Amplitude Export API

openapi: 3.2.0
info:
  title: Amplitude Public Export API
  version: '2026-10-05'
  summary: Event ingestion, analytics, taxonomy, export, async DSAR jobs, and agent-readable site content APIs for Amplitude.
  description: 'Amplitude is a digital analytics platform covering product analytics, experimentation, session replay, web analytics, and CDP capabilities.


    This document describes the public HTTP surface most useful to programmatic clients and AI agents:


    - **Ingestion** (`api2.amplitude.com`) — send events. Authenticated with a project API key in the request body.

    - **Analytics, Taxonomy, Export, Cohorts** (`amplitude.com/api`) — read and manage project data. Authenticated with HTTP Basic using a project API key and secret key.

    - **DSAR** (`amplitude.com/api/2/dsar`) — export a user’s data. Authenticated with HTTP Basic using the organization API key and organization secret key, not project credentials.

    - **Site content** (`amplitude.com`) — Markdown and index representations of amplitude.com pages, for retrieval-augmented and agent use.


    For conversational access to Amplitude data, prefer the Amplitude MCP server (`https://mcp.amplitude.com/mcp`, OAuth 2.0) over these REST APIs. For public documentation, use the read-only Docs MCP server (`https://amplitude.com/docs/api/mcp`).


    The full catalog of Amplitude’s agent-callable resources is published at https://amplitude.com/.well-known/ai-catalog.json.


    Endpoint coverage here is deliberately limited to documented, stable endpoints. See https://amplitude.com/docs/apis for the complete reference, including the Experiment, Attribution, Lookup Table, and User Privacy APIs.'
  termsOfService: https://amplitude.com/terms
  contact:
    name: Amplitude Support
    url: https://amplitude.com/support
  license:
    name: Amplitude Terms of Service
    url: https://amplitude.com/terms
servers:
- url: https://amplitude.com
  description: Analytics REST host (default / US data residency)
- url: https://analytics.eu.amplitude.com
  description: Analytics REST host (EU data residency)
tags:
- name: Export
  description: Bulk export raw event data.
  externalDocs:
    url: https://amplitude.com/docs/apis/analytics/export
paths:
  /api/2/export:
    x-api-version: '2'
    get:
      tags:
      - Export
      operationId: exportEvents
      summary: Export raw events
      description: Export raw event data for a time range as a zipped archive of newline-delimited JSON files. Range is bounded by `server_upload_time`, maximum 365 days and 4 GB per request. Data is available roughly two hours after ingestion.
      security:
      - apiKeyAndSecretKey: []
      parameters:
      - name: start
        in: query
        required: true
        description: First hour included, formatted YYYYMMDDTHH.
        schema:
          type: string
          example: 20260101T00
      - name: end
        in: query
        required: true
        description: Last hour included, formatted YYYYMMDDTHH.
        schema:
          type: string
          example: 20260127T00
      responses:
        '200':
          description: Zipped archive of JSON event files.
          content:
            application/zip:
              schema:
                type: string
                format: binary
        '400':
          content:
            '*/*':
              schema:
                $ref: '#/components/schemas/ApiError'
          description: Request too large. Export exceeds the 4 GB limit — narrow the time range.
        '401':
          $ref: '#/components/responses/AnalyticsUnauthorized'
        '404':
          content:
            '*/*':
              schema:
                $ref: '#/components/schemas/ApiError'
          description: No data available for the requested time range.
        '429':
          $ref: '#/components/responses/AnalyticsRateLimited'
components:
  responses:
    AnalyticsRateLimited:
      description: Concurrent or hourly rate limit exceeded for the project. The response identifies which limit was hit. Up to 5 concurrent requests are allowed across Amplitude REST endpoints.
      content:
        '*/*':
          schema:
            $ref: '#/components/schemas/ApiError'
    AnalyticsUnauthorized:
      description: Missing or invalid credentials. Send HTTP Basic auth with the project API key as the username and the secret key as the password.
      content:
        '*/*':
          schema:
            $ref: '#/components/schemas/ApiError'
  schemas:
    ApiError:
      type:
      - object
      - string
      description: Shared description of existing error bodies, not a new wire envelope. JSON APIs may return optional code/error fields or an errors array; other endpoints return text or Markdown. Fields are optional and clients must use the HTTP status and Content-Type. Endpoint-specific details may be present.
      properties:
        code:
          type: integer
          description: HTTP status code, repeated in the body.
        error:
          type: string
          description: Human-readable error description.
          examples:
          - Invalid request path
          - Missing request body
          - Invalid JSON request body
          - Request missing required field
          - Invalid event JSON
          - Invalid API key
          - Invalid field values on some events
        missing_field:
          type: string
          description: Request-level required field that is missing.
        events_with_invalid_fields:
          type: object
          description: Maps field names to the indexes of the events that failed validation.
        events_with_missing_fields:
          type: object
          description: Maps field names to the indexes of the events missing them.
        eps_threshold:
          type: integer
          description: Current events-per-second threshold for the project.
        throttled_devices:
          type: object
          description: Maps device IDs to their current events-per-second rate.
        throttled_events:
          type: array
          items:
            type: integer
          description: Indexes of events that were throttled.
        silenced_devices:
          type: array
          items:
            type: string
          description: Device IDs Amplitude has silenced.
        silenced_events:
          type: array
          items:
            type: integer
          description: Indexes of events whose device was silenced.
        exceeded_daily_quota_devices:
          type: object
          description: Maps device or user IDs to their daily event count, for those over quota.
        errors:
          type: array
          items:
            type: object
            properties:
              message:
                type: string
            additionalProperties: true
          description: Taxonomy API error details.
      additionalProperties: true
  securitySchemes:
    orgApiKeyAndSecretKey:
      type: http
      scheme: basic
      description: DSAR uses HTTP Basic with the org API key and org secret key, as documented in the DSAR request examples.
    apiKeyAndSecretKey:
      type: http
      scheme: basic
      description: 'HTTP Basic authentication. Username is the project API key, password is the project secret key. Both are found in Amplitude under Settings → Projects → General. Credentials must be base64 encoded.


        This scheme is project-scoped and all-or-nothing: a key pair grants every operation on its project. There is no narrower grant. When an agent needs least-privilege access, prefer the MCP server and its `mcpOAuth` scopes over these keys.'
    mcpOAuth:
      type: oauth2
      description: 'OAuth 2.1 authorization code flow with PKCE, used by the Amplitude MCP server at `https://mcp.amplitude.com/mcp`.


        Endpoints and scopes here mirror the authorization server metadata at https://mcp.amplitude.com/.well-known/oauth-authorization-server, which is authoritative. Clients may be registered dynamically (RFC 7591) at `https://mcp.amplitude.com/register`; public clients are supported.


        Scopes bound the token but do not widen it — every call is additionally enforced against the permissions of the Amplitude user who approved the grant. Request the narrowest scope that covers the task.


        For EU data residency, substitute `https://mcp.eu.amplitude.com`.'
      flows:
        authorizationCode:
          authorizationUrl: https://mcp.amplitude.com/authorize
          tokenUrl: https://mcp.amplitude.com/token
          refreshUrl: https://mcp.amplitude.com/token
          scopes:
            mcp:read: Read charts, dashboards, cohorts, experiments, feature flags, events, properties, and session replays.
            mcp:write: Create and modify dashboards, notebooks, experiments, cohorts, and metrics.
            offline_access: Issue a refresh token so the agent can act after the user closes the browser. Omit for one-shot interactive tasks.
externalDocs:
  description: Amplitude API reference
  url: https://amplitude.com/docs/apis
x-api-versioning:
  scheme: per-api-path
  documentVersionScheme: date
  description: API families use independent path namespaces (for example /2/httpapi, /api/2/dsar and /api/5/cohorts). Batch and site-content paths are unversioned. The namespace number is not a shared release number or a semantic-version guarantee.
  deprecationPolicy:
    status: not-verified
    description: No company-wide REST retirement notice period or sunset dates are asserted by this document. SDK maintenance policy does not establish REST API lifecycle policy.