Start a realm export
const url = 'http://localhost:8000/clusters/2489E9AD-2EE2-8E00-8EC9-32D5F69181C0/realms/example/exports';
const options = {
method: 'POST',
headers: {
'API-Version': '2026-06-01.beta',
'API-Key': '<API-Key>',
'Content-Type': 'application/json'
},
body: '{"scope":"full","encryption_password":"a-strong-passphrase"}'
};
try {
const response = await fetch(url, options);
const data = await response.json();
console.log(data);
} catch (error) {
console.error(error);
}curl --request POST \
--url http://localhost:8000/clusters/2489E9AD-2EE2-8E00-8EC9-32D5F69181C0/realms/example/exports \
--header 'API-Key: <API-Key>' \
--header 'API-Version: 2026-06-01.beta' \
--header 'Content-Type: application/json' \
--data '{ "scope": "full", "encryption_password": "a-strong-passphrase" }'Queues an encrypted export of a single realm (configuration, users, and all credentials).
Generated asynchronously by a server-side kc.sh export; poll
GET /realm-exports/{export_id} until status is completed, then download from
download_url before expires_at. Skycloak does not retain the artifact past expires_at.
Required scope: clusters:exports:write
Authorizations
Section titled “Authorizations”Parameters
Section titled “Parameters”Path Parameters
Section titled “Path Parameters”Header Parameters
Section titled “Header Parameters”Request Bodyrequired
Section titled “Request Bodyrequired”object
Export scope. Only full is currently supported.
Password used to encrypt the archive (AES-256-CBC, PBKDF2). Required: every realm export contains credentials. Never stored; only a hash is retained for verification.
Example
{
"scope": "full",
"encryption_password": "a-strong-passphrase"
}Responses
Section titled “Responses”Returned when a realm export has been accepted for processing. Poll the resource until status is completed or failed, then download from download_url.
object
The exported realm’s name (Keycloak realm id).
Percent complete, 0-100.
Keycloak version that produced the export. An import target must run this version or newer. Only set once status is completed.
SHA-256 checksum of the produced encrypted archive (hex). Only set once status is completed.
Time-limited presigned URL to download the encrypted archive. Only set when status is completed and expires_at is in the future. Skycloak does not retain the artifact past expires_at.
When the archive is deleted from storage (24h after completion).
Failure description. Only set when status is failed.
Example
{
"id": "5fa3e1a0-2c9b-4d2f-9b3a-1e8c4d2f9b3a",
"cluster_id": "a1b2c3d4-e5f6-7890-abcd-ef1234567890",
"realm": "cust-brasilia",
"scope": "full",
"status": "completed",
"progress": 100,
"source_version": "26.6.1",
"sha256_checksum": "9f86d081884c7d659a2feaa0c55ad015a3bf4f1b2b0b822cd15d6c15b0f00a08",
"download_url": "https://exports.skycloak.io/.../cust-brasilia.zip.enc?X-Amz-Signature=...",
"expires_at": "2026-07-20T14:15:00Z",
"error_message": null,
"created_at": "2026-07-19T14:00:00Z",
"completed_at": "2026-07-19T14:12:00Z"
}Headers
Section titled “Headers”URL of the resource being created or modified. Poll this endpoint to track completion.
The server could not understand the request due to invalid syntax.
RFC 9457 Problem Details object.
object
Example generated
{
"type": "https://example.com",
"title": "example",
"status": 1,
"detail": "example",
"instance": "https://example.com"
}Access is unauthorized.
RFC 9457 Problem Details object.
object
Example generated
{
"type": "https://example.com",
"title": "example",
"status": 1,
"detail": "example",
"instance": "https://example.com"
}Client error
Returned when a workspace plan quota would be exceeded. required_plan indicates the minimum plan needed to complete the request.
object
Machine-readable identifier of the quota that was hit, so a client can tell
quotas apart without parsing detail. Known values include cluster_limit
(the workspace’s total cluster allowance), cluster_size_quota (the
allowance for the requested cluster size) and cluster_size (the requested
size is not offered on the plan at all). New values may be added.
How many of the resource the workspace currently has.
Maximum allowed by the current plan. 0 means the plan does not include the resource at all.
Example generated
{
"type": "https://example.com",
"title": "example",
"status": 1,
"detail": "example",
"instance": "https://example.com",
"current_plan": "example",
"required_plan": "example",
"code": "example",
"current_usage": 1,
"current_limit": 1
}Access is forbidden.
RFC 9457 Problem Details object.
object
Example generated
{
"type": "https://example.com",
"title": "example",
"status": 1,
"detail": "example",
"instance": "https://example.com"
}The server cannot find the requested resource.
RFC 9457 Problem Details object.
object
Example generated
{
"type": "https://example.com",
"title": "example",
"status": 1,
"detail": "example",
"instance": "https://example.com"
}Client error
object
object
Example generated
{
"type": "https://example.com",
"title": "example",
"status": 1,
"detail": "example",
"instance": "https://example.com",
"errors": [
{
"field": "example",
"detail": "example",
"code": "example",
"value": "example"
}
]
}Client error
RFC 9457 Problem Details object.
object
Example generated
{
"type": "https://example.com",
"title": "example",
"status": 1,
"detail": "example",
"instance": "https://example.com"
}Headers
Section titled “Headers”Server error
RFC 9457 Problem Details object.
object
Example generated
{
"type": "https://example.com",
"title": "example",
"status": 1,
"detail": "example",
"instance": "https://example.com"
}Server error
RFC 9457 Problem Details object.
object
Example generated
{
"type": "https://example.com",
"title": "example",
"status": 1,
"detail": "example",
"instance": "https://example.com"
}