---
title: "oz0 tenant export"
description: "Usage and flags for oz0 tenant export."
canonical_url: "https://docs.oz0.ai/reference/cli/oz0/tenant/export"
---
# oz0 tenant export

> Usage and flags for oz0 tenant export.

For: Operators and developers looking up a command.

Write everything the cluster holds for one tenant into a new folder (or a tar file): its row and each of its tables as JSON lines (every table of the database has a rule: exported, exported with named columns left out, or left out with a reason, all listed in the manifest), each installed plugin's files, the audit chain with its head, the evidence bundle, the usage export and the inventory.

--content adds content columns, audit entries' private parts and every job as `job export --content` writes it, read by an edge with the tenant's keys and with the tenant's secrets redacted; it needs the content permission. Someone else's private chat is exported without what was said unless --chats-reason gives a reason, which is audited per chat and shown to its owner.

A secret's value, a sealed key, a credential's hash and an erased data subject's data are never in an export. The manifest is signed with the cluster's audit key and the jobs' content manifest with an edge's gateway key. The tenant's admins may; each export is audited.

--verify PATH checks an export (a folder or a tar file) without the cluster and without the network: the signatures, every file's size and SHA-256, no file missing or added, each table's row count, the audit chain and the evidence bundle. Pin the audit key with --key and the fingerprint `oz0 audit key` prints. Exit status 0 means every check passed, 1 a check failed, 2 the export could not be read.

## Usage

```bash
oz0 tenant export TENANT --out DIR [flags]
```

## Flags

<table>
<thead>
  <tr>
    <th>
      Flag
    </th>
    
    <th>
      Type
    </th>
    
    <th>
      Default
    </th>
    
    <th>
      Description
    </th>
  </tr>
</thead>

<tbody>
  <tr>
    <td>
      <code>
        --chats-reason
      </code>
    </td>
    
    <td>
      string
    </td>
    
    <td>
      
    </td>
    
    <td>
      export other people's private chats with what was said, for this reason (audited per chat; at most 500 characters)
    </td>
  </tr>
  
  <tr>
    <td>
      <code>
        --content
      </code>
    </td>
    
    <td>
      bool
    </td>
    
    <td>
      
    </td>
    
    <td>
      include what jobs read and wrote, content columns and audit entries' private parts (needs the content permission; audited)
    </td>
  </tr>
  
  <tr>
    <td>
      <code>
        --json
      </code>
    </td>
    
    <td>
      bool
    </td>
    
    <td>
      
    </td>
    
    <td>
      with --verify: print the result as JSON
    </td>
  </tr>
  
  <tr>
    <td>
      <code>
        --key
      </code>
    </td>
    
    <td>
      string
    </td>
    
    <td>
      
    </td>
    
    <td>
      with --verify: the audit key's fingerprint (or public key) the export must be signed with
    </td>
  </tr>
  
  <tr>
    <td>
      <code>
        --out
      </code>
    </td>
    
    <td>
      string
    </td>
    
    <td>
      
    </td>
    
    <td>
      a new or empty folder to write the export to
    </td>
  </tr>
  
  <tr>
    <td>
      <code>
        --since
      </code>
    </td>
    
    <td>
      string
    </td>
    
    <td>
      
    </td>
    
    <td>
      export records, the audit trail, usage and jobs from this time on (RFC 3339); configuration is whole
    </td>
  </tr>
  
  <tr>
    <td>
      <code>
        --tar
      </code>
    </td>
    
    <td>
      string
    </td>
    
    <td>
      
    </td>
    
    <td>
      write the export as one tar file instead (it must not exist)
    </td>
  </tr>
  
  <tr>
    <td>
      <code>
        --timeout
      </code>
    </td>
    
    <td>
      duration
    </td>
    
    <td>
      
    </td>
    
    <td>
      give up when the export takes longer than this (0: no limit)
    </td>
  </tr>
  
  <tr>
    <td>
      <code>
        --unpinned
      </code>
    </td>
    
    <td>
      bool
    </td>
    
    <td>
      
    </td>
    
    <td>
      with --verify: check an export with blinded audit entries without --key, which shows only that it is whole: whoever edited it could have signed it again
    </td>
  </tr>
  
  <tr>
    <td>
      <code>
        --verify
      </code>
    </td>
    
    <td>
      string
    </td>
    
    <td>
      
    </td>
    
    <td>
      check the export at this folder or tar file offline instead of exporting
    </td>
  </tr>
</tbody>
</table>

## Inherited flags

<table>
<thead>
  <tr>
    <th>
      Flag
    </th>
    
    <th>
      Type
    </th>
    
    <th>
      Default
    </th>
    
    <th>
      Description
    </th>
  </tr>
</thead>

<tbody>
  <tr>
    <td>
      <code>
        --context
      </code>
    </td>
    
    <td>
      string
    </td>
    
    <td>
      <code>
        $OZ0_CONTEXT or &lt;config dir>/orchestrator-zero/context.json
      </code>
    </td>
    
    <td>
      CLI context file written by server init
    </td>
  </tr>
  
  <tr>
    <td>
      <code>
        --log-level
      </code>
    </td>
    
    <td>
      string
    </td>
    
    <td>
      <code>
        info
      </code>
    </td>
    
    <td>
      log level: debug, info, warn or error
    </td>
  </tr>
</tbody>
</table>

See [all `oz0` commands](https://docs.oz0.ai/reference/cli/oz0) and the [global flags](https://docs.oz0.ai/reference/cli/oz0#global-flags).


## Sitemap

See the full [sitemap](https://docs.oz0.ai/sitemap.md) for all pages.