> For the complete documentation index, see [llms.txt](https://docs.devolutions.net/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.devolutions.net/cloud/knowledge-base/how-to-articles/export-a-single-vault-with-powershell.md). # Export a single vault with PowerShell Export a single Devolutions Cloud vault with the PowerShell script by scoping an application identity to that vault only, in JSON or CSV format. The [PowerShell script export type](/cloud/web-interface/help-and-tools/export/powershell-script-export-type.md) has no vault setting. The script exports every vault that the application identity running it is allowed to export, and writes one file per vault. To export a single vault, scope the application identity to that vault only. A vault is included in the export when one of these conditions is met: * The application identity has the ***Export*** permission on the vault. * The application identity has ***Can access user vaults*** enabled and the vault is a user vault. With ***Can access user vaults*** enabled, every user vault of the instance is included in the export, even without the ***Export*** permission on them. {% hint style="info" %} Creating an application identity requires the ***Manage users and user groups*** system permission, and editing the permissions of a vault requires the ***Manage vault*** permission on that vault. To export a single vault without an application identity, use the [JSON export type](/cloud/web-interface/help-and-tools/export/json-export-type.md) instead. It lets you select the vault, folders, and entries to export, but only produces a JSON file. {% endhint %} ### Create a dedicated application identity 1. Go to ***Administration***, then under ***Management***, click ***Application identities***. 2. Click the ***Add*** icon at the top right. 3. ***Name*** the application identity after its purpose, for example *Vault export*. 4. Leave ***Can access user vaults*** cleared. This keeps user vaults out of the export. 5. Click ***Submit***. 6. Copy the ***Application Secret*** and ***Application key***, and save them in a secure place. They are only shown once. ### Grant the export permission on the target vault only 1. Go to ***Administration***, then under ***Management***, click ***Vaults***. 2. Click the ***Edit*** pencil icon next to the vault to export. 3. Open the ***Security*** tab, then the ***Edit*** tab. 4. Assign the application identity to the ***Vault owners*** role, or to a custom role that includes the ***Export*** permission. 5. Click ***Update*** to save. Do not assign the application identity to any other vault. It can now export exactly one vault. {% hint style="warning" %} Do not assign the application identity a role in the ***Vaults*** tab of ***System permissions***, under ***Administration*** and ***Configuration and security***. A role assigned there applies to every vault of the instance, so a role that includes the ***Export*** permission, such as ***Vault owners***, makes the application identity export every vault. {% endhint %} ### Generate and run the script 1. In ***Help & tools***, click ***Export***. 2. Select the ***PowerShell script*** export type, then ***Automatic***. 3. Enter the ***Application Secret*** and ***Application key*** of the application identity. 4. Enter the ***Destination folder path***. The folder must already exist. 5. Clear ***Obfuscate sensitive values*** if you need the passwords in readable form. This option is checked by default. 6. Choose to export in JSON or CSV. To protect the file, select JSON and check ***Encrypt with the master key***, then enter a master password. Master password encryption is not supported for CSV exports. 7. Click ***Download***. 8. Run the downloaded script using PowerShell 7 or later. The script installs the Devolutions.PowerShell module from the PowerShell Gallery, so the computer needs internet access. The destination folder contains a single file named `exported-entries-from-.json` or `exported-entries-from-.csv`. {% hint style="warning" %} A CSV file, or a JSON file without a master password, is stored unencrypted. Anyone with access to the folder can read its credentials. Keep the file on storage you control and delete it when you no longer need it. {% endhint %} #### See also * [PowerShell script export type](/cloud/web-interface/help-and-tools/export/powershell-script-export-type.md) * [Manage application identities](/cloud/web-interface/administration/management/application-identities/manage-application-identities.md) * [Create and manage vaults](/cloud/web-interface/administration/management/vaults/create-and-manage-vaults.md) * [Roles and permissions](/cloud/web-interface/administration/configuration-and-security/system-permissions/roles-and-permissions.md) --- # Agent Instructions This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com. ## Querying This Documentation If you need additional information that is not directly available in this page, you can query the documentation by asking a question. Perform an HTTP GET request on the following URL with the `ask` and `goal` query parameters: ``` GET https://docs.devolutions.net/cloud/knowledge-base/how-to-articles/export-a-single-vault-with-powershell.md?ask=&goal= ``` `ask` is the immediate question: it should be specific, self-contained, and written in natural language. `goal` is what the user is ultimately trying to achieve, the reason they need the answer. Sharing it helps GitBook give you a better, more relevant answer. A goal is most helpful when it describes the outcome the user wants rather than restating the question. For example, with `ask=how do I create an API token`, a goal like `automate deployments from our CI pipeline` lets GitBook tailor the answer to that use case. The response will contain a direct answer to the question and relevant excerpts and sources from the documentation. Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.