# Export

`User.export(user_id)` returns everything held about the person: their
record and every record that belongs to them, as JSON, one list per
entity, with the same field names as the API. You write nothing for it
beyond calling it:

```jadpo
// domains/accounts/actions/export_my_data.jadpo
/// Gives the signed-in user a copy of everything held about them.
/// The route passes the caller in: `run: export_my_data(current_principal.id)`.
action export_my_data(user_id: User.id) -> PersonalDataExport {
    return User.export(user_id)
}
```

The export covers both the right of access and the right to take your
data elsewhere ("portability", Article 20). Credentials, such as token
hashes, are left out. It also says how long each kind of data is kept and
which companies receive it, taken from the report, because Article 15
asks for that too.

## Who may erase and export

[Policy](policy.md) decides who may call `erase` and `export`.
`export` needs read access to the person's record, and `erase` needs
delete access ([Grants](grants.md)). Once a caller is allowed,
both reach every record that belongs to the person, as purge does,
because a partial export or erasure is worse than none.