CreateDataExport parity mapping

Supported in:

This guide details the request and response mapping specifications and property parity analysis for migrating from the legacy Backstory Data Export API (CreateDataExport) to the modern Chronicle API (CreateDataExport).

[!NOTE] The legacy Data Export API is deprecated. For more information about exporting data using the modern Chronicle API, see Data Export API (enhanced).

Protocol and mapping overview

Feature Legacy API (CreateDataExport) Modern Chronicle API (CreateDataExport)
HTTP method POST POST
Permissions Partner token or legacy API keys chronicle.googleapis.com/dataExports.create

Request payload field-by-field parity

The modern Chronicle API CreateDataExportRequest requires scoping under a parent Google Cloud instance path and introduces advanced multi-value filtering.

In the modern CreateDataExportRequest proto, the export properties are nested inside a DataExport data_export message (for example, data_export.start_time). In HTTP JSON requests, the data_export message is sent as the request body (body: "data_export"), so its fields appear at the top level of the JSON payload (for example, startTime).

Legacy field (CreateDataExportRequest) Modern field (CreateDataExportRequest) Field type Parity and migration notes
— parent (in HTTP path) string Google Cloud scoping hierarchy: Scopes the export job under the target instance in the request URL: projects/{project}/locations/{region}/instances/{instance}.
start_time data_export.start_time Timestamp Mapped with new validation: Start (inclusive) of the event time range. Optional in the legacy API (defaults to the UNIX epoch); required in the modern API. The value is floored to the hour. Rename to startTime in JSON payloads.
end_time data_export.end_time Timestamp Mapped with new validation: End (exclusive) of the event time range. Optional in the legacy API (defaults to the current time); required in the modern API. The value is floored to the hour, and the export window (end_time - start_time) must be at least one hour. Ranges shorter than one hour don't export any data. Rename to endTime in JSON payloads. For more information, see Minimum time range for export timestamps.
log_type data_export.include_log_types string → repeated string Restructured (type change): In the legacy API, log_type was a single string that specified an individual log type or ALL_TYPES. In the modern API, include_log_types is a repeated string that specifies a list of log type resource names (projects/{project}/locations/{location}/instances/{instance}/logTypes/{log_type}). If omitted, all log types are exported by default. Rename to includeLogTypes in JSON payloads.
gcs_bucket data_export.gcs_bucket string Mapped with new permissions: Path to the destination Cloud Storage bucket (projects/{project}/buckets/{bucket}). Rename to gcsBucket in JSON payloads.
• Service account change: Instead of granting bucket IAM permissions to the legacy data export service account, grant them to the per-project Chronicle service agent returned by FetchServiceAccountForDataExport (service-{project_number}@gcp-sa-chronicle.).
• Region: As in the legacy API, the destination bucket must be in the same region or multi-region as the Google SecOps instance.
— data_export.namespaces repeated string New field: List of feed namespaces used to filter exported data.
— data_export.ingestion_labels repeated DataIngestionLabel New field: List of ingestion label key-value pairs used to filter exported data. Rename to ingestionLabels in JSON payloads.

Response payload field-by-field parity

Both the legacy Backstory Data Export API and modern Chronicle Data Export API return the created DataExport resource.

Legacy field (DataExport message) Modern field (DataExport message) Field type Parity and migration notes
data_export_id name string Parity mapped: The legacy export ID is mapped to the final segment of the standard resource path under name: projects/{project}/locations/{region}/instances/{instance}/dataExports/{id}.
start_time start_time Timestamp Parity mapped: Start time bounds of the exported event range. Rename to startTime in JSON responses.
end_time end_time Timestamp Parity mapped: End time bounds of the exported event range. Rename to endTime in JSON responses.
log_type include_log_types repeated string Restructured: In the legacy API, log_type specified an individual log type or ALL_TYPES. In the modern API, include_log_types lists specific log type resource names: projects/{project}/locations/{location}/instances/{instance}/logTypes/{log_type}. If omitted, all log types are exported by default. Rename to includeLogTypes in JSON responses.
gcs_bucket gcs_bucket string Parity mapped: Path to the destination Cloud Storage bucket. Rename to gcsBucket in JSON responses.
data_export_status data_export_status Message Parity mapped and restructured: Status of the export job. Rename to dataExportStatus in JSON responses.
Subfields translate:
• stage → stage (enum mappings: IN_QUEUE, PROCESSING, FINISHED_SUCCESS, FINISHED_FAILURE, CANCELLED)
• error → error
Removed subfield:
• progress_percentage (progressPercentage in JSON) isn't available in the v1 API and isn't populated by the enhanced Data Export API. Callers that poll PROCESSING jobs for progress must instead rely on stage transitions.
New output-only v1 subfields:
• exported_glob_patterns (exportedGlobPatterns in JSON): Glob patterns that match the exported files in the destination bucket.
• data_rbac_filtered (dataRbacFiltered in JSON): Indicates whether the exported data was filtered by data RBAC.
— estimated_volume int64 New field: Estimated volume of the export in bytes at job creation time. Rename to estimatedVolume in JSON responses.
— exported_volume optional int64 New field: Measured final exported volume in bytes upon job completion. Rename to exportedVolume in JSON responses.
— create_time Timestamp New field: Timestamp when the job was created. Rename to createTime in JSON responses.
— update_time Timestamp New field: Timestamp of the last status update. Rename to updateTime in JSON responses.
— namespaces repeated string New field: List of feed namespaces used to filter the export (for example, namespace1, namespace2).
— ingestion_labels repeated DataIngestionLabel New field: Ingestion label key-value pairs used to filter the export. Rename to ingestionLabels in JSON responses.

Key differences

  • Google Cloud project scoping integration:
    • Scoped natively under the Google Cloud resource tree structure (projects/{project}/locations/{region}/instances/{instance}/dataExports).
  • Export filtering enhancements:
    • Adds the capability to target multiple distinct log types in one run using include_log_types, and configure fine-grained namespace (namespaces) and ingestion label (ingestion_labels) filters.
  • Time range granularity:
    • start_time and end_time are required and are floored to the hour, and the export window must be at least one hour. Ranges shorter than one hour don't export any data.
  • Destination bucket IAM and regional co-location:
    • Callers must fetch their per-project Chronicle service agent by calling FetchServiceAccountForDataExport and grant it Cloud Storage bucket permissions, replacing the legacy data export service account.
    • The destination bucket must reside in the same region or multi-region as the Google SecOps instance.
  • Data RBAC scope filtering:
    • Exported logs are scoped to the data RBAC permissions of the caller. If any data is excluded because of data RBAC, data_export_status.data_rbac_filtered (dataExportStatus.dataRbacFiltered in JSON) is set to true.
  • Companion v1 endpoints and retired ListAvailableLogTypes:
  • Volume and execution telemetry:
    • Modern responses report estimated and actual exported volumes in bytes (estimated_volume and exported_volume), alongside creation and modification timestamps (create_time, update_time).