Data export & privacy

Use this page when you need a copy of your data in a portable format (for a spreadsheet, an audit or a GDPR request), want staqly to clean up old data on its own, or must erase something for good. All of it works the same with the binary and with Docker. For a restorable copy of the whole installation, use Backup & restore instead.

On Staqly Cloud, every plan can export the whole workspace. On Starter the ZIP is data only: everything below except the media files (includes_media: false). The ZIP with the files and the activity log export come with Plus and above: on Starter GET /v1/events/export answers 402 plan_limit_exceeded. The Community Edition always gets everything.

Export the activity logCopy Anchor Link

Download the activity log as NDJSON or CSV in one streamed request:

curl -s -H "Authorization: Bearer $STAQLY_API_KEY" "http://localhost:3333/v1/events/export?format=csv&type_prefix=post.&from=2026-01-01" -o events.csv

All parameters:

GET /v1/events/export?format=ndjson|csv&from=&to=&type=&type_prefix=&actor_type=&actor_id=&collection_id=&post_id=

• Scope events:read (dashboard sessions work too). Events come oldest first and the response is streamed, so a log of any size exports without paging.
• Credential and session audit events (api_key.*, session.*, recovery_key.*, access_token.*, sign_in_method.*, device.*, device_link.*) are included only for admins (dashboard sessions, the Community Edition's access token, keys with admin); other keys get the rest of the log.
• from is inclusive, to exclusive (RFC 3339 or YYYY-MM-DD). type is an exact match; type_prefix a literal prefix such as post..
• JSONL (format=ndjson, also called NDJSON; saved as .jsonl): one JSON event per line, the same shape as GET /v1/events. Not one JSON array, so a large log can be read line by line.
• CSV columns: created_at,id,type,actor_type,actor_id,actor_name,collection_id,post_id,data (data is the event's JSON). RFC 4180 quoting with CRLF line endings; cells starting with =, +, -, @, tab or CR get a leading ' so spreadsheets don't run them as formulas.

Export the whole workspaceCopy Anchor Link

For data portability (GDPR), a ZIP of everything in the workspace (without the media files on the Starter plan):

A data-only export (Starter) has no media/ folder and no media_files on posts; its workspace.json and README.txt say so. API keys, sessions, the recovery key and channel credentials are never exported. The archive is built from live data page by page, not as one snapshot — for a point-in-time copy take a backup. workspace.export_requested and workspace.exported events are recorded.

RetentionCopy Anchor Link

To have staqly delete old data automatically, set these environment variables. A daily worker (first run one minute after start) deletes old data:

• Events can't be changed (a trigger blocks UPDATE); retention only deletes whole events. An event with a still-pending delivery is kept until it finishes, so webhooks stay at-least-once.
• Done jobs of the queue are deleted after 7 days without a setting.

Purge a postCopy Anchor Link

DELETE /v1/posts/{id} removes the post, but its events, which hold snapshots of it, stay. POST /v1/posts/{id}/purge (scope admin; Delete post → Also erase its history in the dashboard) removes the history too:

• the post and its targets;
• every event about it and their webhook deliveries, even pending ones;
• its media files, unless another post uses them;
• cached idempotent responses containing it; finished workspace exports are expired.

{ "post_id": "post_oalirbz67y4m4cqxq5dw", "events_deleted": 4, "media_deleted": 1 }

A single post.purged event with only IDs and counts is recorded.

Delete a workspace (Staqly Cloud)Copy Anchor Link

DELETE /v1/workspace with {"confirm": "<exact workspace name>"} permanently deletes the workspace and everything in it (collections, posts, channels, schedules, media files, events, webhooks, alerts, API keys, sessions and exports) and signs every session out.

• Only a signed-in dashboard session can do it. API keys get 403, even with admin, so a leaked automation key can't destroy a workspace.
• A wrong or missing confirm returns 422. Other workspaces are unaffected. Earlier database backups still contain the data.
• A live subscription is canceled right away.

The Community Edition returns 409: the installation has exactly one workspace. To remove all data, stop staqly and delete its data, as the Delete all data card in Settings → Data & privacy shows:

staqly service uninstall          # only if you installed the background service
rm -rf ~/.local/share/staqly      # or your --data directory

Next stepsCopy Anchor Link