GET /api/me/export
Everything the platform holds about the signed-in person, as one JSON file.
The PDPA gives a data subject the right to see what is held about them. An access request that takes a fortnight and a support ticket is a right on paper only, so this answers it in one request.
Authentication
The caller's own session cookie. There is no token, no parameter and no way to ask for somebody else — the response is assembled from the signed-in user's id and their own attendee rows, and nothing is read from the request.
Not signed in returns 401.
Response
GET /api/me/export is owned directly by the API. It returns 200 with
content-type: application/json,
content-disposition: attachment; filename="xperience-my-data.json", and
cache-control: private, no-store.
| Field | Concrete content |
|---|---|
exported_at | Export timestamp. |
account | id, nullable email/phone, and creation timestamp for the actor. |
profile | Nullable display name, normalised phone, birth date, gender, consent timestamps, onboarding, creation, and deletion timestamps. |
interests | Category id, selection timestamp, and nullable category name. |
registration_details | One organiser-scoped attendee row: identity fields, consent, profile details, and lifecycle timestamps. |
registrations | Status, event/ticket ids, event summary, and signed tickets. |
stall_orders | Historical vendor purchases retained for privacy export and financial reconciliation; no new stall ordering is available in API 2.0.0. |
points | Point kind, signed integer amount, note, timestamp, and nullable event. |
giveaway_entries | Giveaway, entry/win timestamps, and nullable giveaway summary. |
team_memberships | Live or historical organiser role, timestamp, and nullable organisation summary. |
registration_details is one row per organiser to which the person supplied
attendee details. That is where the name and phone visible to that organiser
are stored, rather than on an event-global attendee identity.