---
title: "Export a ledger subject as STIX 2.1"
description: "Requires a workspace-bound API key with `ledger:read`. Exports the subject's fold as a STIX 2.1 bundle. Subjects become identity objects. Email, handle, domain, hostname, URL, and ASN designators become cyber-observable objects. Claims become relationship objects with confidence, start_time, stop_time, and cited observations as external references. Verification state and the claim key travel in a property extension. An unconfirmed same-as exports as related-to. Duplicate-of and attributed-to are never emitted. history=true adds retracted heads as revoked relationships. STIX ids carry the SHA-256 digest of a per-workspace key in UUID form, so they are stable and do not reveal the workspace. An explicit validAt cursor scopes object IDs to that valid-time snapshot. A reassertion after revocation starts a new relationship ID. If the bounded subject neighborhood is incomplete, returns HTTP 400 VALIDATION_ERROR. Export the paginated ledger records and project the complete log offline instead."
canonical: https://y2.dev/docs/api/reference/ontology-ledger/getLedgerSubjectStixV2/
---

Endpoint Reference[Ontology Ledger](https://y2.dev/docs/api/reference/ontology-ledger)

# Export a ledger subject as STIX 2.1

Requires a workspace-bound API key with \`ledger:read\`. Exports the subject's fold as a STIX 2.1 bundle. Subjects become identity objects. Email, handle, domain, hostname, URL, and ASN designators become cyber-observable objects. Claims become relationship objects with confidence, start\_time, stop\_time, and cited observations as external references. Verification state and the claim key travel in a property extension. An unconfirmed same-as exports as related-to. Duplicate-of and attributed-to are never emitted. history=true adds retracted heads as revoked relationships. STIX ids carry the SHA-256 digest of a per-workspace key in UUID form, so they are stable and do not reveal the workspace. An explicit validAt cursor scopes object IDs to that valid-time snapshot. A reassertion after revocation starts a new relationship ID. If the bounded subject neighborhood is incomplete, returns HTTP 400 VALIDATION\_ERROR. Export the paginated ledger records and project the complete log offline instead.

`GET https://api.y2.dev/api/v2/ledger/subjects/{subjectId}/stix`

- Operation ID: `getLedgerSubjectStixV2`
- Required scopes: `ledger:read`
- Contract: https://y2.dev/openapi.json

## Parameters

| Name | In | Type | Required | Description |
| --- | --- | --- | --- | --- |
| `subjectId` | path | string | Yes | Ledger subject ID (sbj_ and 24 hex characters, from the public-ID digest strategy). |
| `recordedAt` | query | string (date-time) | No |  |
| `validAt` | query | string (date-time) | No |  |
| `history` | query | boolean | No | Include retracted heads as revoked relationships. |

## Responses

| Status | Description | Body |
| --- | --- | --- |
| 200 | A STIX 2.1 bundle. | `StixBundle` |
| 400 | Invalid request parameters |  |
| 401 | Missing or invalid API key |  |
| 403 | Insufficient permissions or access denied |  |
| 404 | Resource not found |  |
| 429 | Rate limit exceeded (per-key or per-account aggregate) |  |
| 500 | Internal server error |  |

### 200 response fields

| Field | Type | Description |
| --- | --- | --- |
| `type` | string |  |
| `id` | string |  |
| `objects[]` | array of object |  |
| `objects[].type` | string |  |
| `objects[].id` | string |  |
| `objects[].spec_version` | string |  |