proxies the binary response to the end user, typically by streaming the body straight back with the same Content-Disposition header, or by storing it briefly and serving a one-time download URL.

This indirection keeps the API key on your server and lets you layer your own checks (rate limits, audit logging, a second-factor confirmation, etc.) before honouring the request — the endpoint itself enforces only the organisation/identity binding.