# Bundle Secrets And Disclosure

Use this reference before inspecting, sharing, storing, or summarizing import/export bundles.

Exported bundles can include:

| Category | Examples |
|---|---|
| SQL and analytics logic | virtual dataset SQL, saved query SQL, chart query context |
| Object metadata | dashboard layout, tags, owners, UUIDs, descriptions |
| Database metadata | connection names, engine names, schemas, table metadata |
| Credential-bearing fields | SQLAlchemy URIs, `extra` JSON, encrypted extras, SSH tunnel settings |
| Secret material | passwords, private keys, private key passwords, OAuth/access tokens when supplied for import |

## Handling Rules

- Never print import secrets.
- Never paste passwords, private keys, SQLAlchemy URIs, access tokens, refresh tokens, or signed values into Markdown examples, logs, PR comments, or handoff notes.
- Redact credential-bearing fields before summarizing bundle contents.
- Confirm the destination path before writing export archives.
- Confirm the source path before reading import archives.

If the user needs a bundle review, report object types, counts, names when safe, and redacted risk notes rather than raw archive contents.

# Export Workflows

Use this reference for Superset workspace export endpoint guidance.

Exports can disclose SQL text, dashboard layout, dataset metadata, database metadata, tags, object UUIDs, and credential-bearing engine or `extra` fields. Confirm before all Superset asset exports, including object-scoped chart/dashboard exports: the API has no non-related export mode, and chart/dashboard bundles can include related dataset/database YAML.

## Export Endpoints

| Surface | Endpoint |
|---|---|
| All assets | `GET /api/v1/assets/export/` |
| Dashboards | `GET /api/v1/dashboard/export/` |
| Dashboard as example | `GET /api/v1/dashboard/{pk}/export_as_example/` |
| Charts | `GET /api/v1/chart/export/` |
| Datasets | `GET /api/v1/dataset/export/` |
| Databases | `GET /api/v1/database/export/` |
| Saved queries | `GET /api/v1/saved_query/export/` |
| Themes | `GET /api/v1/theme/export/` |

Before a gated export, summarize:

1. Workspace hostname.
2. Export endpoint.
3. Object IDs or whether this is an all-assets export.
4. Expected included related objects.
5. Where the archive will be written.
6. Expected disclosure, including SQL or credential-bearing metadata.

Load [bundle-secrets-and-disclosure.md](bundle-secrets-and-disclosure.md) before inspecting or sharing export bundle contents.

# Import Workflows

Use this reference for Superset workspace import endpoint guidance.

Imports mutate workspace metadata. Database imports can require passwords, SSH tunnel passwords, private keys, private key passwords, or encrypted extra secrets.

Use `preset-destructive-imports` for overwrite, sparse-update, all-assets restore, database import, or secret-bearing import workflows.

## Import Endpoints

| Surface | Endpoint |
|---|---|
| All assets | `POST /api/v1/assets/import/` |
| Dashboards | `POST /api/v1/dashboard/import/` |
| Charts | `POST /api/v1/chart/import/` |
| Datasets | `POST /api/v1/dataset/import/` |
| Databases | `POST /api/v1/database/import/` |
| Saved queries | `POST /api/v1/saved_query/import/` |
| Themes | `POST /api/v1/theme/import/` |

Before importing, summarize:

1. Workspace hostname.
2. Import endpoint.
3. Bundle path and contained object types.
4. Whether overwrite, sparse update, or passwords are provided.
5. Expected objects created or changed.
6. Rollback or restore plan.

Never print import secrets or embed them in Markdown examples.

# Validation And Smoke Patterns

Use this reference for safe import/export validation.

## Preferred Validation

For smoke validation, prefer OpenAPI presence checks for import/export endpoints:

```python
openapi = client.workspace("GET", hostname, "/_openapi")
paths = openapi.get("paths", {})
assert "/api/v1/assets/export/" in paths
assert "/api/v1/dashboard/import/" in paths
```

Verify candidate endpoints against the target workspace's own `/api/v1/_openapi` response before relying on public docs.

## Live Smoke Limits

- Do not live-test imports without explicit approval.
- Do not live-test exports unless the user explicitly approves the disclosure and destination path.
- Do not inspect exported archive contents without applying [bundle-secrets-and-disclosure.md](bundle-secrets-and-disclosure.md).
- Do not use production workspaces for import smoke tests unless the user explicitly approves the exact bundle and rollback plan.

Use `preset-destructive-imports` before testing overwrite, sparse-update, all-assets restore, database import, or secret-bearing import workflows.