File Export

BriefGate can drop everything a client submits straight into your own Google Drive or Dropbox — no downloading files and re-uploading them somewhere else. Connect a provider once, and every future intake can export itself the moment it completes.

What you get

A folder per intake, with a subfolder per item that has files, so a project's materials land already organised.
A summary.md alongside the files with every item's status and its submitted text, structured values, or decision — one page that tells a human what's in the folders without opening each file.
Export runs automatically when an intake completes, or on demand from the intake detail page at any time, including a re-export.
Two independent connections — Google Drive and Dropbox — you can use one, both, or neither.

Download everything as a ZIP

For a one-off download instead of a standing Drive or Dropbox connection, pull an intake's entire contents as a single ZIP — from the intake detail page in the dashboard, or GET /v1/intakes/:id/download.

podklady-bella-napoli-website-in_8f3kQmR2.zip
├── podklady.pdf
├── podklady.md
├── Logo/
│   └── bella-napoli-logo.png
└── Food and interior photos/
    ├── photo-1.jpg
    ├── photo-2.jpg
    └── photo-3.jpg

podklady.pdf is a readable summary of every item — label, type, status, the submitted value, decisions, and waived items with their reason — for a human who wants one document instead of opening the dashboard. podklady.md carries the same content in Markdown, for a script or another agent to parse. Every uploaded file sits in its own item's subfolder, exactly as the client uploaded it — no re-encoding, no format conversion.

A file still going through the antivirus scan is left out of the ZIP and listed as pending in both podklady.pdf and podklady.md, the same as summary.md above — download again once the scan clears.

Secrets are opt-in per download. By default, secret items are left out entirely, the same as Drive/Dropbox export, so they stay available for a one-time reveal in the dashboard. Choosing to include them — in podklady.pdf only; podklady.md never carries secret values — reveals every secret item that hasn't been shown yet, and that reveal is final: it consumes the same one-time reveal as get_intake_results or the dashboard's Reveal button, and downloading again without secrets does not give it back. A secret already revealed earlier is shown as already revealed on <date> regardless of what you choose this time. See Secrets vault for the one-time reveal itself. Only the account owner's own session, or an API key with the secrets:read or admin scope, may choose to include secrets — anyone else gets 403 forbidden (reason secrets_owner_only) if they try.

Size limit. An intake above 500 MB is refused for ZIP download (413 download_too_large). Export to Google Drive or Dropbox instead — it has no size limit.

Connect Google Drive

Open Settings → File export and click Connect Google Drive, then sign in and approve the consent screen. BriefGate requests Google's drive.file scope only: it can see and write files and folders it creates itself, and nothing else already in your Drive. Automatic export turns on by default the moment the connection succeeds.

Connect Dropbox

Open Settings → File export and click Connect Dropbox, then sign in and approve access. BriefGate requests app-folder scoped permissions (files.content.write, files.metadata.write, files.metadata.read, account_info.read) — it writes inside its own app folder in your Dropbox, not your whole account. As with Google Drive, automatic export is on by default and can be switched off independently.

Disconnecting either provider (from the same screen, or DELETE /v1/account/exports/:provider) revokes the OAuth token and deletes it from BriefGate immediately. Past exports already sitting in your Drive or Dropbox are untouched — disconnecting only stops future ones.

Automatic vs manual export

With Export automatically when an intake completes on, BriefGate starts an export as soon as an intake's required items are all in — the same moment that fires the intake.completed webhook. With it off, nothing leaves BriefGate until you trigger it yourself. Only one provider can be the automatic destination at a time: turning the switch on for the second one is refused until you turn it off for the first. Manual export always lets you pick either.

Manual export works from the intake detail page, or POST /v1/intakes/:id/export, and isn't limited to completed intakes — export whatever has arrived so far, then export again later for the rest.

What lands in the folder

The top-level folder is named BriefGate / <project name> (<intake id>), for example:

BriefGate / Bella Napoli — Website (in_8f3kQmR2)
├── Logo/
│   └── bella-napoli-logo.png
├── Food and interior photos/
│   ├── photo-1.jpg
│   ├── photo-2.jpg
│   └── photo-3.jpg
└── summary.md

Only items with files get a subfolder. Everything else — text, structured answers, decisions — lives only in summary.md:

markdown

# Bella Napoli — Website
Intake in_8f3kQmR2 · exported 2026-09-05T10:22:00Z

## Logo (image) — approved
File(s) in ./Logo/

## Hero section tagline (longtext) — approved
Real Napoli-style pizza, right in your neighbourhood.

## Opening hours (structured) — approved
mon_fri: 12:00-22:00
sat: 12:00-23:00
sun: 13:00-21:00

## Testimonial video (file) — waived
Waived by owner: "Client doesn't have one yet."

## Delivery zone map (image) — pending virus scan
Not exported yet — this file is still being scanned for malware.

## WordPress admin credentials (secret) — approved
Secret item — not exported. See the dashboard or `get_intake_results`.

Waived items are listed with their waiver reason. A file still going through the antivirus scan is skipped and noted, rather than held up — export the intake again once the scan clears.

Secret items are never exported. summary.md names the item so nothing looks missing, but neither the value nor any hint of it — not even whether it was filled in — leaves BriefGate through this feature. Read a secret's value the normal way: the dashboard's one-time reveal, or get_intake_results with the secrets:read scope.

Re-export and overwrites

Exporting an intake that was already exported writes into the same folder and overwrites files with the current version — it does not create a second copy. This is the intended way to pick up items that arrived after the first export, or to refresh summary.md once a pending scan clears.

If a failed export left a partial folder behind, re-exporting completes it rather than starting over from a fresh folder.

Security and privacy

Tokens are encrypted at rest with the same libsodium sealed-box key that protects the secrets vault — a database dump does not yield usable credentials.
Google Drive access is scoped to drive.file: BriefGate cannot list, read, or modify anything in your Drive that it didn't create. Dropbox access is scoped to an app folder (Apps/BriefGate), not your whole account.
The destination is an account you own and chose to connect. Google and Dropbox act on your instruction as the recipient of your own data, not as a BriefGate subprocessor — see the Privacy Notice and the DPA for exactly how that's framed.
Files leave BriefGate's storage only when you connect a provider. BriefGate keeps its own copy under your normal retention settings either way — exporting doesn't shorten or extend how long BriefGate itself holds data.
Disconnecting deletes the stored token immediately, but doesn't reach into Drive or Dropbox to remove files already exported there.

API

Trigger an export

bash

curl -X POST https://api.briefgate.dev/v1/intakes/in_8f3kQmR2/export \
  -H "Authorization: Bearer bg_live_xxxxx" \
  -H "Content-Type: application/json" \
  -d '{"provider": "google_drive"}'

provider is optional — omit it to export to every connected provider with automatic export enabled. Returns 202 immediately and runs asynchronously:

json

{ "intake_id": "in_8f3kQmR2", "export": { "status": "pending", "provider": "google_drive" } }

Poll GET /v1/intakes/:id for progress — it carries the latest state under export:

json

"export": {
  "status": "completed",
  "provider": "google_drive",
  "url": "https://drive.google.com/drive/folders/1AbCdEfGhIjKlMnOpQrSt",
  "exported_at": "2026-09-05T10:22:03Z",
  "error": null
}

status is pending, completed, or failed. On failed, error carries the provider's message.

Account export settings

bash

curl https://api.briefgate.dev/v1/account/exports \
  -H "Authorization: Bearer bg_live_xxxxx"

json

{
  "providers": [
    {
      "provider": "google_drive",
      "connected": true,
      "account_email": "[email protected]",
      "auto_export": true,
      "connected_at": "2026-08-20T09:00:00Z"
    },
    { "provider": "dropbox", "connected": false }
  ]
}

Toggle automatic export:

bash

curl -X PATCH https://api.briefgate.dev/v1/account/exports/google_drive \
  -H "Authorization: Bearer bg_live_xxxxx" \
  -H "Content-Type: application/json" \
  -d '{"auto_export": false}'

Disconnect a provider, revoking and deleting its token:

bash

curl -X DELETE https://api.briefgate.dev/v1/account/exports/dropbox \
  -H "Authorization: Bearer bg_live_xxxxx"

Returns 204. Connecting a provider in the first place requires the OAuth redirect and can only be done from the dashboard — there's no REST endpoint for it.

Check before downloading a ZIP

bash

curl https://api.briefgate.dev/v1/intakes/in_8f3kQmR2/download/preflight \
  -H "Authorization: Bearer bg_live_xxxxx"

json

{
  "files": 6,
  "bytes": 18420531,
  "skipped_files": 1,
  "secrets": { "total": 2, "unrevealed": 1, "already_revealed": 1 },
  "too_large": false,
  "max_bytes": 524288000,
  "filename": "podklady-bella-napoli-website-in_8f3kQmR2.zip"
}

skipped_files is how many uploads are still pending the antivirus scan and would be left out. secrets.unrevealed is how many secret items are still available for a one-time reveal if include_secrets is left off; secrets.already_revealed show as already-revealed text either way. too_large mirrors the 413 the download call below would return.

Download the ZIP

bash

curl "https://api.briefgate.dev/v1/intakes/in_8f3kQmR2/download?include_secrets=false" \
  -H "Authorization: Bearer bg_live_xxxxx" \
  -o podklady.zip

Returns application/zip with Content-Disposition: attachment; filename="podklady-bella-napoli-website-in_8f3kQmR2.zip". include_secrets defaults to false; set it to true to reveal and include secret values in podklady.pdf — owner session or a secrets:read/admin key only, see Download everything as a ZIP above. Logged as an intake.downloaded audit event either way.

Troubleshooting

"No provider connected." POST /v1/intakes/:id/export needs at least one connected provider, or an explicit provider that is in fact connected. Connect one in Settings → File export first.
Token revoked, export failing after it worked before. Google or Dropbox access can be revoked from their side — a password change, or the customer revoking BriefGate in their own account settings. BriefGate retries three times with backoff, then marks the export failed with the provider's message and a Try again button. Reconnect the provider to clear it.
A file is missing from the export. Check summary.md — a file still being scanned for malware is skipped and listed as pending, not exported partially. Export again once the scan finishes.
Nothing happens when an intake completes. Confirm Export automatically when an intake completes is on for that provider; it defaults to on at connection time but can be switched off independently.
"Download refused, intake too large." ZIP download tops out at 500 MB (413 download_too_large). Check GET /v1/intakes/:id/download/preflight for the exact size, and use Google Drive or Dropbox export instead — it has no size limit.

FAQ

Does this replace get_intake_results? No. An agent calling get_intake_results already gets signed URLs and typed values directly; export exists for the human who lives in Drive or Dropbox and wants the same materials there without asking the agent for them.

Can I export to a shared Drive or Team folder instead of my personal one? Not yet — export goes to the account you authenticated with.

Does disconnecting delete what was already exported? No. It only revokes access going forward; files already placed in your Drive or Dropbox stay put.