--- title: "Tenant export format" description: "Look up export files, manifest fields and table inclusion rules." canonical_url: "https://docs.oz0.ai/admin/tenant-export/format" --- # Tenant export format > Look up export files, manifest fields and table inclusion rules. For: cluster and tenant administrators. Look up export files, manifest fields and table inclusion rules. ## The format The format is `oz0-tenant-export/1`. Within it files are only added: a new column appears in its table's file and in the manifest, so read columns by name and allow ones you do not know. A renamed or removed column, or a changed meaning, is a new format version, never a patch release's change.
Path What it holds
README.txt What the export holds and how to check it
manifest.json , manifest.sig The manifest below, and the audit key's signature over "oz0-tenant-export/1\n" + sha256(manifest.json)
keys/audit.json , keys/gateway.json The public keys that sign the manifests ( id , kind , public_key in base64, fingerprint , created_at , retired_at )
tables/<table>.jsonl One JSON object per row: the table's columns by name (text as strings, integers as numbers, bytes in base64); times are UTC milliseconds in integer columns; text columns that hold JSON stay JSON text
plugins/<name>/<version>.tar.gz Each installed plugin's files, the gzipped tar the cluster installed
audit/log.jsonl The tenant's audit chain as oz0 audit export writes it, ending with the head line
evidence/ The evidence bundle for the period, with its own manifest.json and signature; made without the content permission , whoever exports, since audit/log.jsonl carries the private parts
usage/usage.jsonl The usage export 's rows (schema version 1)
inventory/inventory.json The inventory export as JSON
recipients/recipients.json The recipient map of every agent and flow as oz0 inventory recipients --format json writes it (format oz0-recipients/1 ), computed when the export is made
purposes/purposes.json The tenant's purposes and legal bases , each agent's declared purposes and the findings (format oz0-purposes/1 )
content/manifest.json , content/manifest.sig With --content : the jobs an edge exported, signed with its gateway key over "oz0-tenant-export-content/1\n" + sha256(content/manifest.json)
content/jobs/<job>.json Each job as oz0 job export --content writes it (format oz0.job-export/v1 )
`manifest.json`:
Field What it holds
format oz0-tenant-export/1
tenant , created_at , created_by Whose export, when, and who made it
cluster id , name , version (the server's) and schema_version (the database's)
since The start of the period, when --since was given
content Whether content is in it
key_id The audit key that signs it
tables Per exported table: name , rule , file , rows , sha256 , columns ( name and type : text, integer, real, bytes, boolean), redacted and sealed (never in the rows), withheld (content columns, null without content), since (the column --since filtered on), erased_rows (rows left out as an erased subject's), private_rows (rows whose content columns are null as someone else's private chat's), walled_rows (rows whose content columns are null because a wall closes them to the exporter)
skipped Every table not in tables/ , with its rule and reason : carried by a part, transient, or the cluster's
parts The parts ( audit , evidence , usage , inventory , recipients , purposes , content ), each with its path and format
plugins Each installed plugin: name , version , artifact (its digest) and file
content_manifest With content: the content manifest's sha256 , the gateway key that signed it and the number of jobs
private_chats With content: withheld and read_with_reason (other people's private chats), and the rows and audit_entries whose content was withheld
walls With content, when the tenant's walls apply to the exporter: the rows and audit_entries whose content a wall withheld, and a note on how it was decided
files Every other file's path , size and sha256 , but the content part's files, which the content manifest lists
`content/manifest.json` has `format` (`oz0-tenant-export-content/1`), `tenant`, `created_at`, `created_by`, `since`, `key_id`, `jobs` (each `id`, `file`, `content`, `redactions` and a `note`), `left` (jobs left out with the reason, such as an erased subject), `truncated` and `files`. ### Tables Every table of the database has one rule, and a test fails when a new table has none, so this list is complete for the version you run. `export` exports every column but those named; `part` means another part carries the table; `skip` and `cluster` tables are not in the export, for the reason given. The third column is the column `--since` filters on.
Table Rule --since
tenants export
plugins export
plugin_versions export
plugin_contract_changes export created_at
plugin_uses_grants export
plugin_uses_pending export
plugin_optional_secrets export
plugin_provides export
tool_policies export
tool_rule_shadow export last_at
llm_providers export
model_aliases export
model_alias_seeds export
model_map_rules export
agent_budgets export
agent_changes export proposed_at
plugin_change_budgets export
model_canaries export
teams export
team_members export
quotas export
routines export
routine_versions export
plugin_hidden_skills export
channel_bindings export
channel_members export
channel_rooms export
connections export; redacted nonce, nonce_expires_at (the one-time nonce of a flow under way)
credential_bindings export
tenant_settings export
tenant_retention export
mfa_policies export
notification_rules export
kill_switches export created_at
inventory export
memberships export
provisioner_tenants export
api_keys export; redacted secret_hash (a key's hash is a credential)
join_tokens export; redacted secret_hash (a token's hash is a credential)
nodes export
rollouts export created_at
tenant_backend_moves export started_at
change_requests export; content diff, payload, error only with --content; digests delta_sha256 keyed without --content requested_at
tenant_region_moves export started_at
workspace_folders export
workspace_revisions export
workspace_revision_files export
workspace_blobs export
workspace_drafts export
workspace_draft_files export
tenant_secrets export; sealed sealed left out
tenant_payload_keys export; sealed sealed left out
subject_keys export; sealed sealed left out
job_summaries export; content error, findings only with --content started_at
job_owners export started_at
job_starters export started_at
job_runs export started_at
job_tags export added_at
job_step_summaries export started_at
job_errors export; content message, example only with --content last_at
harness_sessions export recorded_at
job_budgets export created_at
job_board export; redacted dedupe; content body only with --content created_at
job_conversations export started_at
event_waits export created_at
routine_outputs export; content output, arguments, result, answer only with --content created_at
budget_requests export created_at
loop_events export
chats export
chat_people export
chat_shares export
chat_texts export; sealed sealed left out started_at
channel_threads export; redacted reply_token, reply_until; content request only with --content (a chat message's reply token lasts minutes) created_at
subject_jobs export started_at
erasures export requested_at
held_histories export; sealed data left out, its digest keyed without content (a held history's copy is the history itself: read it with oz0 retention held --out ) copied_at
eval_runs export started_at
eval_findings export opened_at
eval_kept export kept_at
audit_log part audit recorded_at
audit_chain part audit
gateway_records part evidence recorded_at
gateway_chain part evidence
llm_usage part usage at
outside_spend part usage imported_at
payloads skip: content stored apart from the histories, sealed with the tenant's payload key: each job's export (--content) carries it decrypted
quota_usage skip: per-person spend figures (R6): the usage part holds the tenant's spend, by team where works-council mode shows it
job_summary_cursors skip: internal: the summarizer's place
channel_handled skip: transient: chat messages acted on, kept a day for deduplication
channel_link_codes skip: transient: codes that link a chat identity, for ten minutes
connection_tokens skip: transient: rebuilt by use
eval_keep_calls skip: transient: a kept case's model calls, sealed, while it is kept
event_deliveries skip: transient: events, kept a day for deduplication
feeds skip: transient: browser tabs' feeds
job_replay_calls skip: transient: the test bench's recorded model calls
job_replays skip: transient: the test bench's recordings
notification_deliveries skip: transient: notifications' tries, kept 30 days
plugin_candidates skip: transient: private candidates their developers renew
plugin_uploads skip: transient: bundles waiting to be installed, a day at most
provider_key_hashes skip: transient: hashes of provider keys, rebuilt by use
provider_pool_state skip: transient: what edges saw of pool members, rebuilt by use
quota_pending_charges skip: transient: charges an edge buffered
stream_tickets skip: transient: one-time stream tickets, for a minute
blobs cluster: plugin artifacts by digest, shared; the export carries each installed plugin's artifact under plugins/
temporal_retention cluster: each backend namespace's retention as the edge found it; the tenant's retention is in tenant_retention
cluster cluster: the cluster's identity and its CA keys
operators cluster: the cluster's operators
users cluster: the cluster's accounts and their password hashes; the tenant's members are in memberships
user_identities cluster: accounts' sign-in identities
user_mfa cluster: accounts' second factors
recovery_codes cluster: accounts' recovery codes
pending_links cluster: accounts waiting to link a sign-in identity
notification_addresses cluster: accounts' own addresses
removed_accounts cluster: accounts removed from the cluster
directory_groups cluster: a directory's groups of accounts
provisioners cluster: the cluster's provisioners
oidc_providers cluster: the cluster's sign-in providers
plugin_indexes cluster: the cluster's plugin indexes
signing_keys cluster: the cluster's signing keys; the public ones are in keys/
audit_key_seals cluster: the audit keys' sealed halves
key_backups cluster: what operators confirmed of the cluster's key copies
servers cluster: servers' heartbeats
node_status cluster: nodes' connections
sessions cluster: sign-in sessions
signin_failures cluster: failed sign-ins of the last minutes, by keyed hash
leases cluster: servers' leases
edge_registry cluster: what edges applied of the registry
registry_confirmations cluster: registry confirmations
registry_version cluster: the registry's version
edge_applied cluster: writes edges buffered
edge_sealing cluster: the cluster's record that the edges re-sealed every key of a kind
feed_bells cluster: the feeds' doorbell
authority_envelopes export; a block's digest of its input keyed and its MAC left out without content created_at
authority_epochs export
authority_revocations export created_at
receipts export created_at
revocation_fences cluster: which servers fenced a receipt's epoch
file_labels export; digests keyed without content
file_scopes export; digests keyed without content
tenant_mail export
apps export
erasure_deferrals export
erasure_policies export
agent_keep_for export
subject_rules export
job_keys export
job_key_wraps export; sealed wrapped left out
tenant_secret_history skip: previous secret values, sealed and kept 24 hours: never exported
secret_ref_state skip: transient: what a secret store last answered
secret_stores cluster: the secret stores each edge reaches
key_sources cluster: where each server's keys come from
role_sets cluster: the cluster's role sets; a member's roles are in memberships
budget_reservations export; redacted budgets (a call's budget keys name the person whose quota it charged (R6)) created_at
budget_holds skip: transient: per-budget counters recomputed from llm_usage; quota: rows are per-person spend figures (R6)
tree_admissions export created_at
comparisons export created_at
comparison_runs export finished_at
incidents export
incident_links export
incident_stages export
incident_notes export; content body only with --content
incident_reminders export
incident_settings export
tenant_legal_bases export
tenant_purposes export
agent_legal_bases export
inventory_assessment export
purpose_counts export
plugin_reads export
plugin_read_targets export
results_seen skip: edges' claims of the results source's routed events, kept a week
inventory_seen skip: edges' change-detection state, rebuilt quietly on the next look
tool_sequence_facts skip: transient: the sequence rules that fired in a running job tree, which the edge prunes
plugin_vuln_scans export
plugin_vuln_findings export
advisories cluster: the cluster's imported advisories, which every tenant's scans read
advisory_sources cluster: where the cluster's advisories came from, and who imported them
spend_root_kinds skip: derived: the kind of each root job that spent money, read again from its workflow
spend_anomaly_days export
governance_replays export created_at
governance_replay_jobs export at
oidc_issuers export
mcp_grants export; redacted code_hash, code_challenge, refresh_hash, refresh_prev_hash, last_used_at created_at
mcp_client_policies export
plugin_records export; redacted dedupe; content body only with --content created_at
tenant_memory export
agent_memory export
test_approvals export
approval_asks skip: transient: the ladder's first steps, kept a day for the flood finding
judge_anchor_runs export started_at
sampled_judgments export sampled_at
subject_restrictions export
decision_records export started_at
decision_contests export; content reason only with --content created_at
agent_tombstones export
team_orphans export
idempotency_keys skip: transient: the admin API's answers to calls made with an Idempotency-Key, kept a day
plugin_set_members export
plugin_version_provenance export
agent_starts skip: transient: the running jobs of agents with limits.concurrent, which each start counts again
tool_snapshot_checks skip: a queue: node listings management has still to check against the tool policy; the snapshots are exported with the plugins
job_outcomes export; content detail only with --content reported_at
plugin_rollout_quality export
candidate_checks skip: transient: the candidate checks of agent-made changesets, each for its job's changes approval, holding code no person has read yet; a job asks again
model_vettings export
held_history_heads export; current and published retained-history generations
held_history_captures export; private source, checkpoint and manifest internals left out
held_history_objects export; source identities left out, payload digests only with content permission
held_history_chunks export; chunk bytes left out, payload digests only with content permission
held_history_discovery export; private scan and source checkpoint internals left out
held_history_erased_trees export; erasure markers that prevent capture from bringing erased jobs back
## Sitemap See the full [sitemap](https://docs.oz0.ai/sitemap.md) for all pages.