# Export data

**Flow key:** `export-data`

## Outcome

An authorized user exports exactly the intended scope and fields in a usable format without hidden-data leakage, stale scope, corruption, or uncontrolled retention.

## Actors

- User/admin
- Export service
- Background worker
- Storage/download service

## Preconditions and entry points

- A deterministic dataset contains permitted and restricted fields across roles/tenants.
- Format, size, retention, redaction, and notification policies are known.

## Required test data

Use synthetic, isolated, resettable data. Never use real credentials, payment instruments, private customer records, or production notifications.

| Data | Canonical valid seed | Critical variations |
|---|---|---|
| Scope | 10 selected synthetic records | all records, active filter, empty, large, other tenant |
| Fields | ID/name/status/updated | sensitive hidden field, custom field, deleted relation |
| Format | CSV UTF-8 | JSON, XLSX, PDF, locale-specific, compressed archive |
| Values | null/zero/false, Unicode/emoji, multiline, formula-prefix canary | large text, timezone/currency |
| Delivery | direct safe download | background email link, expiring signed URL, revoked access |

## Canonical steps

Treat this as the ordinary successful path inferred from common product behavior. Adapt it to observed labels, business rules, APIs, and implementation evidence; do not invent a requirement.

| Step | User or system action | Expected evidence |
|---:|---|---|
| 1 | Set list/query scope and choose Export. | The export summarizes exact records, filters, fields, format, and sensitivity. |
| 2 | Choose permitted options. | Server reauthorizes field and row scope independently of UI. |
| 3 | Submit once. | One export job/version is created without changing source data. |
| 4 | Monitor or receive completion. | Status, counts, size, expiry, and failures are truthful. |
| 5 | Download and inspect output. | Rows, fields, order, types, encoding, formulas, locale, and redaction match the request. |
| 6 | Expire/revoke/delete the export. | URLs, caches, storage, notifications, and audit follow retention policy. |

## Alternate paths

- Immediate small export
- Background large export
- Selected rows
- Current filtered view
- Admin compliance export

## Failure and recovery paths

- Permission changes after request
- Worker produces partial file
- Signed URL leaks or outlives access
- Spreadsheet formula injection
- Notification sent to wrong recipient

## Completion oracle

- The stated outcome is true in visible UI and authoritative persisted state.
- Exactly one intended business result and no unintended side effect occurred.
- Identity, tenant, authorization, money/data, lifecycle, notifications, integrations, analytics, and audit agree where applicable.
- Refresh, retry, back/forward, and a second authorized read do not reveal a contradictory result.
- Any partial, delayed, canceled, failed, or unknown outcome is labeled truthfully and has a safe recovery path.

## Evidence to capture

- Entry context, actor, tenant, role, feature flags, locale, time zone, and initial identifiers/state.
- Step-level screenshots or DOM state plus request/response, correlation, job, event, and stable business IDs where available.
- Before/after authoritative records, versions, totals, permissions, lifecycle states, and downstream side effects.
- Notifications, audit events, integration deliveries, retries, deduplication, latency, and recovery evidence.
- Untested branches, unsafe-to-run cases, product decisions, and evidence tier.

## Product decisions to resolve

- Exact eligibility, required data, authorization, and validation rules.
- Which steps are synchronous, asynchronous, optional, skippable, reversible, or irreversible.
- Idempotency, concurrency, timeout, retry, cancellation, and compensation semantics.
- Retention, privacy, notification, audit, performance, accessibility, and localization commitments.

## Related CARBON items

- [export](../../items/content/export.md)
- [download and export file delivery](../../items/content/download-and-export-file-delivery.md)
- [privacy](../../items/quality/privacy.md)
- [security](../../items/quality/security.md)

[Back to Productivity and collaboration flows](index.md)
