API: Exports

Streams one RawEventExportRecord per line with synchronous writes for backpressure. The query is scoped by project_id and server_time, is cancelled on disconnect, and is limited to 1000000 records, 30 seconds, 10 starts per organization per minute, two concurrent streams per organization and eight per process. Cloud access is fail-closed through the effective plan's api_export entitlement; on-prem access is controlled by the signed license feature of the same name. Privacy export for a specific data subject is a separate, non-commercial flow and is not affected by this gate. Errors before the first record use the canonical JSON envelope. After streaming begins, no error object is mixed into NDJSON. A transport short write can truncate the final JSON line, so clients must parse every line and require an ok X-PP-Export-Status trailer; a missing trailer does not prove success. Export trailers mark a partial result. The same 30-second deadline bounds the whole request (including gate/limiter), the query context, response writes and response finalization.

Cloud requires the Start, Growth or Scale result_csv entitlement; on-prem requires result_csv in the current verified signed-license feature subset. Enforcement is server-side for direct API calls. Runs the same canonical query definition and project timezone as the Funnel, Retention, Insights, Paths or Advanced Insights screen, or the same filters as the Events list. Result and raw exports share a server-side limit of 10 starts per organization per minute, two active exports per organization and eight per process. The response starts with an UTF-8 BOM and has stable, locale-neutral machine headers. At most 100000 data rows are returned; the header does not count. Text cells whose first non-whitespace character is =, +, - or @ are prefixed with an apostrophe before CSV encoding. Every data row starts with schema_version,locale,timezone = 1.3,und,<project IANA timezone>. Revision 1.3 preserves every 1.2 header as an unchanged prefix and appends the Advanced Insights activation-drivers columns on the right. Revision 1.2 preserves each 1.1 header as an unchanged prefix and appends comparison on the right for Funnel, Retention and Insights; fixed-width 1.1 parsers must upgrade. Without compare the new cell is empty. With fixed A/B compare, rows contain A followed by B and the formula-safe side name; the top-level compatibility copy of A is not duplicated. Funnel includes total and nested breakdown rows for each side. Both sides together count toward the 100000-row limit. Remaining columns are: funnel scope,breakdown,step_index,step_name,value,conversion_previous, conversion_first,avg_seconds_to_step,est_monthly_loss_rub,comparison; retention cohort,cohort_size,period_index,retention,granularity, revenue_ltv_rub,comparison; insights series,period,value,interval, revenue_rub,revenue_avg_rub,comparison; events project_id,event_id,event_name,actor_id,user_id, anon_id,session_id,event_time,server_time,props,url,referrer,utm_source, utm_medium,utm_campaign,device_type,os,browser,country,revenue_rub; paths scope,rank,position,event_route,event,count,share,dropoff; advanced insights mode,warning,estimate,bucket,days,event,actors,total_actors, target_n,n,joint_n,lift,new,current,resurrected,dormant,share, scope,anchor_event,count_gte,within_days,above_n,below_n,above_rate, below_rate,delta_pp,ci_low_pp,ci_high_pp,p_value,q_value,status, eligible_actors,retained_actors,immature_actors,base_retention_rate, threshold_search_truncated,as_of. The activation-drivers columns are empty for the correlations, lifecycle and stickiness modes; that mode emits one population row plus a discovery and a validation row per finding. step_index and period_index are zero-based. Predictable validation, entitlement, limiter, query and row-limit errors are JSON responses before streaming starts and are audited without config/filter values. Before a known discriminator is validated, audit uses the neutral result_csv type. Once the body has started, the status remains 200: no JSON or sentinel row is appended. A transport short write can truncate the final CSV record. Clients must require successful CSV parsing plus an ok X-PP-Export-Status trailer; a missing trailer does not prove success. X-PP-Export-Error-Code describes a partial result to clients that support HTTP trailers. The same 30-second deadline bounds the canonical query, response writes and response finalization.