CancelDataExport parity mapping

Supported in:

This guide details the request and response mapping specifications and property parity analysis for migrating from the legacy Backstory Data Export API (CancelDataExport) to the modern Chronicle API (CancelDataExport).

[!NOTE] The legacy Data Export API is deprecated. For more information about exporting data using the modern Chronicle API, see Data Export API (enhanced).

Protocol and mapping overview

Feature Legacy API (CancelDataExport) Modern Chronicle API (CancelDataExport)
HTTP method POST POST
Permissions Partner token or legacy API keys chronicle.googleapis.com/dataExports.cancel

Request payload field-by-field parity

The modern Chronicle API CancelDataExportRequest identifies target resources using canonical Google Cloud resource paths rather than isolated UUIDs.

Legacy field (CancelDataExportRequest) Modern field (CancelDataExportRequest) Field type Parity and migration notes
data_export_id name (in HTTP path) string Google Cloud scoping hierarchy: In the legacy API, data_export_id was passed in the URL path and request body. In the modern API, the request specifies the resource name in the URL path: projects/{project}/locations/{region}/instances/{instance}/dataExports/{id}. The request body is empty.

Response payload field-by-field parity

Both the legacy Backstory Data Export API and modern Chronicle Data Export API return the canceled DataExport resource.

Legacy field (DataExport message) Modern field (DataExport message) Field type Parity and migration notes
data_export_id name string Parity mapped: The legacy export ID is mapped to the final segment of the standard resource path under name.
start_time start_time Timestamp Parity mapped: Start time bounds of the exported event range. Rename to startTime in JSON responses.
end_time end_time Timestamp Parity mapped: End time bounds of the exported event range. Rename to endTime in JSON responses.
log_type include_log_types repeated string Restructured: In the legacy API, log_type specified an individual log type or ALL_TYPES. In the modern API, include_log_types lists specific log type resource names: projects/{project}/locations/{location}/instances/{instance}/logTypes/{log_type}. If omitted, all log types are exported by default. Rename to includeLogTypes in JSON responses.
gcs_bucket gcs_bucket string Parity mapped: Path to the destination Cloud Storage bucket. Rename to gcsBucket in JSON responses.
data_export_status data_export_status Message Parity mapped and restructured: Current status of the export job. Rename to dataExportStatus in JSON responses.
Subfields translate:
• stage → stage (enum mappings: IN_QUEUE, PROCESSING, FINISHED_SUCCESS, FINISHED_FAILURE, CANCELLED)
• error → error
Removed subfield:
• progress_percentage (progressPercentage in JSON) isn't available in the v1 API and isn't populated by the enhanced Data Export API. Callers that poll PROCESSING jobs for progress must instead rely on stage transitions.
New output-only v1 subfields:
• exported_glob_patterns (exportedGlobPatterns in JSON): Glob patterns that match the exported files in the destination bucket.
• data_rbac_filtered (dataRbacFiltered in JSON): Indicates whether the exported data was filtered by data RBAC.
— estimated_volume int64 New field: Estimated volume of the export in bytes. Rename to estimatedVolume in JSON responses.
— exported_volume optional int64 New field: Measured final exported volume in bytes. Rename to exportedVolume in JSON responses.
— create_time Timestamp New field: Timestamp when the job was created. Rename to createTime in JSON responses.
— update_time Timestamp New field: Timestamp of the last status update. Rename to updateTime in JSON responses.
— namespaces repeated string New field: List of feed namespaces used to filter the export (for example, namespace1, namespace2).
— ingestion_labels repeated DataIngestionLabel New field: Ingestion label key-value pairs used to filter the export. Rename to ingestionLabels in JSON responses.

Key differences

  • Google Cloud project scoping integration:
    • Management shifts from querying customer-wide data exports globally to managing individual configuration models under the standard Google Cloud resource tree structure (projects/{project}/locations/{region}/instances/{instance}/dataExports/{id}).
  • Enhanced filtering controls:
    • The modern endpoint replaces single log_type filtering with include_log_types for multiple log types, and adds parameters to filter data exports explicitly by feed namespaces (namespaces) and raw ingestion tags (ingestion_labels).
  • Volume and execution telemetry:
    • Modern responses report estimated and actual exported volumes in bytes (estimated_volume and exported_volume), alongside creation and modification timestamps (create_time, update_time).