Export your data

You can download a copy of what Udibo holds about your identity tenant at any time, without opening a support request. The dashboard's Export page offers two tiers because they carry different risk. The directory export has your users, applications, organizations and audit history. The credential export covers password hashes, encrypted to a key you hold, and is deliberately slow.

Download the directory export

1. In the dashboard, open your tenant and choose Export in the Tenant group.

2. Under Directory export, choose Download directory export.

Your browser saves udibo-directory-export.ndjson. Downloading needs the Export directory data permission. Admin and Owner carry it; Support does not, and the page names the permission when you lack it. Each download is recorded in the tenant's audit log. One person can download it 10 times per tenant per hour; downloads past that are refused until the hour ends.

Open the downloaded file as text and check its first line before using it: tenantId should name the tenant you intended, format should be udibo.directory-export.v2, and containsCredentials should be false. Keep it under your own access controls. The absence of password hashes does not make a file of profiles, memberships, metadata, and audit activity public.

What the directory export contains

The file is NDJSON: one JSON object per line. The first line describes the file:

{
  "type": "manifest",
  "record": {
    "format": "udibo.directory-export.v2",
    "tenantId": "…",
    "createdAt": "…",
    "containsCredentials": false
  }
}

Every later line has the same shape, {"type": …, "record": {…}}. The types appear in this order:

Deleted records are included, with their deletedAt time set, so the file also shows what was removed. The export contains no password hashes, no MFA secrets and no client secrets.

What to use it for

• Directory copies. Keep a regular copy under your own control and verify it can be read by your chosen tools. This file is not a complete tenant backup or a one-click restore artifact.

• Analytics and subject requests. Find the included records about a person. The file holds no credential material, but it does not include every category of data or configuration the service holds.

• Leaving or migrating. Load users, linked sign-ins and organizations into another system. Without password hashes, plan how people will sign in there: a password reset, or a social provider they already linked. The migration guide covers the same questions for a move onto Udibo.

Credential export

The second tier hands over password hashes in a documented format, encrypted to a public key you supply. Optionally, it also includes MFA secrets. It is limited to owners through the Export credentials permission.

1. Generate an RSA keypair of at least 2048 bits and keep the private half to yourself, for example openssl genpkey -algorithm RSA -pkeyopt rsa_keygen_bits:4096.

2. Under Credential export, paste the public half, choose whether to include MFA secrets, and confirm it is you with your own Udibo account: its password, or a code from your authenticator app when it has no password, or a passkey. An account with none of these, such as one that signs in only by email link or a social provider, must add one on its security page first. An account in the tenant you are exporting cannot confirm it.

3. Save the download token the page shows. It is shown once.

4. After the 24-hour hold, download the file with the command the page gave you within the next 12 hours. The token goes in a header, and the download works once.

Every owner who can export the tenant's credentials, and has a verified email address on an account that can sign in, gets an email when an export is requested, when its hold ends, when it is cancelled and when a download attempt begins (each of up to three attempts gets its own email). If an owner changed their email address in the last 7 days and can still undo the change, the address they changed away from gets the emails too. You cannot turn these emails off. Each one names who asked, when the hold ends and the fingerprint of the key the file is encrypted to, so you can tell whether the key is yours.

Any owner can cancel an export until it has been downloaded, during the hold or the download window, and every step is recorded in the tenant's audit log. Undoing an email change from the link sent to the old address also cancels any open credential export that account requested. Cancelling also stops a download already in progress: the file is cut off before its next part, so it never reaches its final part, the export stays cancelled, it is never recorded as downloaded, and it cannot be started again. Data that download already sent cannot be recalled. If you did not start an export, cancel it and treat it as a compromise.

The file is NDJSON. Its first line is a plaintext manifest naming the tenant and the request; every later line is a JWE compact token (alg RSA-OAEP-256, enc A256GCM) that decrypts with your private key to a JSON array of users.

Export through the API

The directory export is also a management API operation, GET /api/identity/{tenantId}/export/directory. Its scope is never issued to machine tokens. Customers cannot get a token that carries it today; see the management API. Download from the dashboard instead.

The credential export's operation, POST /api/identity/{tenantId}/export/credentials, runs the same checks as the page: an owner signed in as a person, never a machine token, confirming a password or code of the account the token belongs to. As with the directory export, customers cannot get a token for it today; use the dashboard.

For the audit log on its own, with filters and CSV or NDJSON output, see the audit log guide.

Limits today

• The old address hears only while the change can be undone. If an owner's email address was changed, the address it changed from gets export emails only for the 7 days its undo link works. An export requested after that, or any email sent after it, goes to the new address only. If you get an email saying your address changed and you did not change it, undo it at once.

• Some export emails do not go out. Udibo does not send to an address on its suppression list, which an address joins after a bounce or a spam complaint. While Udibo's sending limit is reached, an email is retried every 15 minutes until shortly before the export expires, then dropped. An email saying a download began, or that an export was cancelled after one began, keeps retrying for up to 24 hours after the export expires. Each of these is recorded in the audit log as admin.export.credentials.notice_failed. An owner without a verified address is skipped. To be told independently, subscribe a webhook to admin.export.*.

• Some configuration is not in the file. Redirect URIs, application scope allowlists, webhook endpoints, identity-provider settings, and waitlist entries are not exported. Record them from the dashboard before you leave.

• No point-in-time snapshot. The export reads records in batches while it streams. Changes made during a download can appear in later batches; the manifest's createdAt is the export start time, not a transaction snapshot.

• Audit history stops at the retention window. Events older than the retention period are already gone and cannot be exported.

• No scheduled or pushed exports. Every export is a download you start.

Next: read the audit log guide, or review who can download exports in team access.

Last verified 2026-11-07.