Start here. This is the direct spoken answer to practice first.
Why this question matters
Large exports combine API latency, data volume, background processing, storage, authorization, and user-visible progress. The request path must stay bounded while the generated artifact remains durable and securely retrievable.
I would avoid generating a large report inside the HTTP request. The API would create an export job record, validate the user's permission, enqueue a message with the job id, and return a status URL. A worker would load the data in pages or streams, generate the file, store it durably, and mark the job complete with a download link. The user can poll or receive a notification when the export is ready.