Export Keystore

Endpoint

GET /apiops/projects/{projectName}/keystores/{keystoreName}/export/

Authentication

Requires a Personal API Access Token.

Header

Authorization: Bearer YOUR_TOKEN

Request

Headers

Header	Value	Required
Authorization	Bearer {token}	Yes
X-Apinizer-Package-Passphrase	Base64 encoding of the UTF-8 passphrase	Only when encrypt=true

Path Parameters

Parameter	Type	Required	Description
projectName	string	Yes	Project name
keystoreName	string	Yes	Name of the keystore to export

Query Parameters

Parameter	Type	Required	Description
encrypt	boolean	No	Whether to encrypt the exported package with a passphrase. Defaults to false. When true, the X-Apinizer-Package-Passphrase header is required.

Response

Success Response (200 OK)

The response is a ZIP file containing the keystore export.

Headers

• Content-Type: application/octet-stream
• Content-Disposition: attachment; filename="<keystoreName>.zip"

Response Body

• Binary ZIP file containing:
  • A single JSON entry with the keystore definition

ZIP File Contents

• One JSON entry describing the keystore
• When encrypt=false, the archive is a plain ZIP file, byte-compatible with older Apinizer versions
• When encrypt=true, the whole package — including entry names — is encrypted with the supplied passphrase; nothing about its contents can be observed from the outside

Warning

Without a passphrase (encrypt=false), the exported package carries the keystore's secret values (the keystore file content and its password) in a readable form so they can be carried over on import. Treat unencrypted keystore export files as highly sensitive, and prefer encrypt=true whenever the file will be stored or transferred outside a fully trusted channel.

Error Response (400 Bad Request)

{
  "status": "FAILURE",
  "resultMessage": "projectName value can not be empty!"
}

or

{
  "status": "FAILURE",
  "resultMessage": "keystoreName value can not be empty!"
}

or

{
  "status": "FAILURE",
  "resultMessage": "Keystore (name: MyKeystore) is not found!"
}

or

{
  "status": "FAILURE",
  "resultMessage": "Package encryption requested but no passphrase was supplied."
}

or

{
  "status": "FAILURE",
  "resultMessage": "Export package could not be encrypted."
}

Common Causes

• Empty projectName or keystoreName
• Keystore does not exist in the project
• encrypt=true but the X-Apinizer-Package-Passphrase header was not provided
• The package could not be encrypted

Error Response (401 Unauthorized)

{
  "status": "FAILURE",
  "resultMessage": "Token is not valid!"
}

cURL Example

Example 1: Export Keystore (Unencrypted)

curl -X GET \
  "https://demo.apinizer.com/apiops/projects/MyProject/keystores/MyKeystore/export/" \
  -H "Authorization: Bearer YOUR_TOKEN" \
  --output keystoreExportFile.zip

Example 2: Export Keystore (Encrypted with Passphrase)

curl -X GET \
  "https://demo.apinizer.com/apiops/projects/MyProject/keystores/MyKeystore/export/?encrypt=true" \
  -H "Authorization: Bearer YOUR_TOKEN" \
  -H "X-Apinizer-Package-Passphrase: $(printf '%s' 'MyStrongPassphrase' | base64)" \
  --output keystoreExportFile.zip

Notes and Warnings

• Optional Encryption:

  • Encryption is opt-in via the encrypt query parameter, default false
  • Unencrypted exports remain byte-compatible with older Apinizer versions
  • Encrypted exports protect the entire package, including object names

• Passphrase Handling:

  • The passphrase is never stored anywhere and cannot be recovered
  • If the passphrase is lost, the encrypted package can never be opened again
  • The encryption key is derived from the passphrase; the passphrase itself is not written into the package

• Header Encoding:

  • X-Apinizer-Package-Passphrase carries the Base64 encoding of the UTF-8 passphrase
  • Base64 is a transport encoding only, not a protection mechanism — the header relies on TLS for confidentiality
  • Base64 encoding exists so that non-ASCII passphrase characters survive header transport without corruption

• File Naming:

  • The download is named after the keystore, for example partner-keystore.zip
  • The name is sanitized, so a keystore whose name contains a slash or another reserved character still produces a valid file name
  • You can rename the downloaded file as needed

Permissions

• User must have SECRETS + EXPORT_IMPORT permission in the project
• Alternatively, user can have project admin role

Related Documentation

• Import Keystore - Import a keystore from an exported ZIP file
• Get Keystore - Get keystore details
• List Keystores - List all keystores