> ## Documentation Index
> Fetch the complete documentation index at: https://docs.myrqen.cc/llms.txt
> Use this file to discover all available pages before exploring further.

# Export a synced report

> Downloads resolve the **same** projection the page uses and then render, so no format is a bypass. The response is an attachment.



## OpenAPI

````yaml /api-reference/openapi.json get /api/v1/reports/{id}/export/{format}
openapi: 3.1.0
info:
  title: Myrqen API
  version: 1.0.0
  description: >-
    The JSON API served by `apps/web` under `/api/v1`. Derived from the route
    handlers in `apps/web/app/api/v1` and the shared types in
    `packages/contracts`.


    This reference documents the surface a developer and the Myrqen CLI actually
    use. Platform-administration and billing endpoints exist in the application
    but are operator-only and are deliberately not published here.


    The hosted service at `https://api.myrqen.cc` is not deployed yet. Run your
    own deployment and use its origin.
  license:
    name: Myrqen Source-Available Licence 1.0
    url: https://github.com/stijnswapped/Myrqen/blob/main/LICENSE
servers:
  - url: http://localhost:3000
    description: >-
      A deployment you run yourself. Use this while the hosted service is
      unavailable.
  - url: https://api.myrqen.cc
    description: >-
      The hosted API. This is the CLI's shipped default, but the hosted service
      is NOT deployed yet, so requests to it do not resolve today.
security: []
tags:
  - name: Health
    description: >-
      Liveness and readiness probes. Unauthenticated, and answered on any
      hostname.
  - name: Authentication
    description: Browser sessions. Password plus recovery codes; no email is ever sent.
  - name: Device linking
    description: Binding a machine's CLI to an account, via browser approval.
  - name: Workspaces and projects
    description: Where a scanned repository belongs.
  - name: Sync and quota
    description: Creating, feeding, and finalizing a cloud report.
  - name: Reports
    description: Reading and exporting a synced report.
  - name: Sharing
    description: Share links and the server-side projections they resolve to.
  - name: Analytics
    description: Allowlisted product-event ingest.
  - name: Updates
    description: The signed release manifest.
paths:
  /api/v1/reports/{id}/export/{format}:
    get:
      tags:
        - Reports
      summary: Export a synced report
      description: >-
        Downloads resolve the **same** projection the page uses and then render,
        so no format is a bypass. The response is an attachment.
      operationId: exportReport
      parameters:
        - $ref: '#/components/parameters/ReportId'
        - $ref: '#/components/parameters/ExportFormat'
      responses:
        '200':
          description: The rendered report.
          content:
            text/html:
              schema:
                type: string
            text/markdown:
              schema:
                type: string
            application/json:
              schema:
                type: object
        '400':
          $ref: '#/components/responses/BadRequest'
        '404':
          $ref: '#/components/responses/NotFound'
        '410':
          $ref: '#/components/responses/Gone'
      security:
        - sessionCookie: []
components:
  parameters:
    ReportId:
      name: id
      in: path
      required: true
      schema:
        type: string
      description: The cloud report id.
    ExportFormat:
      name: format
      in: path
      required: true
      schema:
        type: string
        enum:
          - html
          - json
          - markdown
          - sarif
  responses:
    BadRequest:
      description: >-
        `BAD_REQUEST`. Also returned with HTTP 413 when a body exceeds the
        endpoint's byte limit.
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/ApiError'
    NotFound:
      description: >-
        `NOT_FOUND` — the resource does not exist, or exists and you may not
        know that.
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/ApiError'
    Gone:
      description: >-
        `REPORT_EXPIRED` or `DEVICE_LINK_EXPIRED` — the resource passed its
        window and its contents were deleted.
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/ApiError'
  schemas:
    ApiError:
      type: object
      required:
        - error
      properties:
        error:
          type: object
          required:
            - code
            - message
            - requestId
          properties:
            code:
              $ref: '#/components/schemas/ApiErrorCode'
            message:
              type: string
              description: Human-readable. May change; branch on `code`.
            requestId:
              type: string
              description: A fresh UUID per response, for correlating with server logs.
            details:
              type: object
              additionalProperties: true
      example:
        error:
          code: SYNC_WEEKLY_LIMIT_REACHED
          message: Cloud report limit reached. This scan stays local.
          requestId: 8f14e45f-ceea-467a-9f8b-2b6b2b6a1f2c
          details:
            weekly:
              used: 15
              limit: 15
              resetsAt: '2026-08-24T06:00:00.000Z'
    ApiErrorCode:
      type: string
      enum:
        - BAD_REQUEST
        - VALIDATION_FAILED
        - UNAUTHENTICATED
        - FORBIDDEN
        - NOT_FOUND
        - CONFLICT
        - RATE_LIMITED
        - INTERNAL
        - DEVICE_LINK_EXPIRED
        - DEVICE_LINK_ALREADY_CONSUMED
        - DEVICE_LINK_NOT_APPROVED
        - DEVICE_REVOKED
        - SYNC_DAILY_LIMIT_REACHED
        - SYNC_WEEKLY_LIMIT_REACHED
        - REPORT_EXPIRED
        - REPORT_SCHEMA_UNSUPPORTED
        - UNSAFE_PAYLOAD_REJECTED
        - SHARE_PASSWORD_REQUIRED
        - SHARE_NOT_AVAILABLE
        - CLIENT_VERSION_REVOKED
        - CLIENT_VERSION_TOO_OLD
        - SUPPORT_GRANT_REQUIRED
  securitySchemes:
    sessionCookie:
      type: apiKey
      in: cookie
      name: myrqen_session
      description: >-
        Browser session cookie: `httpOnly`, `sameSite=lax`, `Secure` when
        `APP_BASE_URL` is https, 30-day lifetime. Deliberately separate from CLI
        device credentials.

````