Bulk export agent-based policies and vulnerabilities with the API

Overview

Using the Bulk Export API, you can bulk export your agent-based policies, asset, vulnerabilities and asset, or vulnerabilty remediation data using a GraphQL API. The data is returned in Parquet  format and can be downloaded for use in your business intelligence tools.

To bulk export API data to Parquet files, complete the following tasks:

1. Gather the information required to make a request
2. Make a request
3. Check the status of the export
4. Download the files

Task 1: Gather required information

To sucessfully run a Bulk Export request, you will need multiple pieces of information:

1. An API key to authorize the request
2. The relevant URI for your region
3. The mutation for the data you want to export

As you complete task 1, copy the information you get somewhere safe for use in task 2.

Gain authorization

Authorization is performed by passing your API key using the X-Api-Key header parameter. The API key must be passed with all requests. To learn how to generate and manage API keys, see Managing Platform API Keys .

Select your region

Select the URI that matches the region associated with the API key you obtained for authorization.

Select export type

Select a mutation based on the data you require:

mutation CreatePolicyExport { 
    createPolicyExport(input:{}) {
        id
    }
}

mutation CreateVulnerabilityExport { 
    createVulnerabilityExport(input:{}) {
        id
    }
}

mutation CreateVulnerabilityRemediationExport($input: VulnerabilityRemediationExportConfiguration!) { 
    createVulnerabilityRemediationExport(input: $input) 
        {
            id
        }
}

{
  "input": {
    "startDate": "2025-08-03",
    "endDate": "2025-08-24" 
  }
}

Task 2: Make a request

Now that you have the required information from task 1, you can make a request to retrieve the URLs to download Parquet files.

To make a request:

1. In Postman, click the three dots beside the relevant Collection and select Add Request.
2. Change the query to POST using the dropdown in the query bar.
3. Paste the region URI from task 1.
4. Go to the Headers tab.
   1. Paste X-Api-Key into the Key column.
   2. Paste the API key from task 1 into the Value column.
5. Go to the Body tab.
   1. Select GraphQL from the options at the top of the tab.
   2. In the Query section, paste the mutation you selected in task 1.
6. Click Send in the query bar. This will begin to run the request.
7. Under Body you will see a response, where EXAMPLEID will be a unique string:

{
    "data": {
        "createvulnerabilityExport": {
            "id" : "EXAMPLEID"
            }
    }
}

Copy this ID and keep it somewhere safe for use in task 3.

Task 3: Check the status of the export

Once you have run the initial request in task 2, you will need to create an additional request to check the status of the export. This allows you to verify that the initial request ran successfully and to access the URLs you need to download to export the data.

To check the export status:

1. In Postman, click the three dots beside the relevant Collection and select Add Request.
2. Change the query to GET using the dropdown in the query bar.
3. Paste the region URI from task 1.
4. Go to the Headers tab.
   1. Paste X-Api-Key into the Key column.
   2. Paste the API key from task 1 into the Value column.
5. Go to the Body tab.
   1. Select GraphQL from the options at the top of the tab.
   2. In the Query section, paste this query, replacing EXAMPLEID with the unique string you copied in task 2.

query GetExport {
    export(id: "EXAMPLEID"){
        id
        status
        dataset
        timestamp
        result {
             prefix
             urls
       }
    }
}

6. Click Send in the query bar. This will begin to run the request.
7. Under Body you will see a response which will outline the status of the initial request from task 2.

Task 4: Download the Parquet files

Once the status of the request from task 3 becomes SUCCEEDED, you will see mutliple URLs listed, each with a prefix value.

Each prefix will outline what data is included in that URL, for example the URL tied to "prefix": "asset" will be an export of asset data.

You may have more than one URL relating to one prefix. This is dependant on the size of your environment and the amount of information contained in the export.

• Each time download URLs are generated, they remain valid for 15 minutes. Within this window, files can be downloaded as many times as needed.
• These URLs can be regenerated at any time within 30 days of the initial request.
• Exported files are retained for 30 days. After that, attempts to access the files will result in an error.

Parquet files

These schemas provide an overview of the fields returned in the files at the URLs provided:

Agent-based policy export

Vulnerability export

Vulnerability remediations export