Delivery destination. Currently supports S3 only; non-AWS destinations are planned. roleArn must trust the Wingspan source account and require the ExternalId: wingspan-{accountId}-{dataExportId} for confused-deputy prevention.

Schedule for the export. Cron expression with explicit timezone. Minimum cadence is hourly; maximum is daily.

Optional per-resource column projection. Keys are the eligible DataExportResource object names. Values are dot-notation field paths for that resource. Omitted resources export their default field set. Default = all non-sensitive fields, except for Person and Account PII, which default to a non-PII subset (id, externalId, status, events, actors, metadata). Including PII requires explicit opt-in here AND the calling Authorization must carry the relevant data-export.{resource}.pii:read scope.

Optional per-resource row filters. Keys are eligible DataExportResource object names. A resource filter may only be supplied for resources present in entities; otherwise create/update returns 422 ValidationError. Each resource filter is applied after the run's watermark window, so a row must both be changed in the run window and satisfy the resource filter to be emitted.

Free-form key-value pairs. Max 50 keys; key length at most 40 characters; value length at most 500 characters. Where a list endpoint declares metadata filtering, it uses the QueryQL namespace via filter[metadata.{key}][eq]=value or filter[metadata.{key}][in][]=value. Endpoints that do not declare the dynamic Metadata filter do not support Metadata filtering.