# Compliance export

One zip with every record in a period, or for one person, or of one kind, with the consent records and the verifier, ready for an auditor or an issuer’s information request.

Status: Live · Updated: 2026-09-14
For: agent
Source: https://enruta.ai/docs/compliance-export

An export is what leaves Enruta when somebody outside it needs proof: the auditor at year end, an issuer asking for the material behind a disputed payment, a regulator asking who authorized an agent. It contains the records, their bundles, the consents and the verifier, and nothing in it depends on Enruta being online.

## Request one

```http
POST /v0/exports          Authorization: Bearer enruta_dev_… (or an auditor key)
{
  "from": "2026-09-01", "to": "2026-09-30",
  "principal_login_id": "halvern/dana.reyes@halvernrobotics.com",   // optional: one person's records
  "kinds": "all",                                   // optional: or ["payment", "reversal", "consent_record"]
  "consents": true                                  // optional: include the sealed consent records
}
→ 202 { "id": "exp_01M2H4W7Q2T9K5N3B8D1H6XRS" }

GET /v0/exports/exp_01M2H4W7Q2T9K5N3B8D1H6XRS         → { "state": "ready", "download_url": "…" }
GET /v0/exports/exp_01M2H4W7Q2T9K5N3B8D1H6XRS/download → application/zip
```

Without the three optional fields the export is exactly the v0 export: the payment records of the period. `enruta records export --from --to --out` does the same from the terminal, and the export panel on `/records` in the console offers the same options.

## What is in the zip

| Path | Contents |
|---|---|
| `rec_….json`, `rec_….bundle.json` | Every payment record in range with its bundle |
| `linked/rec_….json`, `linked/rec_….bundle.json` | Every linked record in range: reversals, dispute packets and outcomes, settlement records, reconciliation lines and reports, attestations, recurrences, pauses |
| `consents/cns_….json` | The sealed consent records, when `consents: true` |
| `checkpoints/<date>.json` | The signed daily roots the records are included in |
| `enruta-verify.mjs`, `evidence-record.schema.json` | The verifier and the schema, the versions that sealed these records |
| `README.md` | The layout, and the verify command |

```bash
npx enruta-verify ./export-2026-09/
# 47 records: 41 payment, 3 reversal, 1 settlement_record, 1 reconciliation_line, 1 reconciliation_report
# chain ok  #1 → #47, 2 checkpoints, 0 gaps
# PASS
```

## Retention

Records are kept for the plan’s retention period: 13 months on Free, 540 days on Developer and Scale, 24 months on Vendor and Enterprise. Contracts state the minimum a paid plan keeps: 540 days for card rails, the longest dispute window, and 730 days for ACH consent records. Every plan exports on expiry, and a record you hold keeps verifying after you leave.

## Two requests it answers

- **An issuer’s information request.** For the $168.40 payment of 2026-09-09, the export of that day, filtered to the approver’s login id, contains the consent, the mandate, the record and the bundle; the issuer runs the verifier. The card-rail retention keeps that record until at least March 2028.
- **A revocation.** A person revokes an agent’s consent on 2027-02-15; the export shows the consent record, the revocation record chained to it, and that every mandate after it was denied with `consent_revoked`. For a consumer, `institution_notified_at` marks the moment the institution was told.