# Moving accounts to another host An operator winding a server down hands each account's data to its next host. This page is that handover, one account at a time or every account at once. A whole deployment moves by [zone handoff](zone-handoff.md) instead. ## Stop the writes `didbot account lock --server ` refuses the account's writes and leaves its repository readable. An export taken after the lock is the account's last state. An export taken without one is still one snapshot with one head; writes after it are not in it. ## Export ```sh didbot account export kestrel.agents.example --out ./kestrel --server pds.example didbot account export --all --out ./evacuation --server pds.example ``` The first writes one account into `./kestrel`. `--all` writes every account, one at a time, each into a directory beneath `./evacuation` named by its host. The output directory must be new or empty. An account whose repository the server does not serve, because it is erased, suspended or deactivated, is listed with the server's reason and the run goes on. On the dashboard, the Accounts tab's Show opens an account, and its Export downloads the same export as `.tar`. `tar -xf .tar -C ` unpacks it to the same files. Each export holds: | File | What it is | |---|---| | `repo.car` | The repository as `com.atproto.sync.getRepo` answers it | | `blobs/` | Every blob a record names, filed under its CID | | `did.json` | The account's DID document | | `manifest.json` | The DID, handle, head commit, revision, record and blob counts, export time and server revision | The server takes all of it from one snapshot of the repository, checks it against the account's own DID document, and hashes each blob as it streams. The command checks what arrived the way `verify-export` does. An export is a read: run it as often as needed. ## Check ```sh didbot account verify-export ./evacuation ``` This takes one export, or every export directly beneath a directory, and needs nothing but the files. Every block and blob must hash to its name, the commit must verify against the `#atproto` key in `did.json`, `did.json` must claim the manifest's handle, and the manifest must agree with the repository. It prints the key each export verified against. A recipient compares that key with the document the account's name resolves to, `https:///.well-known/did.json`, so the check does not rest on the server that wrote the export. ## Hand over The next host imports `repo.car` with `com.atproto.repo.importRepo` and each blob with `com.atproto.repo.uploadBlob`. The account's signing key stays on this server, and its DID document keeps naming this server's key and endpoint. Whether the key is exported, rotated to one the new host holds, or the account migrates another way is the owner's decision in [evacuation](../plan/evacuation.md), options B to D.