netbirdexport 0.1.0__tar.gz

netbirdexport-0.1.0/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 Younes Z.
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

netbirdexport-0.1.0/PKG-INFO

@@ -0,0 +1,123 @@
+Metadata-Version: 2.4
+Name: netbirdexport
+Version: 0.1.0
+Summary: Export a NetBird account inventory (peers, users, setup keys, groups) to CSV and JSON in one command, using your own access token. Standard library only.
+Author: Younes Z.
+License: MIT
+Project-URL: Homepage, https://github.com/Rezarys/netbirdexport
+Project-URL: Issues, https://github.com/Rezarys/netbirdexport/issues
+Keywords: netbird,wireguard,mesh vpn,inventory,export,csv,audit,backup,self hosted
+Classifier: Development Status :: 4 - Beta
+Classifier: Environment :: Console
+Classifier: Intended Audience :: System Administrators
+Classifier: Intended Audience :: Developers
+Classifier: License :: OSI Approved :: MIT License
+Classifier: Programming Language :: Python :: 3
+Classifier: Topic :: System :: Networking
+Classifier: Topic :: System :: Systems Administration
+Classifier: Topic :: Utilities
+Requires-Python: >=3.9
+Description-Content-Type: text/markdown
+License-File: LICENSE
+Dynamic: license-file
+
+# netbirdexport
+
+```
+pip install netbirdexport
+```
+
+Export your NetBird account inventory to CSV and JSON in one command, using your own access token. Peers, users, setup keys and groups, one CSV and one JSON file each, plus a manifest. Standard library only, no dependencies.
+
+Not affiliated with NetBird. "NetBird" is used here only to say which API this tool reads.
+
+## Why this exists
+
+In [netbirdio/netbird#4437](https://github.com/netbirdio/netbird/issues/4437), open since September 2025, `chirag-rastogi` wrote:
+
+> Currently, there's no way to download or back up information like the list of users, peers, or setup keys.
+
+The management API already exposes every one of those objects: `/api/users`, `/api/peers` and `/api/setup-keys` all exist and are read by the project's own REST client. The missing part was the one command that reads them and writes them out for an audit or a migration. That is all this tool is.
+
+## Use
+
+Create a personal access token in the management dashboard, then:
+
+```
+export NETBIRD_TOKEN=nbp_xxxxxxxxxxxxxxxx
+netbirdexport
+```
+
+```
+netbirdexport 0.1.0
+source  https://api.netbird.io
+output  netbird-export
+
+resource    rows  files
+peers          2  peers.csv, peers.json
+users          2  users.csv, users.json
+setup-keys     1  setup-keys.csv, setup-keys.json
+groups         2  groups.csv, groups.json
+
+never written, matched by field name: setup-keys.key
+wrote 9 files including manifest.json
+```
+
+The token is read from `NETBIRD_TOKEN` and is never accepted as a command line argument, so it does not appear in the argument list of the running process. It is still in that process's environment, and typing `export NETBIRD_TOKEN=...` at a prompt does put it in your shell history, so read it from a secret store or from a file you control if that matters to you.
+
+Self hosted, and more resources:
+
+```
+netbirdexport --url https://netbird.example.org --resources peers,users,setup-keys,groups,policies,routes,nameservers --out audit-2026-09
+```
+
+Options:
+
+- `--url` management API base URL, default `https://api.netbird.io`.
+- `--out` directory to write into, created if missing, default `netbird-export`.
+- `--resources` comma separated, in output order. Available: `peers`, `users`, `setup-keys`, `groups`, `policies`, `routes`, `nameservers`.
+- `--format` comma separated, `csv` and `json`, default both.
+- `--bearer` send the token as `Bearer` instead of `Token`, for an OAuth access token rather than a personal access token.
+- `--version` print the version and exit.
+
+Nothing is written until every request has succeeded, so a failure halfway through leaves no half exported directory behind.
+
+## What the two formats are for
+
+`<resource>.json` keeps the nested shape the API returned, which is what you want for a diff between two dates. `<resource>.csv` flattens the same objects to one row each: a nested object becomes a `parent.child` column, and every list gets a `<field>_count` column, whatever it holds and even when it is empty, so that a column never appears or disappears just because a list happened to be empty on one run. A list of values also gets `<field>` with the values joined by a vertical bar; a list of objects also gets `<field>_ids` when every object in the list carries a string `id`. Columns are the union of the keys seen across all rows, so a field that only some objects carry still gets a column.
+
+Columns are not a fixed list. This tool writes whatever the API returns, minus the redacted fields below, which means it does not silently drop a field that a newer server version added.
+
+`manifest.json` records the tool version, the source URL, the UTC time of the run, and for each resource its API path, its row count and the names of the fields that were dropped.
+
+## Secrets: what is dropped, and what that does not promise
+
+A field is never written when its own name, lowercased, is one of `key`, `token`, `secret`, `password`, `passphrase`, `private_key`, `privatekey`, `client_secret`, `api_key`, `access_token`, `refresh_token`, or ends with `_secret`, `_password`, `_token` or `_private_key`. This applies at every depth, inside nested objects and inside lists. Every dropped field is named on the console and in `manifest.json`, so nothing is removed silently.
+
+Read this next part before you share an export. **This is a match on field names, not a classification of content.** It drops the setup key field, which is named `key`, and it deliberately keeps fields like `setup_key_id` or `public_key`, which identify rather than authenticate. It cannot know that some future field with an innocent name holds something sensitive. An export of an administration inventory contains user emails, host names and internal addresses in any case: treat the output directory as sensitive, and read it before sending it anywhere.
+
+## Honest limits
+
+**This tool has never been run against a real NetBird instance.** It has no test deployment and no token behind it. Its test suite runs against example API responses written for those tests, and the shape of those responses follows the upstream project's public REST client and API specification, read on 2026-09-30. If you run it against a real account and something is wrong, open an issue and it will be fixed.
+
+It issues one GET per resource and sends nothing else of its own. It does not follow redirects: a redirect is reported as an error rather than followed, because following one would resend your `Authorization` header to whatever host the server pointed at. It never asks the API to change anything, because every request it makes is a GET.
+
+It does not paginate: it reads each list endpoint once and writes what came back. The project's own REST client takes no page parameter on these list calls, but if some server version paginates one of them, this tool would write only the first page, and that has not been tested against a real instance.
+
+It reads only a whole account: there is no filter by group, by name or by date. An export is the inventory as it stands at the moment of the run.
+
+An export is not a restore file. Nothing here writes back, the default set covers four resources out of seven, and a setup key cannot be recreated from an export because its value is deliberately absent. Treat the output as an audit and migration record, not as a backup you could restore from.
+
+`policies`, `routes` and `nameservers` are available but not exported by default. The default set is peers, users and setup keys, the three the request above named, plus groups, because a peer row carries group ids and those ids mean nothing without the group names.
+
+Python 3.9 or newer.
+
+## Upstream licence
+
+NetBird is published by NetBird GmbH and its authors. Its repository is BSD 3-Clause except the `management/`, `signal/`, `relay/` and `combined/` directories, which are GNU AGPL version 3. This package is MIT and is not derived from it: no upstream line is copied here. What was read is the public shape of its HTTP interface, and this tool is an outside client that speaks to that interface over the network.
+
+## Licence
+
+MIT, Younes Z. See `LICENSE`.
+
+Built with AI assistance, reviewed and tested by me.

netbirdexport-0.1.0/README.md

@@ -0,0 +1,100 @@
+# netbirdexport
+
+```
+pip install netbirdexport
+```
+
+Export your NetBird account inventory to CSV and JSON in one command, using your own access token. Peers, users, setup keys and groups, one CSV and one JSON file each, plus a manifest. Standard library only, no dependencies.
+
+Not affiliated with NetBird. "NetBird" is used here only to say which API this tool reads.
+
+## Why this exists
+
+In [netbirdio/netbird#4437](https://github.com/netbirdio/netbird/issues/4437), open since September 2025, `chirag-rastogi` wrote:
+
+> Currently, there's no way to download or back up information like the list of users, peers, or setup keys.
+
+The management API already exposes every one of those objects: `/api/users`, `/api/peers` and `/api/setup-keys` all exist and are read by the project's own REST client. The missing part was the one command that reads them and writes them out for an audit or a migration. That is all this tool is.
+
+## Use
+
+Create a personal access token in the management dashboard, then:
+
+```
+export NETBIRD_TOKEN=nbp_xxxxxxxxxxxxxxxx
+netbirdexport
+```
+
+```
+netbirdexport 0.1.0
+source  https://api.netbird.io
+output  netbird-export
+
+resource    rows  files
+peers          2  peers.csv, peers.json
+users          2  users.csv, users.json
+setup-keys     1  setup-keys.csv, setup-keys.json
+groups         2  groups.csv, groups.json
+
+never written, matched by field name: setup-keys.key
+wrote 9 files including manifest.json
+```
+
+The token is read from `NETBIRD_TOKEN` and is never accepted as a command line argument, so it does not appear in the argument list of the running process. It is still in that process's environment, and typing `export NETBIRD_TOKEN=...` at a prompt does put it in your shell history, so read it from a secret store or from a file you control if that matters to you.
+
+Self hosted, and more resources:
+
+```
+netbirdexport --url https://netbird.example.org --resources peers,users,setup-keys,groups,policies,routes,nameservers --out audit-2026-09
+```
+
+Options:
+
+- `--url` management API base URL, default `https://api.netbird.io`.
+- `--out` directory to write into, created if missing, default `netbird-export`.
+- `--resources` comma separated, in output order. Available: `peers`, `users`, `setup-keys`, `groups`, `policies`, `routes`, `nameservers`.
+- `--format` comma separated, `csv` and `json`, default both.
+- `--bearer` send the token as `Bearer` instead of `Token`, for an OAuth access token rather than a personal access token.
+- `--version` print the version and exit.
+
+Nothing is written until every request has succeeded, so a failure halfway through leaves no half exported directory behind.
+
+## What the two formats are for
+
+`<resource>.json` keeps the nested shape the API returned, which is what you want for a diff between two dates. `<resource>.csv` flattens the same objects to one row each: a nested object becomes a `parent.child` column, and every list gets a `<field>_count` column, whatever it holds and even when it is empty, so that a column never appears or disappears just because a list happened to be empty on one run. A list of values also gets `<field>` with the values joined by a vertical bar; a list of objects also gets `<field>_ids` when every object in the list carries a string `id`. Columns are the union of the keys seen across all rows, so a field that only some objects carry still gets a column.
+
+Columns are not a fixed list. This tool writes whatever the API returns, minus the redacted fields below, which means it does not silently drop a field that a newer server version added.
+
+`manifest.json` records the tool version, the source URL, the UTC time of the run, and for each resource its API path, its row count and the names of the fields that were dropped.
+
+## Secrets: what is dropped, and what that does not promise
+
+A field is never written when its own name, lowercased, is one of `key`, `token`, `secret`, `password`, `passphrase`, `private_key`, `privatekey`, `client_secret`, `api_key`, `access_token`, `refresh_token`, or ends with `_secret`, `_password`, `_token` or `_private_key`. This applies at every depth, inside nested objects and inside lists. Every dropped field is named on the console and in `manifest.json`, so nothing is removed silently.
+
+Read this next part before you share an export. **This is a match on field names, not a classification of content.** It drops the setup key field, which is named `key`, and it deliberately keeps fields like `setup_key_id` or `public_key`, which identify rather than authenticate. It cannot know that some future field with an innocent name holds something sensitive. An export of an administration inventory contains user emails, host names and internal addresses in any case: treat the output directory as sensitive, and read it before sending it anywhere.
+
+## Honest limits
+
+**This tool has never been run against a real NetBird instance.** It has no test deployment and no token behind it. Its test suite runs against example API responses written for those tests, and the shape of those responses follows the upstream project's public REST client and API specification, read on 2026-09-30. If you run it against a real account and something is wrong, open an issue and it will be fixed.
+
+It issues one GET per resource and sends nothing else of its own. It does not follow redirects: a redirect is reported as an error rather than followed, because following one would resend your `Authorization` header to whatever host the server pointed at. It never asks the API to change anything, because every request it makes is a GET.
+
+It does not paginate: it reads each list endpoint once and writes what came back. The project's own REST client takes no page parameter on these list calls, but if some server version paginates one of them, this tool would write only the first page, and that has not been tested against a real instance.
+
+It reads only a whole account: there is no filter by group, by name or by date. An export is the inventory as it stands at the moment of the run.
+
+An export is not a restore file. Nothing here writes back, the default set covers four resources out of seven, and a setup key cannot be recreated from an export because its value is deliberately absent. Treat the output as an audit and migration record, not as a backup you could restore from.
+
+`policies`, `routes` and `nameservers` are available but not exported by default. The default set is peers, users and setup keys, the three the request above named, plus groups, because a peer row carries group ids and those ids mean nothing without the group names.
+
+Python 3.9 or newer.
+
+## Upstream licence
+
+NetBird is published by NetBird GmbH and its authors. Its repository is BSD 3-Clause except the `management/`, `signal/`, `relay/` and `combined/` directories, which are GNU AGPL version 3. This package is MIT and is not derived from it: no upstream line is copied here. What was read is the public shape of its HTTP interface, and this tool is an outside client that speaks to that interface over the network.
+
+## Licence
+
+MIT, Younes Z. See `LICENSE`.
+
+Built with AI assistance, reviewed and tested by me.

netbirdexport-0.1.0/pyproject.toml

@@ -0,0 +1,45 @@
+[build-system]
+requires = ["setuptools>=68"]
+build-backend = "setuptools.build_meta"
+
+[project]
+name = "netbirdexport"
+version = "0.1.0"
+description = "Export a NetBird account inventory (peers, users, setup keys, groups) to CSV and JSON in one command, using your own access token. Standard library only."
+readme = "README.md"
+requires-python = ">=3.9"
+license = { text = "MIT" }
+authors = [{ name = "Younes Z." }]
+keywords = [
+  "netbird",
+  "wireguard",
+  "mesh vpn",
+  "inventory",
+  "export",
+  "csv",
+  "audit",
+  "backup",
+  "self hosted",
+]
+classifiers = [
+  "Development Status :: 4 - Beta",
+  "Environment :: Console",
+  "Intended Audience :: System Administrators",
+  "Intended Audience :: Developers",
+  "License :: OSI Approved :: MIT License",
+  "Programming Language :: Python :: 3",
+  "Topic :: System :: Networking",
+  "Topic :: System :: Systems Administration",
+  "Topic :: Utilities",
+]
+dependencies = []
+
+[project.urls]
+Homepage = "https://github.com/Rezarys/netbirdexport"
+Issues = "https://github.com/Rezarys/netbirdexport/issues"
+
+[project.scripts]
+netbirdexport = "netbirdexport.cli:main"
+
+[tool.setuptools.packages.find]
+where = ["src"]

netbirdexport-0.1.0/setup.cfg

@@ -0,0 +1,4 @@
+[egg_info]
+tag_build = 
+tag_date = 0
+

netbirdexport-0.1.0/src/netbirdexport/__init__.py

@@ -0,0 +1,3 @@
+"""Export a NetBird account inventory to CSV and JSON in one command."""
+
+__version__ = "0.1.0"

netbirdexport-0.1.0/src/netbirdexport/__main__.py

@@ -0,0 +1,6 @@
+import sys
+
+from .cli import main
+
+if __name__ == "__main__":
+    sys.exit(main())

netbirdexport-0.1.0/src/netbirdexport/cli.py

@@ -0,0 +1,186 @@
+"""Command line entry point."""
+
+import argparse
+import datetime
+import json
+import os
+import sys
+
+from . import __version__
+from .core import (
+    DEFAULT_RESOURCES,
+    DEFAULT_URL,
+    RESOURCES,
+    ExportError,
+    auth_header,
+    export,
+    flatten,
+    http_fetch,
+    to_csv,
+    to_json,
+)
+
+TOKEN_ENV = "NETBIRD_TOKEN"
+
+
+def build_parser():
+    parser = argparse.ArgumentParser(
+        prog="netbirdexport",
+        description=(
+            "Export a NetBird account inventory to CSV and JSON in one command. "
+            "The token is read from the %s environment variable and is never "
+            "accepted as an argument, so it does not appear in the argument list of "
+            "the running process. It is still in that process's environment, and "
+            "typing it at a prompt puts it in your shell history." % TOKEN_ENV
+        ),
+    )
+    parser.add_argument(
+        "--url",
+        default=DEFAULT_URL,
+        help="management API base URL (default: %s)" % DEFAULT_URL,
+    )
+    parser.add_argument(
+        "--out",
+        default="netbird-export",
+        help="directory to write into, created if missing (default: netbird-export)",
+    )
+    parser.add_argument(
+        "--resources",
+        default=",".join(DEFAULT_RESOURCES),
+        help=(
+            "comma separated list, in output order (default: %s; available: %s)"
+            % (",".join(DEFAULT_RESOURCES), ",".join(sorted(RESOURCES)))
+        ),
+    )
+    parser.add_argument(
+        "--format",
+        default="csv,json",
+        help="comma separated, csv and json (default: csv,json)",
+    )
+    parser.add_argument(
+        "--bearer",
+        action="store_true",
+        help="send the token as Bearer instead of Token, for an OAuth access token",
+    )
+    parser.add_argument("--version", action="version", version=__version__)
+    return parser
+
+
+def parse_list(raw, allowed, label):
+    names = [one.strip() for one in raw.split(",") if one.strip()]
+    if not names:
+        raise ExportError("--%s got an empty list." % label)
+    unknown = [one for one in names if one not in allowed]
+    if unknown:
+        raise ExportError(
+            "unknown %s: %s. Available: %s."
+            % (label, ", ".join(unknown), ", ".join(sorted(allowed)))
+        )
+    ordered = []
+    for one in names:
+        if one not in ordered:
+            ordered.append(one)
+    return ordered
+
+
+def render_report(url, out, written, dropped):
+    """The exact text the tool prints on success.
+
+    Kept free of anything that changes between two identical runs, so that the
+    sample in the README can be checked character by character.
+    """
+    lines = [
+        "netbirdexport " + __version__,
+        "source  " + url,
+        "output  " + out,
+        "",
+    ]
+    head = ("resource", "rows", "files")
+    rows = [(name, str(count), ", ".join(files)) for name, count, files in written]
+    first = max([len(head[0])] + [len(row[0]) for row in rows])
+    second = max([len(head[1])] + [len(row[1]) for row in rows])
+    lines.append("%-*s  %*s  %s" % (first, head[0], second, head[1], head[2]))
+    for name, count, files in rows:
+        lines.append("%-*s  %*s  %s" % (first, name, second, count, files))
+    lines.append("")
+    if dropped:
+        lines.append("never written, matched by field name: " + ", ".join(dropped))
+    else:
+        lines.append("never written, matched by field name: none found")
+    total = sum(len(files) for _, _, files in written) + 1
+    lines.append("wrote %d files including manifest.json" % total)
+    return "\n".join(lines) + "\n"
+
+
+def run(argv, fetch=http_fetch, env=None, stdout=None):
+    env = os.environ if env is None else env
+    stdout = sys.stdout if stdout is None else stdout
+    args = build_parser().parse_args(argv)
+
+    token = env.get(TOKEN_ENV, "").strip()
+    if not token:
+        raise ExportError(
+            "%s is not set. Create a personal access token in the management "
+            "dashboard, then export %s=... before running this." % (TOKEN_ENV, TOKEN_ENV)
+        )
+
+    resources = parse_list(args.resources, set(RESOURCES), "resources")
+    formats = parse_list(args.format, {"csv", "json"}, "format")
+
+    result = export(resources, args.url, auth_header(token, args.bearer), fetch=fetch)
+
+    os.makedirs(args.out, exist_ok=True)
+    written = []
+    all_dropped = []
+    manifest = {
+        "tool": "netbirdexport",
+        "version": __version__,
+        "source": args.url,
+        "generated_utc": datetime.datetime.now(datetime.timezone.utc).strftime(
+            "%Y-%m-%dT%H:%M:%SZ"
+        ),
+        "resources": {},
+    }
+
+    for name in resources:
+        items, dropped = result[name]
+        all_dropped.extend(name + "." + one for one in dropped)
+        files = []
+        if "csv" in formats:
+            rows = [flatten(item) for item in items]
+            files.append(name + ".csv")
+            write_text(os.path.join(args.out, name + ".csv"), to_csv(rows))
+        if "json" in formats:
+            files.append(name + ".json")
+            write_text(os.path.join(args.out, name + ".json"), to_json(items))
+        written.append((name, len(items), files))
+        manifest["resources"][name] = {
+            "path": RESOURCES[name],
+            "rows": len(items),
+            "files": files,
+            "redacted_fields": dropped,
+        }
+
+    write_text(
+        os.path.join(args.out, "manifest.json"),
+        json.dumps(manifest, indent=2, sort_keys=True) + "\n",
+    )
+    stdout.write(render_report(args.url, args.out, written, all_dropped))
+    return 0
+
+
+def write_text(path, text):
+    with open(path, "w", encoding="utf-8", newline="") as handle:
+        handle.write(text)
+
+
+def main(argv=None):
+    try:
+        return run(sys.argv[1:] if argv is None else argv)
+    except ExportError as err:
+        sys.stderr.write("netbirdexport: %s\n" % err)
+        return 1
+
+
+if __name__ == "__main__":
+    sys.exit(main())

netbirdexport-0.1.0/src/netbirdexport/core.py

@@ -0,0 +1,218 @@
+"""Fetching, redaction and rendering.
+
+The HTTP layer is kept behind a single callable so that every other part of this
+package is pure and testable without a network.
+"""
+
+import csv
+import io
+import json
+import urllib.error
+import urllib.request
+
+# Resource name as written on the command line, mapped to its API path.
+# Every path here is read from the upstream REST client at
+# shared/management/client/rest/ and from its own documentation links, not
+# guessed from the resource name.
+RESOURCES = {
+    "peers": "/api/peers",
+    "users": "/api/users",
+    "setup-keys": "/api/setup-keys",
+    "groups": "/api/groups",
+    "policies": "/api/policies",
+    "routes": "/api/routes",
+    "nameservers": "/api/dns/nameservers",
+}
+
+DEFAULT_RESOURCES = ("peers", "users", "setup-keys", "groups")
+
+DEFAULT_URL = "https://api.netbird.io"
+
+# A field is never written when its own name, lowercased, is listed here or ends
+# with one of REDACT_SUFFIXES. This is a name match, not a classification: see
+# the README for what that does and does not guarantee.
+REDACT_NAMES = frozenset(
+    (
+        "key",
+        "token",
+        "secret",
+        "password",
+        "passphrase",
+        "private_key",
+        "privatekey",
+        "client_secret",
+        "api_key",
+        "access_token",
+        "refresh_token",
+    )
+)
+
+REDACT_SUFFIXES = ("_secret", "_password", "_token", "_private_key")
+
+
+class ExportError(Exception):
+    """Anything that should end the run with a readable message."""
+
+
+def is_redacted(name):
+    """True when a field with this name must never be written."""
+    low = name.lower()
+    if low in REDACT_NAMES:
+        return True
+    return any(low.endswith(suffix) for suffix in REDACT_SUFFIXES)
+
+
+def redact(value, path=(), dropped=None):
+    """Return value with every redacted field removed, structure preserved.
+
+    Collects the dotted path of each removed field into dropped.
+    """
+    if dropped is None:
+        dropped = set()
+    if isinstance(value, dict):
+        out = {}
+        for name in value:
+            here = path + (name,)
+            if is_redacted(name):
+                dropped.add(".".join(here))
+                continue
+            out[name] = redact(value[name], here, dropped)
+        return out
+    if isinstance(value, list):
+        return [redact(item, path, dropped) for item in value]
+    return value
+
+
+def flatten(value, prefix=""):
+    """Flatten one already redacted object into a single level of scalars.
+
+    A nested object becomes parent.child. Every list gets a <field>_count,
+    whatever it holds and even when it is empty, so that a column never appears
+    or disappears just because a list happened to be empty on one run. A list of
+    values also gets <field> with the values joined by a vertical bar; a list of
+    objects also gets <field>_ids when every object carries a string id.
+    """
+    flat = {}
+    if isinstance(value, dict):
+        for name in value:
+            key = prefix + "." + name if prefix else name
+            flat.update(flatten(value[name], key))
+        return flat
+    if isinstance(value, list):
+        flat[prefix + "_count"] = len(value)
+        if not value:
+            return flat
+        if all(isinstance(item, dict) for item in value):
+            ids = [item.get("id") for item in value]
+            if all(isinstance(one, str) for one in ids):
+                flat[prefix + "_ids"] = "|".join(ids)
+            return flat
+        flat[prefix] = "|".join("" if item is None else str(item) for item in value)
+        return flat
+    if isinstance(value, bool):
+        flat[prefix] = "true" if value else "false"
+        return flat
+    flat[prefix] = "" if value is None else value
+    return flat
+
+
+def columns_of(rows):
+    """The union of the keys of every row, id and name first, then sorted."""
+    seen = set()
+    for row in rows:
+        seen.update(row)
+    lead = [name for name in ("id", "name", "email") if name in seen]
+    rest = sorted(name for name in seen if name not in lead)
+    return lead + rest
+
+
+def to_csv(rows):
+    """Render rows as CSV text with a header line, newline terminated."""
+    cols = columns_of(rows)
+    buf = io.StringIO()
+    writer = csv.DictWriter(buf, fieldnames=cols, lineterminator="\n", restval="")
+    writer.writeheader()
+    for row in rows:
+        writer.writerow(row)
+    return buf.getvalue()
+
+
+def to_json(items):
+    """Render already redacted items as indented JSON text."""
+    return json.dumps(items, indent=2, sort_keys=True, ensure_ascii=False) + "\n"
+
+
+def auth_header(token, bearer=False):
+    """The Authorization header value.
+
+    Read from the upstream REST client: a personal access token created in the
+    management dashboard is sent as Token, an OAuth access token as Bearer.
+    """
+    return ("Bearer " if bearer else "Token ") + token
+
+
+class _NoRedirect(urllib.request.HTTPRedirectHandler):
+    """Refuses every redirect instead of following it.
+
+    The default opener would follow up to ten redirects and, doing so, would
+    copy the Authorization header onto the target, which can be another host.
+    An administration token is not something to hand to whatever a server
+    points at, so a redirect is an error here and says so.
+    """
+
+    def redirect_request(self, req, fp, code, msg, headers, newurl):
+        raise ExportError(
+            "%s answered HTTP %s, a redirect to %s. This tool does not follow "
+            "redirects, because following one would send your token to the "
+            "target. Point --url at the final address instead."
+            % (req.selector, code, newurl)
+        )
+
+
+_OPENER = urllib.request.build_opener(_NoRedirect)
+
+
+def http_fetch(url, path, header, timeout=30):
+    """GET one API path and decode its JSON body.
+
+    This is the only function in the package that touches the network. It sends
+    exactly one GET per call, never follows a redirect, and sends the token only
+    in the Authorization header of that one request.
+    """
+    request = urllib.request.Request(
+        url.rstrip("/") + path,
+        headers={"Authorization": header, "Accept": "application/json"},
+        method="GET",
+    )
+    try:
+        with _OPENER.open(request, timeout=timeout) as response:
+            raw = response.read()
+    except urllib.error.HTTPError as err:
+        raise ExportError(
+            "%s returned HTTP %s. A 401 or 403 usually means the token is wrong "
+            "or lacks the admin role." % (path, err.code)
+        )
+    except urllib.error.URLError as err:
+        raise ExportError("%s could not be reached: %s" % (path, err.reason))
+    try:
+        body = json.loads(raw.decode("utf-8"))
+    except (UnicodeDecodeError, ValueError):
+        raise ExportError("%s did not return JSON." % path)
+    if not isinstance(body, list):
+        raise ExportError("%s did not return a list of objects." % path)
+    return body
+
+
+def export(resources, url, header, fetch=http_fetch):
+    """Fetch and redact each resource.
+
+    Returns a mapping of resource name to a pair of the redacted items and the
+    sorted dotted paths of the fields that were dropped from them.
+    """
+    result = {}
+    for name in resources:
+        items = fetch(url, RESOURCES[name], header)
+        dropped = set()
+        clean = [redact(item, (), dropped) for item in items]
+        result[name] = (clean, sorted(dropped))
+    return result

netbirdexport-0.1.0/src/netbirdexport.egg-info/PKG-INFO

@@ -0,0 +1,123 @@
+Metadata-Version: 2.4
+Name: netbirdexport
+Version: 0.1.0
+Summary: Export a NetBird account inventory (peers, users, setup keys, groups) to CSV and JSON in one command, using your own access token. Standard library only.
+Author: Younes Z.
+License: MIT
+Project-URL: Homepage, https://github.com/Rezarys/netbirdexport
+Project-URL: Issues, https://github.com/Rezarys/netbirdexport/issues
+Keywords: netbird,wireguard,mesh vpn,inventory,export,csv,audit,backup,self hosted
+Classifier: Development Status :: 4 - Beta
+Classifier: Environment :: Console
+Classifier: Intended Audience :: System Administrators
+Classifier: Intended Audience :: Developers
+Classifier: License :: OSI Approved :: MIT License
+Classifier: Programming Language :: Python :: 3
+Classifier: Topic :: System :: Networking
+Classifier: Topic :: System :: Systems Administration
+Classifier: Topic :: Utilities
+Requires-Python: >=3.9
+Description-Content-Type: text/markdown
+License-File: LICENSE
+Dynamic: license-file
+
+# netbirdexport
+
+```
+pip install netbirdexport
+```
+
+Export your NetBird account inventory to CSV and JSON in one command, using your own access token. Peers, users, setup keys and groups, one CSV and one JSON file each, plus a manifest. Standard library only, no dependencies.
+
+Not affiliated with NetBird. "NetBird" is used here only to say which API this tool reads.
+
+## Why this exists
+
+In [netbirdio/netbird#4437](https://github.com/netbirdio/netbird/issues/4437), open since September 2025, `chirag-rastogi` wrote:
+
+> Currently, there's no way to download or back up information like the list of users, peers, or setup keys.
+
+The management API already exposes every one of those objects: `/api/users`, `/api/peers` and `/api/setup-keys` all exist and are read by the project's own REST client. The missing part was the one command that reads them and writes them out for an audit or a migration. That is all this tool is.
+
+## Use
+
+Create a personal access token in the management dashboard, then:
+
+```
+export NETBIRD_TOKEN=nbp_xxxxxxxxxxxxxxxx
+netbirdexport
+```
+
+```
+netbirdexport 0.1.0
+source  https://api.netbird.io
+output  netbird-export
+
+resource    rows  files
+peers          2  peers.csv, peers.json
+users          2  users.csv, users.json
+setup-keys     1  setup-keys.csv, setup-keys.json
+groups         2  groups.csv, groups.json
+
+never written, matched by field name: setup-keys.key
+wrote 9 files including manifest.json
+```
+
+The token is read from `NETBIRD_TOKEN` and is never accepted as a command line argument, so it does not appear in the argument list of the running process. It is still in that process's environment, and typing `export NETBIRD_TOKEN=...` at a prompt does put it in your shell history, so read it from a secret store or from a file you control if that matters to you.
+
+Self hosted, and more resources:
+
+```
+netbirdexport --url https://netbird.example.org --resources peers,users,setup-keys,groups,policies,routes,nameservers --out audit-2026-09
+```
+
+Options:
+
+- `--url` management API base URL, default `https://api.netbird.io`.
+- `--out` directory to write into, created if missing, default `netbird-export`.
+- `--resources` comma separated, in output order. Available: `peers`, `users`, `setup-keys`, `groups`, `policies`, `routes`, `nameservers`.
+- `--format` comma separated, `csv` and `json`, default both.
+- `--bearer` send the token as `Bearer` instead of `Token`, for an OAuth access token rather than a personal access token.
+- `--version` print the version and exit.
+
+Nothing is written until every request has succeeded, so a failure halfway through leaves no half exported directory behind.
+
+## What the two formats are for
+
+`<resource>.json` keeps the nested shape the API returned, which is what you want for a diff between two dates. `<resource>.csv` flattens the same objects to one row each: a nested object becomes a `parent.child` column, and every list gets a `<field>_count` column, whatever it holds and even when it is empty, so that a column never appears or disappears just because a list happened to be empty on one run. A list of values also gets `<field>` with the values joined by a vertical bar; a list of objects also gets `<field>_ids` when every object in the list carries a string `id`. Columns are the union of the keys seen across all rows, so a field that only some objects carry still gets a column.
+
+Columns are not a fixed list. This tool writes whatever the API returns, minus the redacted fields below, which means it does not silently drop a field that a newer server version added.
+
+`manifest.json` records the tool version, the source URL, the UTC time of the run, and for each resource its API path, its row count and the names of the fields that were dropped.
+
+## Secrets: what is dropped, and what that does not promise
+
+A field is never written when its own name, lowercased, is one of `key`, `token`, `secret`, `password`, `passphrase`, `private_key`, `privatekey`, `client_secret`, `api_key`, `access_token`, `refresh_token`, or ends with `_secret`, `_password`, `_token` or `_private_key`. This applies at every depth, inside nested objects and inside lists. Every dropped field is named on the console and in `manifest.json`, so nothing is removed silently.
+
+Read this next part before you share an export. **This is a match on field names, not a classification of content.** It drops the setup key field, which is named `key`, and it deliberately keeps fields like `setup_key_id` or `public_key`, which identify rather than authenticate. It cannot know that some future field with an innocent name holds something sensitive. An export of an administration inventory contains user emails, host names and internal addresses in any case: treat the output directory as sensitive, and read it before sending it anywhere.
+
+## Honest limits
+
+**This tool has never been run against a real NetBird instance.** It has no test deployment and no token behind it. Its test suite runs against example API responses written for those tests, and the shape of those responses follows the upstream project's public REST client and API specification, read on 2026-09-30. If you run it against a real account and something is wrong, open an issue and it will be fixed.
+
+It issues one GET per resource and sends nothing else of its own. It does not follow redirects: a redirect is reported as an error rather than followed, because following one would resend your `Authorization` header to whatever host the server pointed at. It never asks the API to change anything, because every request it makes is a GET.
+
+It does not paginate: it reads each list endpoint once and writes what came back. The project's own REST client takes no page parameter on these list calls, but if some server version paginates one of them, this tool would write only the first page, and that has not been tested against a real instance.
+
+It reads only a whole account: there is no filter by group, by name or by date. An export is the inventory as it stands at the moment of the run.
+
+An export is not a restore file. Nothing here writes back, the default set covers four resources out of seven, and a setup key cannot be recreated from an export because its value is deliberately absent. Treat the output as an audit and migration record, not as a backup you could restore from.
+
+`policies`, `routes` and `nameservers` are available but not exported by default. The default set is peers, users and setup keys, the three the request above named, plus groups, because a peer row carries group ids and those ids mean nothing without the group names.
+
+Python 3.9 or newer.
+
+## Upstream licence
+
+NetBird is published by NetBird GmbH and its authors. Its repository is BSD 3-Clause except the `management/`, `signal/`, `relay/` and `combined/` directories, which are GNU AGPL version 3. This package is MIT and is not derived from it: no upstream line is copied here. What was read is the public shape of its HTTP interface, and this tool is an outside client that speaks to that interface over the network.
+
+## Licence
+
+MIT, Younes Z. See `LICENSE`.
+
+Built with AI assistance, reviewed and tested by me.

netbirdexport-0.1.0/src/netbirdexport.egg-info/SOURCES.txt

@@ -0,0 +1,14 @@
+LICENSE
+README.md
+pyproject.toml
+src/netbirdexport/__init__.py
+src/netbirdexport/__main__.py
+src/netbirdexport/cli.py
+src/netbirdexport/core.py
+src/netbirdexport.egg-info/PKG-INFO
+src/netbirdexport.egg-info/SOURCES.txt
+src/netbirdexport.egg-info/dependency_links.txt
+src/netbirdexport.egg-info/entry_points.txt
+src/netbirdexport.egg-info/top_level.txt
+tests/test_cli.py
+tests/test_core.py

netbirdexport-0.1.0/src/netbirdexport.egg-info/dependency_links.txt

@@ -0,0 +1 @@
+

netbirdexport-0.1.0/src/netbirdexport.egg-info/entry_points.txt

@@ -0,0 +1,2 @@
+[console_scripts]
+netbirdexport = netbirdexport.cli:main

netbirdexport-0.1.0/src/netbirdexport.egg-info/top_level.txt

@@ -0,0 +1 @@
+netbirdexport

netbirdexport-0.1.0/tests/test_cli.py

@@ -0,0 +1,166 @@
+import csv
+import io
+import json
+import os
+import shutil
+import tempfile
+import unittest
+
+from fixtures import fake_fetch
+from netbirdexport.cli import TOKEN_ENV, run
+from netbirdexport.core import ExportError
+
+# The exact text the tool prints, also recopied by hand into the README. The
+# test below compares this constant to the tool's real output, so the tool
+# cannot change its output without turning this suite red. It does not read
+# README.md, so keeping the README in step with this constant stays a manual
+# step; what the suite guarantees is that this constant is not stale.
+README_SAMPLE = """netbirdexport 0.1.0
+source  https://api.netbird.io
+output  netbird-export
+
+resource    rows  files
+peers          2  peers.csv, peers.json
+users          2  users.csv, users.json
+setup-keys     1  setup-keys.csv, setup-keys.json
+groups         2  groups.csv, groups.json
+
+never written, matched by field name: setup-keys.key
+wrote 9 files including manifest.json
+"""
+
+
+class CliTest(unittest.TestCase):
+    def setUp(self):
+        self.tmp = tempfile.mkdtemp()
+        self.out = os.path.join(self.tmp, "netbird-export")
+        self.env = {TOKEN_ENV: "pat-example"}
+
+    def tearDown(self):
+        shutil.rmtree(self.tmp, ignore_errors=True)
+
+    def invoke(self, *extra):
+        stdout = io.StringIO()
+        code = run(
+            ["--out", self.out] + list(extra),
+            fetch=fake_fetch,
+            env=self.env,
+            stdout=stdout,
+        )
+        return code, stdout.getvalue()
+
+    def read(self, name):
+        with open(os.path.join(self.out, name), encoding="utf-8") as handle:
+            return handle.read()
+
+    def test_the_whole_rendering_is_the_one_shown_in_the_readme(self):
+        stdout = io.StringIO()
+        code = run([], fetch=fake_fetch, env=self.env, stdout=stdout)
+        try:
+            self.assertEqual(0, code)
+            self.assertEqual(README_SAMPLE, stdout.getvalue())
+        finally:
+            shutil.rmtree("netbird-export", ignore_errors=True)
+
+    def test_it_writes_one_csv_and_one_json_per_resource_plus_a_manifest(self):
+        code, _ = self.invoke()
+        self.assertEqual(0, code)
+        self.assertEqual(
+            sorted(
+                [
+                    "groups.csv",
+                    "groups.json",
+                    "manifest.json",
+                    "peers.csv",
+                    "peers.json",
+                    "setup-keys.csv",
+                    "setup-keys.json",
+                    "users.csv",
+                    "users.json",
+                ]
+            ),
+            sorted(os.listdir(self.out)),
+        )
+
+    def test_the_setup_key_value_is_in_no_written_byte_anywhere(self):
+        self.invoke()
+        for name in os.listdir(self.out):
+            self.assertNotIn("A616097E", self.read(name), name)
+
+    def test_the_manifest_names_the_fields_it_dropped(self):
+        self.invoke()
+        manifest = json.loads(self.read("manifest.json"))
+        self.assertEqual(["key"], manifest["resources"]["setup-keys"]["redacted_fields"])
+        self.assertEqual([], manifest["resources"]["peers"]["redacted_fields"])
+
+    def test_the_manifest_records_the_source_and_the_row_counts(self):
+        self.invoke("--url", "https://nb.example.org")
+        manifest = json.loads(self.read("manifest.json"))
+        self.assertEqual("https://nb.example.org", manifest["source"])
+        self.assertEqual(2, manifest["resources"]["peers"]["rows"])
+        self.assertEqual("/api/peers", manifest["resources"]["peers"]["path"])
+
+    def test_the_csv_has_a_header_and_one_line_per_object(self):
+        self.invoke()
+        rows = list(csv.DictReader(io.StringIO(self.read("peers.csv"))))
+        self.assertEqual(2, len(rows))
+        self.assertEqual("laptop-01", rows[0]["name"])
+        self.assertEqual("100.72.0.2", rows[1]["ip"])
+
+    def test_the_json_keeps_the_nested_shape_the_api_returned(self):
+        self.invoke()
+        peers = json.loads(self.read("peers.json"))
+        self.assertEqual("All", peers[0]["groups"][0]["name"])
+
+    def test_only_the_requested_resources_are_fetched_and_in_that_order(self):
+        code, text = self.invoke("--resources", "users,peers")
+        self.assertEqual(0, code)
+        self.assertEqual(["manifest.json", "peers.csv", "peers.json", "users.csv", "users.json"], sorted(os.listdir(self.out)))
+        self.assertLess(text.index("users "), text.index("peers "))
+
+    def test_asking_for_csv_only_writes_no_json_except_the_manifest(self):
+        self.invoke("--format", "csv")
+        self.assertEqual(
+            ["groups.csv", "manifest.json", "peers.csv", "setup-keys.csv", "users.csv"],
+            sorted(os.listdir(self.out)),
+        )
+
+    def test_a_repeated_resource_is_exported_once(self):
+        _, text = self.invoke("--resources", "peers,peers")
+        self.assertEqual(1, text.count("peers.csv"))
+
+    def test_a_missing_token_is_an_error_that_names_the_variable(self):
+        self.env = {}
+        with self.assertRaises(ExportError) as caught:
+            self.invoke()
+        self.assertIn(TOKEN_ENV, str(caught.exception))
+
+    def test_a_blank_token_counts_as_missing(self):
+        self.env = {TOKEN_ENV: "   "}
+        with self.assertRaises(ExportError):
+            self.invoke()
+
+    def test_an_unknown_resource_is_refused_and_the_list_is_shown(self):
+        with self.assertRaises(ExportError) as caught:
+            self.invoke("--resources", "peers,widgets")
+        self.assertIn("widgets", str(caught.exception))
+        self.assertIn("setup-keys", str(caught.exception))
+
+    def test_an_unknown_format_is_refused(self):
+        with self.assertRaises(ExportError):
+            self.invoke("--format", "xlsx")
+
+    def test_nothing_is_written_before_every_fetch_has_succeeded(self):
+        def failing(url, path, header, timeout=30):
+            if path == "/api/groups":
+                raise ExportError("boom")
+            return fake_fetch(url, path, header)
+
+        stdout = io.StringIO()
+        with self.assertRaises(ExportError):
+            run(["--out", self.out], fetch=failing, env=self.env, stdout=stdout)
+        self.assertFalse(os.path.exists(self.out))
+
+
+if __name__ == "__main__":
+    unittest.main()

netbirdexport-0.1.0/tests/test_core.py

@@ -0,0 +1,142 @@
+import unittest
+import urllib.request
+
+from fixtures import GROUPS, PEERS, SETUP_KEYS, USERS
+from netbirdexport.core import (
+    ExportError,
+    _NoRedirect,
+    auth_header,
+    columns_of,
+    flatten,
+    is_redacted,
+    redact,
+    to_csv,
+)
+
+
+class RedactionTest(unittest.TestCase):
+    def test_a_field_named_key_is_redacted_and_reported(self):
+        dropped = set()
+        clean = redact(SETUP_KEYS[0], (), dropped)
+        self.assertNotIn("key", clean)
+        self.assertEqual({"key"}, dropped)
+
+    def test_every_other_setup_key_field_survives(self):
+        clean = redact(SETUP_KEYS[0], (), set())
+        expected = set(SETUP_KEYS[0]) - {"key"}
+        self.assertEqual(expected, set(clean))
+
+    def test_the_name_match_is_case_insensitive_and_covers_suffixes(self):
+        for name in ("Key", "TOKEN", "client_secret", "db_password", "x_private_key"):
+            self.assertTrue(is_redacted(name), name)
+
+    def test_an_identifier_that_merely_mentions_a_key_is_kept(self):
+        for name in ("setup_key_id", "public_key", "keys_count", "monkey"):
+            self.assertFalse(is_redacted(name), name)
+
+    def test_redaction_reaches_inside_nested_objects_and_lists(self):
+        dropped = set()
+        clean = redact(
+            {"a": {"token": "t", "b": 1}, "c": [{"secret": "s", "d": 2}]}, (), dropped
+        )
+        self.assertEqual({"a": {"b": 1}, "c": [{"d": 2}]}, clean)
+        self.assertEqual({"a.token", "c.secret"}, dropped)
+
+    def test_redaction_does_not_mutate_its_input(self):
+        redact(SETUP_KEYS[0], (), set())
+        self.assertIn("key", SETUP_KEYS[0])
+
+
+class FlattenTest(unittest.TestCase):
+    def test_a_list_of_objects_becomes_a_count_and_the_joined_ids(self):
+        flat = flatten(PEERS[0])
+        self.assertEqual(2, flat["groups_count"])
+        self.assertEqual("ch8i4ug6lnn4g9hqv7m1|ch8i4ug6lnn4g9hqv7m2", flat["groups_ids"])
+
+    def test_an_empty_list_of_objects_is_a_zero_count_not_a_missing_column(self):
+        self.assertEqual({"auto_groups_count": 0}, flatten({"auto_groups": []}))
+
+    def test_a_list_of_scalars_is_joined_with_a_bar_and_still_counted(self):
+        self.assertEqual({"g": "a|b", "g_count": 2}, flatten({"g": ["a", "b"]}))
+
+    def test_every_list_gets_a_count_whether_it_holds_values_or_objects(self):
+        # Otherwise a column would appear or disappear between two runs only
+        # because a list happened to be empty, which reads as a server change.
+        for value in ([], ["a"], [{"id": "x"}]):
+            self.assertIn("g_count", flatten({"g": value}), value)
+
+    def test_booleans_are_written_as_words_not_as_python_repr(self):
+        flat = flatten(PEERS[0])
+        self.assertEqual("true", flat["connected"])
+        self.assertEqual("false", flat["ssh_enabled"])
+
+    def test_a_nested_object_is_dotted(self):
+        self.assertEqual({"a.b": 1}, flatten({"a": {"b": 1}}))
+
+    def test_none_becomes_an_empty_cell(self):
+        self.assertEqual({"a": ""}, flatten({"a": None}))
+
+    def test_no_flattened_column_of_a_peer_is_a_container(self):
+        for key, value in flatten(PEERS[1]).items():
+            self.assertNotIsInstance(value, (dict, list), key)
+
+
+class ColumnsTest(unittest.TestCase):
+    def test_identifying_columns_come_first_then_the_rest_sorted(self):
+        cols = columns_of([{"z": 1, "name": 2, "id": 3, "a": 4}])
+        self.assertEqual(["id", "name", "a", "z"], cols)
+
+    def test_columns_are_the_union_over_rows_so_a_sparse_row_is_not_dropped(self):
+        self.assertEqual(["id", "a", "b"], columns_of([{"id": 1, "a": 2}, {"b": 3}]))
+
+    def test_a_missing_value_is_written_as_an_empty_cell(self):
+        text = to_csv([{"id": "1", "a": "x"}, {"id": "2"}])
+        self.assertEqual("id,a\n1,x\n2,\n", text)
+
+
+class CsvTest(unittest.TestCase):
+    def test_the_header_is_present_even_with_no_rows(self):
+        self.assertEqual("\n", to_csv([]))
+
+    def test_a_group_renders_its_member_ids_in_one_cell(self):
+        rows = [flatten(redact(item, (), set())) for item in GROUPS]
+        text = to_csv(rows)
+        self.assertIn("ch8i4ug6lnn4g9hqv7m0|ch8i4ug6lnn4g9hqv7m5", text)
+
+    def test_a_user_email_is_exported_because_it_identifies_not_authenticates(self):
+        rows = [flatten(redact(item, (), set())) for item in USERS]
+        self.assertIn("ada@example.org", to_csv(rows))
+
+
+class RedirectTest(unittest.TestCase):
+    def test_a_redirect_is_refused_rather_than_followed(self):
+        # Following one would resend the Authorization header to the target,
+        # which the standard library opener does by default and this one must not.
+        request = urllib.request.Request("https://nb.example.org/api/peers")
+        with self.assertRaises(ExportError) as caught:
+            _NoRedirect().redirect_request(
+                request, None, 302, "Found", {}, "https://elsewhere.example/api/peers"
+            )
+        self.assertIn("elsewhere.example", str(caught.exception))
+
+    def test_the_opener_used_for_fetching_carries_no_redirect_handler(self):
+        from netbirdexport.core import _OPENER
+
+        followers = [
+            handler
+            for handler in _OPENER.handlers
+            if type(handler) is urllib.request.HTTPRedirectHandler
+        ]
+        self.assertEqual([], followers)
+
+
+class AuthHeaderTest(unittest.TestCase):
+    def test_a_personal_access_token_is_sent_as_token(self):
+        self.assertEqual("Token abc", auth_header("abc"))
+
+    def test_an_oauth_access_token_is_sent_as_bearer(self):
+        self.assertEqual("Bearer abc", auth_header("abc", bearer=True))
+
+
+if __name__ == "__main__":
+    unittest.main()