# kindgi exports

> Exports: create an export of the whole workspace as files, or verify a signed one

## `kindgi exports`

**Synopsis**

```sh signature
kindgi exports <command>
```

Exports: create an export of the whole workspace as files, or verify a signed one.

**Commands**

| Command                                                                                                   | Description                                                                                                                                                                                                                              |
| --------------------------------------------------------------------------------------------------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| [`kindgi exports create`](https://docs.kindgi.com/v0.1.10/reference/cli/exports.md#kindgi-exports-create) | Export the whole workspace as files: every kind of record the API reads, one JSON line per record, as the API answers it, and the signed exports (each decided approval's audit bundle, each run's provenance, the compliance evidence). |
| [`kindgi exports verify`](https://docs.kindgi.com/v0.1.10/reference/cli/exports.md#kindgi-exports-verify) | Check a signed export (an approval's audit bundle, a run's provenance, compliance evidence): that its bytes are the ones signed, and, with --trust or --from-runtime, who signed them.                                                   |

**See also**

- [Export signed evidence](https://docs.kindgi.com/v0.1.10/guides/observability/export-signed-evidence.md)

### `kindgi exports create`

**Synopsis**

```sh signature
kindgi exports create --out <dir> [--resume] [--no-signed] [--yes]
```

Export the whole workspace as files: every kind of record the API reads, one JSON line per record, as the API answers it, and the signed exports (each decided approval's audit bundle, each run's provenance, the compliance evidence). Run it as a tenant admin. manifest.json says what each file holds. Exit 0 when every kind is exported or skipped, 1 when any failed.

**Options**

| Option          | Default                                                                               | Description                                                                                             |
| --------------- | ------------------------------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------- |
| `--no-signed`   | off                                                                                   | Don't make the signed exports: fewer requests, and no `export-signed` audit events.                     |
| `--out <value>` | required: a new or empty folder, or, with `--resume`, the folder an export stopped in | The folder to write the export to: a new or empty one, or, with --resume, one an export stopped in.     |
| `--resume`      | off                                                                                   | Finish the export in --out: the kinds its manifest.json marks ok are kept, and the rest are read again. |
| `--yes`         | off                                                                                   | Export as someone who isn't a tenant admin: the kinds only a tenant admin reads are skipped.            |

Every command also takes the [global flags](https://docs.kindgi.com/v0.1.10/reference/cli.md#global-flags).

**Examples**

Export the whole workspace to a new folder, as a tenant admin.

```sh
kindgi exports create --out ./acme-export
```

Finish an export that stopped part way: the kinds already written are kept.

```sh
kindgi exports create --out ./acme-export --resume
```

**See also**

- [Export signed evidence](https://docs.kindgi.com/v0.1.10/guides/observability/export-signed-evidence.md)
- [`kindgi exports`](https://docs.kindgi.com/v0.1.10/reference/cli/exports.md#kindgi-exports)

### `kindgi exports verify`

**Synopsis**

```sh signature
kindgi exports verify <file> [--trust=<public-key.pem>]... [--from-runtime]
```

Check a signed export (an approval's audit bundle, a run's provenance, compliance evidence): that its bytes are the ones signed, and, with --trust or --from-runtime, who signed them. Exit 0 when it checks out, 1 when it doesn't.

**Options**

| Option            | Default                                         | Description                                                                    |
| ----------------- | ----------------------------------------------- | ------------------------------------------------------------------------------ |
| `--from-runtime`  | off                                             | Trust the keys the runtime signs exports with (`GET /v1/export-signing-keys`). |
| `--trust <value>` | none (checks against the export's own key only) | A public key file (PEM) you trust. Repeat for several. Repeatable.             |

Every command also takes the [global flags](https://docs.kindgi.com/v0.1.10/reference/cli.md#global-flags).

**Examples**

From [Export signed evidence](https://docs.kindgi.com/v0.1.10/guides/observability/export-signed-evidence.md):

```sh
pnpm exec kindgi exports verify approval.json --from-runtime
```

**See also**

- [Export signed evidence](https://docs.kindgi.com/v0.1.10/guides/observability/export-signed-evidence.md)
- [`kindgi exports`](https://docs.kindgi.com/v0.1.10/reference/cli/exports.md#kindgi-exports)