Export and closure

Your data is yours to take and yours to end: an account export, account closure, a whole-space export, and the space's cap on artifact retention.

Account export

Under Settings → Account, Download my data saves one JSON file, sigbound-account.json, holding everything the installation keeps about you: the profile (id, address, display name, created date), the spaces you belong to and your role in each, your live sessions, your API tokens, your connected harnesses, the sign-in providers linked to the account, and your SSH keys. Credentials appear by name and date, never by value.

curl -H 'Sigbound-Version: 2026-08-14' -H 'Authorization: Bearer $SIGBOUND_TOKEN' \
  https://api.sigbound.com/accounts/me/export > sigbound-account.json

Closing an account

On the same page, type the address you sign in with and choose Close my account. Closure is one transaction:

  • Every membership is revoked, and each space's audit log records the removal with the reason account closed.
  • Every session, API token, connected harness and linked sign-in provider is revoked.
  • Every SSH key is removed.
  • The account is marked closed. Its display name becomes a former member and its address is freed, so a signed merge record or an audit row that named the account keeps naming it, as a former member.

Closure is refused while the account is the only owner of a space: move ownership first, or delete the space. A confirmation that does not match the address is refused with the remedy to type the address you sign in with.

curl -X DELETE -H 'Sigbound-Version: 2026-08-14' -H 'Authorization: Bearer $SIGBOUND_TOKEN' \
  -H 'Content-Type: application/json' -d '{"confirm":"you@example.com"}' \
  https://api.sigbound.com/accounts/me
# 204 on success; last_owner when the account still solely owns a space

Space export

A space owner exports the whole space from Settings → Export as one JSON file, sigbound-<space>.json, streamed section by section: the space, its members (account, address, kind, role), then per repository the goals, the attempts, and the landings, each landing with its signed merge record as the DSSE envelope, then the audit log. Git itself is not in the file: each repository entry links its bundle export, and the page lists a clone line per repository.

The space export page: one button for the whole space as a file, and a clone line for each of the four repositories
Settings → Export: the whole space as one file, and git as a bundle per repository
# the space, minus git
curl -H 'Sigbound-Version: 2026-08-14' -H 'Authorization: Bearer $SIGBOUND_TOKEN' \
  https://api.sigbound.com/orgs/<space>/export > sigbound-<space>.json
# one repository as a git bundle
curl -H 'Sigbound-Version: 2026-08-14' -H 'Authorization: Bearer $SIGBOUND_TOKEN' \
  https://api.sigbound.com/orgs/<space>/repos/<repo>/export > <repo>.bundle

The space export needs the space's admin permission; the bundle needs the repository's. The format field in the file's first section is sigbound.space-export/1.

Artifact retention

A space can cap how long any CI artifact in it is kept, in days from the run that produced it. Zero, the default, means no cap: artifacts stay until their storage partition is retired. Signed merge records and the audit log are never subject to the cap.

curl -X PUT -H 'Sigbound-Version: 2026-08-14' -H 'Authorization: Bearer $SIGBOUND_TOKEN' \
  -H 'Content-Type: application/json' -d '{"artifact_retention_days": 30}' \
  https://api.sigbound.com/orgs/<space>/retention
# 0 is the platform default; 1 to 3650 is a cap; anything else is refused

The setting is shown under the space's Settings and comes back as artifact_retention_days in the space's settings document.