GetDataExport parity mapping

Supported in:

This guide details the request and response mapping specifications and property parity analysis for migrating from the legacy Backstory Data Export API (GetDataExport) to the modern Chronicle API (GetDataExport).

[!NOTE] The legacy Data Export API is deprecated. For more information about exporting data using the modern Chronicle API, see Data Export API (enhanced).

Protocol and mapping overview

Feature Legacy API (GetDataExport) Modern Chronicle API (GetDataExport)
HTTP method GET GET
Permissions Partner token or legacy API keys chronicle.googleapis.com/dataExports.get

Request payload field-by-field parity

The modern Chronicle API GetDataExportRequest identifies target resources using canonical Google Cloud resource paths rather than isolated UUIDs.

Legacy field (GetDataExportRequest) Modern field (GetDataExportRequest) Field type Parity and migration notes
data_export_id name (in HTTP path) string Google Cloud scoping hierarchy: In the legacy API, the target export was identified globally by data_export_id. In the modern API, the request specifies the resource name in the URL path: projects/{project}/locations/{region}/instances/{instance}/dataExports/{id}. The request body is empty.

Response payload field-by-field parity

Both the legacy Backstory Data Export API and modern Chronicle Data Export API return the retrieved DataExport resource.

Legacy field (DataExport message) Modern field (DataExport message) Field type Parity and migration notes
data_export_id name string Parity mapped: The legacy export ID is mapped to the final segment of the standard resource path under name: projects/{project}/locations/{region}/instances/{instance}/dataExports/{id}.
start_time start_time Timestamp Parity mapped: Start time bounds of the exported event range. Rename to startTime in JSON responses.
end_time end_time Timestamp Parity mapped: End time bounds of the exported event range. Rename to endTime in JSON responses.
log_type include_log_types repeated string Restructured: In the legacy API, log_type specified an individual log type or ALL_TYPES. In the modern API, include_log_types lists specific log type resource names: projects/{project}/locations/{location}/instances/{instance}/logTypes/{log_type}. If omitted, all log types are exported by default. Rename to includeLogTypes in JSON responses.
gcs_bucket gcs_bucket string Parity mapped: Path to the destination Cloud Storage bucket. Rename to gcsBucket in JSON responses.
data_export_status data_export_status Message Parity mapped and restructured: Current status of the export job. Rename to dataExportStatus in JSON responses.
Subfields translate:
• stage → stage (enum mappings: IN_QUEUE, PROCESSING, FINISHED_SUCCESS, FINISHED_FAILURE, CANCELLED)
• error → error
Removed subfield:
• progress_percentage (progressPercentage in JSON) isn't available in the v1 API and isn't populated by the enhanced Data Export API. Callers that poll PROCESSING jobs for progress must instead rely on stage transitions.
New output-only v1 subfields:
• exported_glob_patterns (exportedGlobPatterns in JSON): Glob patterns that match the exported files in the destination bucket.
• data_rbac_filtered (dataRbacFiltered in JSON): Indicates whether the exported data was filtered by data RBAC.
— estimated_volume int64 New field: Estimated volume of the export in bytes. Rename to estimatedVolume in JSON responses.
— exported_volume optional int64 New field: Measured final exported volume in bytes upon job completion. Rename to exportedVolume in JSON responses.
— create_time Timestamp New field: Timestamp when the job was created. Rename to createTime in JSON responses.
— update_time Timestamp New field: Timestamp of the last status update. Rename to updateTime in JSON responses.
— namespaces repeated string New field: List of feed namespaces used to filter the export (for example, namespace1, namespace2).
— ingestion_labels repeated DataIngestionLabel New field: Ingestion label key-value pairs used to filter the export. Rename to ingestionLabels in JSON responses.

Key differences

  • Google Cloud project scoping integration:
    • Target data exports are identified using canonical Google Cloud resource paths (projects/{project}/locations/{region}/instances/{instance}/dataExports/{id}) rather than global UUIDs.
  • Volume and execution telemetry:
    • Modern responses report estimated and actual exported volumes in bytes (estimated_volume and exported_volume), alongside creation and modification timestamps (create_time, update_time).
  • Enhanced filtering controls:
    • The modern endpoint returns detailed filter configurations, including multiple log types (include_log_types), namespace arrays (namespaces), and raw ingestion tags (ingestion_labels).