--- id: SVC-PFM-QRY-data-exports title: Data exports service module product_area: platform module: queries repository: services-platform source_module: modules/data-exports revision: 1 status: draft design_intent: confirmed implementation_evidence: partially-observed inference: [] source_sha: services-platform: ad3f6a6582843008ed0f5a17b131878d15829af1 react-console: baf6dae382d6f41dce976c7f848667ccc37e076f owns: - DOM-PFM-QRY-004 does_not_own: - >- Queries owns query and report files and schedules; this service owns complete workspace package foundations and coverage. - Integrations owns storage connections and the eventual durable file-delivery binding store. - Operations licensing supplies customer entitlement and allowance records. - Participating applications own their export dataset declarations and extraction behavior. operations: - operation_id: getDataExportCoverage intent: Read active and deferred workspace export declarations with their coverage version. method: 'GET /data_exports/{tenantId}/coverage' access: console permission: platform.data-exports.read realises: - CAP-PFM-QRY-018 published_to_submissions: 'not published: information retrieval' provenance: observed source: 'services-platform:modules/data-exports/aws/api/coverage.routes.ts:getDataExportCoverage' - operation_id: getDataExportsHealth intent: Return this API’s health and deployed service identity. method: GET /data_exports/health access: public permission: 'none: public route' realises: - CAP-PFM-QRY-018 published_to_submissions: 'not published: diagnostic health read' provenance: observed source: 'services-platform:modules/data-exports/aws/api/data-exports.routes.ts:getDataExportsHealth' - operation_id: getDataExportDefinition intent: 'Read workspace package settings and destinations, returning null before initial configuration.' method: 'GET /data_exports/{tenantId}/definition' access: console permission: platform.data-exports.read realises: - CAP-PFM-QRY-018 published_to_submissions: 'not published: information retrieval' provenance: observed source: 'services-platform:modules/data-exports/aws/api/definitions.routes.ts:getDataExportDefinition' - operation_id: saveDataExportDefinition intent: Create or version-check eligible workspace package and notification settings. method: 'PUT /data_exports/{tenantId}/definition' access: console permission: platform.data-exports.manage realises: - CAP-PFM-QRY-018 published_to_submissions: 'not published: console work management' provenance: observed source: 'services-platform:modules/data-exports/aws/api/definitions.routes.ts:saveDataExportDefinition' - operation_id: addDataExportDestination intent: >- Add an enabled storage destination and its current file-delivery binding, within the five-connection limit. method: 'POST /data_exports/{tenantId}/definition/destinations' access: console permission: platform.data-exports.manage realises: - CAP-PFM-QRY-018 published_to_submissions: 'not published: console work management' provenance: observed source: 'services-platform:modules/data-exports/aws/api/definitions.routes.ts:addDataExportDestination' - operation_id: updateDataExportDestination intent: Change a destination’s relative path or enablement using its write version. method: 'PATCH /data_exports/{tenantId}/definition/destinations/{connectionId}' access: console permission: platform.data-exports.manage realises: - CAP-PFM-QRY-018 published_to_submissions: 'not published: console work management' provenance: observed source: >- services-platform:modules/data-exports/aws/api/definitions.routes.ts:updateDataExportDestination - operation_id: removeDataExportDestination intent: Remove the destination and retire its current binding. method: 'DELETE /data_exports/{tenantId}/definition/destinations/{connectionId}' access: console permission: platform.data-exports.manage realises: - CAP-PFM-QRY-018 published_to_submissions: 'not published: console work management' provenance: observed source: >- services-platform:modules/data-exports/aws/api/definitions.routes.ts:removeDataExportDestination - operation_id: requestDataExportExecution intent: 'Admit an eligible workspace request as queued, reserving its single unfinished-execution slot.' method: 'POST /data_exports/{tenantId}/executions' access: console permission: platform.data-exports.execute realises: - CAP-PFM-QRY-018 published_to_submissions: 'not published: console work management' provenance: observed source: 'services-platform:modules/data-exports/aws/api/executions.routes.ts:requestDataExportExecution' - operation_id: listDataExportExecutions intent: Page workspace execution history by status and trigger. method: 'GET /data_exports/{tenantId}/executions' access: console permission: platform.data-exports.read realises: - CAP-PFM-QRY-018 published_to_submissions: 'not published: information retrieval' provenance: observed source: 'services-platform:modules/data-exports/aws/api/executions.routes.ts:listDataExportExecutions' - operation_id: getDataExportExecution intent: 'Read the execution with any package, volume, delivery and notice rows present.' method: 'GET /data_exports/{tenantId}/executions/{id}' access: console permission: platform.data-exports.read realises: - CAP-PFM-QRY-018 published_to_submissions: 'not published: information retrieval' provenance: observed source: 'services-platform:modules/data-exports/aws/api/executions.routes.ts:getDataExportExecution' - operation_id: getDataExportManifest intent: >- Require an existing artifact, then return not implemented because manifest reading is unfinished. method: 'GET /data_exports/{tenantId}/executions/{id}/manifest' access: console permission: platform.data-exports.read realises: - CAP-PFM-QRY-018 published_to_submissions: 'not published: information retrieval' provenance: observed source: 'services-platform:modules/data-exports/aws/api/executions.routes.ts:getDataExportManifest' - operation_id: cancelDataExportExecution intent: 'Require the workspace execution, then return not implemented for cancellation.' method: 'POST /data_exports/{tenantId}/executions/{id}/cancel' access: console permission: platform.data-exports.execute realises: - CAP-PFM-QRY-018 published_to_submissions: 'not published: console work management' provenance: observed source: 'services-platform:modules/data-exports/aws/api/executions.routes.ts:cancelDataExportExecution' - operation_id: downloadDataExportVolume intent: 'Require the workspace execution, then return not implemented for volume download.' method: 'GET /data_exports/{tenantId}/executions/{id}/volumes/{volumeId}/download' access: console permission: platform.data-exports.download realises: - CAP-PFM-QRY-018 published_to_submissions: 'not published: information retrieval' provenance: observed source: 'services-platform:modules/data-exports/aws/api/executions.routes.ts:downloadDataExportVolume' - operation_id: deleteDataExportArtifact intent: 'Require the workspace execution, then return not implemented for early package deletion.' method: 'DELETE /data_exports/{tenantId}/executions/{id}/artifact' access: console permission: platform.data-exports.manage realises: - CAP-PFM-QRY-018 published_to_submissions: 'not published: console work management' provenance: observed source: 'services-platform:modules/data-exports/aws/api/executions.routes.ts:deleteDataExportArtifact' - operation_id: retryDataExportDelivery intent: 'Require the workspace execution, then return not implemented for destination retry.' method: 'POST /data_exports/{tenantId}/executions/{id}/deliveries/{deliveryId}/retry' access: console permission: platform.data-exports.execute realises: - CAP-PFM-QRY-018 published_to_submissions: 'not published: console work management' provenance: observed source: 'services-platform:modules/data-exports/aws/api/executions.routes.ts:retryDataExportDelivery' - operation_id: listHqDataExportExecutions intent: Read cross-workspace execution history under staff filters. method: GET /hq/data_exports/executions access: system permission: hq.data-exports.read realises: - CAP-PFM-QRY-018 published_to_submissions: 'not published: internal staff administration' provenance: observed source: >- services-platform:modules/data-exports/aws/api/hq-data-exports.routes.ts:listHqDataExportExecutions - operation_id: getHqDataExportCoverage intent: 'Read the complete declaration registry, including retired datasets and recorded hashes.' method: GET /hq/data_exports/coverage access: system permission: hq.data-exports.read realises: - CAP-PFM-QRY-018 published_to_submissions: 'not published: internal staff administration' provenance: observed source: >- services-platform:modules/data-exports/aws/api/hq-data-exports.routes.ts:getHqDataExportCoverage - operation_id: getHqDataExportTenantCoverage intent: Compare the workspace’s last execution coverage with the registry version. method: 'GET /hq/data_exports/coverage/tenants/{tenantId}' access: system permission: hq.data-exports.read realises: - CAP-PFM-QRY-018 published_to_submissions: 'not published: internal staff administration' provenance: observed source: >- services-platform:modules/data-exports/aws/api/hq-data-exports.routes.ts:getHqDataExportTenantCoverage - operation_id: getHqDataExportEntitlements intent: Read active and past customer export entitlements and applicable workspace overrides. method: GET /hq/data_exports/entitlements access: system permission: hq.data-exports.read realises: - CAP-PFM-QRY-018 published_to_submissions: 'not published: internal staff administration' provenance: observed source: >- services-platform:modules/data-exports/aws/api/hq-data-exports.routes.ts:getHqDataExportEntitlements - operation_id: reconcileCoverageAtActivation intent: >- Reconcile accepted participant declarations after catalog activation without blocking the release on conflict. method: in-process at manifest activation (commitCatalog) access: internal permission: 'none: release-time' realises: - CAP-PFM-QRY-018 published_to_submissions: 'not published: internal processing interface' provenance: observed source: >- services-platform at ad3f6a6: modules/data-exports/aws/api/*.routes.ts (imported), aws/logic/data-exports-api.lambda.ts, services/**, db/*.table.ts, data-exports.settings.ts; docs/data-exports.md; docs/proposals/tenant-data-export/ (decisions of 2026-10-18) - operation_id: dataExportsLifecycleParticipants intent: 'Purge export bytes and history before settings on deletion, retaining settings on reset.' method: workspace lifecycle participants platform.data-exports and platform.data-export-history access: internal permission: 'none: invoked by the lifecycle jobs' realises: - CAP-PFM-QRY-018 published_to_submissions: 'not published: internal processing interface' provenance: observed source: >- services-platform at ad3f6a6: modules/data-exports/aws/api/*.routes.ts (imported), aws/logic/data-exports-api.lambda.ts, services/**, db/*.table.ts, data-exports.settings.ts; docs/data-exports.md; docs/proposals/tenant-data-export/ (decisions of 2026-10-18) events: [] jobs: - >- A package-generation job type and step catalog are registered, but no deployed dispatcher or state machine creates its executions. integrations: - system: Integration Platform bindings direction: outbound contract: >- Destination changes create or retire definition-scoped file-delivery bindings through the temporary in-memory adapter. - system: Data exports bucket direction: outbound contract: >- The bucket separates published artifact prefixes from three-day staging retention and does not retain object versions. - system: Security audit events direction: outbound contract: >- Security audit records commit with implemented settings, destination, admission and early-deletion helper writes. consistency: - rule: >- Execution admission and its security audit commit together under the one-active workspace restriction. kind: transactional compensation: Rejected admission creates no execution. - rule: >- Destination and audit rows commit in the database, while the current binding adapter modifies process memory separately. kind: transactional compensation: No durable rollback or restart persistence is established for those bindings. - rule: 'Package processing is intended to follow admission, but no runner currently performs it.' kind: eventual compensation: Queued execution has no implemented customer cancellation or automatic settlement. - rule: Coverage follows accepted release declarations when reconciliation succeeds. kind: eventual compensation: Conflicts are logged and counted without failing activation; old coverage can remain. evidence: - >- services-platform at ad3f6a6: modules/data-exports/aws/api/*.routes.ts (imported), aws/logic/data-exports-api.lambda.ts, services/**, db/*.table.ts, data-exports.settings.ts; docs/data-exports.md; docs/proposals/tenant-data-export/ (decisions of 2026-10-18) - 'react-console at baf6dae: components/data-management/data-exports/*.tsx' controls: [TC-AVL-001, TC-AVL-004, TC-AVL-005, TC-AZ-001, TC-AZ-002, TC-AZ-003, TC-AZ-004, TC-AZ-005, TC-CHG-001, TC-CHG-002, TC-CHG-003, TC-CHG-004, TC-CHG-005, TC-CHG-006, TC-CRY-001, TC-CRY-002, TC-CRY-003, TC-CRY-004, TC-DAT-001, TC-DAT-002, TC-DAT-003, TC-DAT-004, TC-DAT-005, TC-IAM-001, TC-IAM-002, TC-IAM-003, TC-IAM-004, TC-IAM-005, TC-IAM-006, TC-LOG-001, TC-LOG-002, TC-LOG-003, TC-LOG-004, TC-LOG-005, TC-MON-001, TC-MON-003, TC-PI-001, TC-PI-002, TC-PI-003, TC-PI-004, TC-PI-005, TC-TEN-001, TC-TEN-002, TC-TEN-003, TC-VEN-001, TC-VEN-002, TC-VEN-003] --- # Data exports service module ## What This Service Is For Data Exports implements workspace settings, destinations, execution admission, history and the export coverage registry. The deployed boundary stops before package generation. ## Boundary Applications supply export declarations, Integrations supplies connection behavior, and licensing supplies allowance records. Query and report file delivery belongs to the query service. ## Operations in Words Customers can configure settings, request an eligible execution and inspect it. Cancellation, volume download, early deletion, retry and manifest retrieval retain explicitly unfinished responses. Staff reads inspect history, coverage and entitlements. ## Events and Jobs No events are declared and no package-generation workflow is deployed. A registered job type documents the later orchestration seam without making it operational. ## Consistency Guarantees Admission is durable and occupies one active slot. Destination bindings remain process-local, coverage reconciliation tolerates conflicts, and no completed-package compensation is implemented.