Data Exports
There are two ways to export data:
| Method | Where | Use it for |
|---|---|---|
| Table export | The Export button on a table | A one-off file of what a table shows, with your filters. |
| Scheduled blob storage export | Project Settings → Integrations → Blob Storage | A continuous copy of trace data in your own storage, for a warehouse or backup. |
Exports can contain prompt and response content and other sensitive data. Restrict access to the destination and use least-privilege credentials. If Trace input and output is turned off, exports leave that content out.
Table exports
You can export these tables: Traces, Observations, Sessions, Scores, dataset items, Discover AI Users, and, at organization level, Audit Logs.
Filter the table
Apply the filters, search and sort order you want. The export uses them.
Export
Select Export and choose CSV, JSON or JSONL. The export is queued and runs in the background.
Download
When it is ready you get an Export ready notification, and an email if the deployment can send email. Download it from the notification or from Project Settings → Exports. Download links stay valid for one hour. Audit log exports are delivered only by email and notification. Every download is recorded in the audit log.
Project Settings → Exports lists each export with the columns Export, Status (Queued, Processing, Completed, Failed), Format, Created by, Checksum, Log and Download. Checksum is the SHA-256 checksum of the completed file. If an export fails you get an Export failed notification.
Limits: an export holds at most 1,500,000 rows and 25 MB by default (the deployment can change these). Exports of Discover AI users and agents cover at most a 7-day window.
Permissions:
- Creating table exports needs data export access: Owner, Department Admin and Cost Analyst among the built-in roles. Exporting Discover AI user data is Owner only.
- Exporting Traces or Observations, which include prompt and response content, also needs the content permission (
pii:read). Among the built-in roles, only Owner holds both. See Data Privacy. - Viewing Project Settings → Exports needs
batchExports:read(Owner, Department Admin, Cost Analyst). - Exporting audit logs needs audit log access and the
audit-logsentitlement. - If step-up verification is enabled, creating an export asks for an emailed code. See Authentication & Security.
Scheduled blob storage exports
Blob storage exports write a project's traces, observations and scores to your bucket on a schedule.
Needs the scheduled-blob-exports entitlement (Enterprise cloud plan and every self-hosted plan). Viewing the settings needs integrations.destinations:read and changing them needs integrations.destinations:write (Owner among the built-in roles). Changing the destination asks for step-up verification when it is enabled.
Open the settings
Go to Project Settings → Integrations and open Blob Storage.
Choose the destination
| Field | Notes |
|---|---|
| Storage Provider | AWS S3, S3 Compatible Storage or Azure Blob Storage. |
| Bucket Name or Container Name | The destination. |
| Endpoint URL | S3-compatible storage and Azure only. |
| Region | The bucket region. |
| Force Path Style | For S3-compatible storage that needs path-style URLs. |
| Access Key ID and Secret Access Key | For S3. On self-hosted deployments they can be left empty to use the host's credentials, such as an IAM role. |
| Authentication Method | Azure only: Shared Key (Account Key) with the storage account name and key, or Service Principal (Entra ID App) with Tenant ID, Client ID and Client Secret. The service principal needs the Storage Blob Data Contributor role on the container. |
| Export Prefix | Optional folder path inside the bucket. |
Credentials are encrypted at rest.
Choose what and when
| Field | Options |
|---|---|
| Export Frequency | Hourly, Daily or Weekly. |
| File Type | JSONL, CSV or JSON. |
| Export Mode | Full history, Today (from the setup date) or Custom date with an Export Start Date. |
| Filter Attributes to Export | Limits the Standardized Export to the attributes you pick under Attributes to Export. |
Each run writes the raw traces, observations and scores (all columns, unfiltered) plus a Standardized Export: one row per observation with its trace fields and scores attached, ready for analytics tools. Files are written under <prefix><project id>/<dataset>/, with a manifest for each run. The manifest lists every file the run wrote with its SHA-256 checksum. See Run manifests. Scheduled runs stop about 30 minutes before the run time, so late-arriving events are picked up.
Save and test
Turn on Enabled and select Save. Select Validate to upload a small test file and confirm the credentials work.
Run, monitor and reset
- Run Now exports the configured range (from the export mode and start date) up to now, without changing the schedule.
- Re-export All rewrites the whole configured date range with the current attribute selection, so all files share one schema. Use it after changing attributes.
- Reset removes the configuration.
- Status shows when data was last exported. A large backlog is caught up in daily batches.
- Recent Runs lists each scheduled or manual run and its result.
Verify an export
Each export file has a SHA-256 checksum, calculated when the file is written:
| Export | Where the checksum is |
|---|---|
| Table export | The Checksum column in Project Settings → Exports, and the Export ready notification and email |
| Audit log export | The Export ready notification and email |
| Scheduled blob storage export | The run manifest, one checksum per file |
To prove a file has not changed since it was exported, calculate its SHA-256 checksum and compare it with the recorded one. If they match, the file is exactly as ANTS Platform wrote it.
Chain of custody
For each table and audit log export, the audit log records:
- Creation: who created the export, when, and the query and filters it used.
- Download: each download, with the user, the time and the file.
Together with the checksum, these entries show who produced a file, who received it, and that it was not altered. Files copied out of your own bucket after a blob storage export are outside ANTS Platform; use your storage provider's access logs for those.
Hashing of each record at capture is on the roadmap.
Other ways to get data
- The public REST API reads traces, observations, scores and more with a project API key. It follows the Trace input and output setting, so hidden content is not returned.
- Governance reports and evidence packs come from Audit & Export.
Next steps
- Data Retention: export before shortening retention.
- Data Privacy: control what content is visible and exported.