Security Roles

You can provide Enterprise Manager accounts with permissions by assigning them security roles. In the Veeam Backup Enterprise Manager web UI, you can assign one of the following roles to the account: Portal Administrator, Portal User or Restore Operator. For details on security roles in the Enterprise Manager web UI, see the Configuring Accounts and Roles section of the Veeam Backup Enterprise Manager User Guide.

Veeam Backup Enterprise Manager REST API implements the same idea but in a slightly different way. The REST API offers the following set of security roles:

Portal Administrator
Portal User
VM Restore Operator
File Restore Operator
Exchange Restore Operator
Oracle Restore Operator
SQL Restore Operator

You can assign multiple roles to an account. The set of roles depends on the resources and operations that you want to be available for the account. For details on how to assign a security role, see POST /security/accounts/{ID}/roles.

Role	Available Operations	Unavailable Operations
Portal Administrator	All	—
Portal User	Operations of the following resources: /agents: GET /agents GET /agents/backups GET /agents/backupFiles GET /agents/backupSessions GET /agents/restorePoints GET /agents/agentRestorePoints GET /agents/agentRestorePoints/{ID} GET /agents/agentRestorePoints/{ID}/mounts/{ID}/{filepath} /backupFiles (all) /backups (all) /backupServers: GET /backupServers GET /backupServers/{ID} POST /backupServers/{ID}?action=veeamzip POST /backupServers/{ID}?action=quickbackup POST /backupServers/{ID}?action=collect GET /backupServers/{ID}/credentials GET /backupServers/{ID}/credentials/{ID} GET /backupServers/{ID}/passwords GET /backupServers/{ID}/passwords/{ID} GET /backupServers/{ID}/externalRepositories /backupSessions: GET /backupSessions GET /backupSessions/{ID} GET /backupSessions/{ID}/taskSessions GET /backupSessions/{ID}/agentManagementSessions /backupTaskSessions (all) /catalog/vms (all) /cdpReplicaSessions (all) /cdpReplicaTaskSessions (all) /cloud: /cloud/gateways (all) /cloud/gatewayPools (all) /cloud/tenants (all) /cloud/hardwarePlans (all) /cloud/publicIpAddresses (all) /cloud/failoverSessions (all) /cloud/replicas (all) /cloud/vmReplicaPoints (all) /cloud/vlans (all) /externalRepositories (all) /hierarchyRoots (all) /lookupSvc (all) /managedServers (all) /nas: GET /nas GET /nas/jobs/{ID}/backupSessions GET /nas/fileServers GET /nas/fileServers/{ID} GET /nas/backupSessions /querySvc: GET /querySvc GET /query?type=AgentRestorePoint GET /query?type=Backup GET /query?type=BackupFile GET /query?type=BackupJobSession GET /query?type=BackupServer GET /query?type=BackupTaskSession GET /query?type=CdpReplicaSession GET /query?type=CdpReplicaTaskSession GET /query?type=CloudGatewayPool GET /query?type=Credentials GET /query?type=FileServer GET /query?type=HierarchyRoot GET /query?type=ManagedServer GET /query?type=Passwords GET /query?type=Replica GET /query?type=ReplicaJobSession GET /query?type=ReplicaTaskSession GET /query?type=Repository GET /query?type=RestorePoint GET /query?type=RestoreSession GET /query?type=Task GET /query?type=vAppReplicaPoint GET /query?type=vAppRestorePoint GET /query?type=VCloudOrganizationConfig GET /query?type=VmReplicaPoint GET /query?type=VmRestorePoint GET /query?type=VsphereSelfServiceConfig GET /query?type=WanAccelerator /replicas (all) /replicaSessions (all) /replicaTaskSessions (all) /reports/summary (all) /repositories (all) /restorePoints (all) /restoreSessions (all) /selfService/vSphere: GET /selfService/vSphere GET /selfService/vSphere/Configs GET /selfService/vSphere/Configs/{ID} GET /selfService/vSphere/Configs/{ID}/backupJobSettings /tasks (all) /vCloud: GET /vCloud GET /vCloud/orgConfigs GET /vCloud/orgConfigs/{ID} POST /vCloud/orgConfigs/{ID}?action=disable GET /vCloud/orgConfigs/{ID}/backupJobSettings /vAppReplicaPoints (all) /vAppRestorePoints (all) /vmReplicaPoints: GET /vmReplicaPoints GET /vmReplicaPoints/{ID} POST /vmReplicaPoints/{ID}?action=failover GET /vmReplicaPoints/{ID}/mounts/{ID}/{filepath} /vmRestorePoints: GET /vmRestorePoints GET /vmRestorePoints/{ID} GET /vmRestorePoints/{ID}/mounts/{ID}/{filepath} /wanAccelerators (all)	Operations of the following resources: /agents: GET /agents/discoveredComputers GET /agents/discoveredComputers/{ID} GET /agents/protectionGroups GET /agents/protectionGroups/{ID} GET /agents/protectionGroups/{ID}/discoveredComputers GET /agents/jobs GET /agents/jobs/{ID} POST /agents/jobs/{ID}?action=start POST /agents/jobs/{ID}?action=stop POST /agents/jobs/{ID}?action=retry POST /agents/jobs/{ID}?action=toggleScheduleEnabled GET /agents/jobs/{ID}/includes GET /agents/jobs/{ID}/includes/{ID} POST /agents/agentRestorePoints/{ID}/mounts GET /agents/agentRestorePoints/{ID}/mounts GET /agents/agentRestorePoints/{ID}/mounts/{ID} DELETE /agents/agentRestorePoints/{ID}/mounts/{ID} POST /agents/agentRestorePoints/{ID}/mounts/{ID}/{filepath}?action=restore /backupServers: POST /backupServers?action=create PUT /backupServers/{ID} DELETE /backupServers/{ID} PUT /backupServers/{ID}/credentials/{ID} DELETE /backupServers/{ID}/credentials/{ID} POST /backupServers/{ID}/passwords?action=create PUT /backupServers/{ID}/passwords/{ID} DELETE /backupServers/{ID}/passwords/{ID} /backupSessions: POST /backupSessions/{ID}?action=stop /cdpPolicies (all) /cdpReplicas (all) /cloud: /cloud/cloudFailoverPlans (all) /failoverPlans (all) /jobs (all) /nas: GET /nas/jobs GET /nas/jobs/{ID} POST /nas/jobs/{ID}/start POST /nas/jobs/{ID}/stop POST /nas/jobs/{ID}/retry POST /nas/jobs/{ID}/toggleScheduleEnabled GET /nas/jobs/{ID}/includes GET /nas/jobs/{ID}/includes/{ID} /security (all) /selfService/vSphere: POST /selfService/vSphere/Configs PUT /selfService/vSphere/Configs/{ID} DELETE /selfService/vSphere/Configs/{ID} /querySvc: GET /query?type=AgentBackupJob GET /query?type=AgentProtectionGroup GET /query?type=CdpPolicy GET /query?type=CdpReplica GET /query?type=DiscoveredComputer GET /query?type=FailoverPlan GET /query?type=Job GET /query?type=NasJob GET /query?type=NasObject GET /query?type=ObjectInJob GET /query?type=VlanConfiguration /vCloud: POST /vCloud/orgConfigs PUT /vCloud/orgConfigs/{ID} DELETE /vCloud/orgConfigs/{ID} /vmReplicaPoints: POST /vmReplicaPoints/{ID}/mounts GET /vmReplicaPoints/{ID}/mounts GET /vmReplicaPoints/{ID}/mounts/{ID} DELETE /vmReplicaPoints/{ID}/mounts/{ID} POST /vmReplicaPoints/{ID}/mounts/{ID}/{filepath}?action=restore /vmRestorePoints: POST /vmRestorePoints/{ID}?action=restore POST /vmRestorePoints/{ID}/mounts GET /vmRestorePoints/{ID}/mounts GET /vmRestorePoints/{ID}/mounts/{ID} DELETE /vmRestorePoints/{ID}/mounts/{ID} POST /vmRestorePoints/{ID}/mounts/{ID}/{filepath}?action=restore
VM Restore Operator	Operations of the following resources: /agents: GET /agents GET /agents/backups GET /agents/restorePoints GET /agents/agentRestorePoints/{ID}/mounts/{ID}/{filepath} /backupFiles: GET /backupFiles/{ID}/restorePoints /backups (all) /catalog/vms (all) /cloud: GET /cloud/cloudFailoverPlans GET /cloud/cloudFailoverPlans/{ID} POST /cloud/cloudFailoverPlans/{ID}?action=start POST /cloud/cloudFailoverPlans/{ID}?action=test POST /cloud/cloudFailoverPlans/{ID}?action=undo GET /cloud/cloudFailoverPlans/{ID}/includes GET /cloud/cloudFailoverPlans/{ID}/includes/{ID} /cloud/failoverSessions (all) /failoverPlans: GET /failoverPlans GET /failoverPlans/{ID} POST /failoverPlans/{ID}?action=start POST /failoverPlans/{ID}?action=undo /querySvc: GET /querySvc GET /query?type=Backup GET /query?type=FailoverPlan GET /query?type=Replica GET /query?type=RestorePoint GET /query?type=RestoreSession GET /query?type=Task GET /query?type=vAppReplicaPoint GET /query?type=vAppRestorePoint GET /query?type=VmReplicaPoint GET /query?type=VmRestorePoint /replicas (all) /restorePoints: GET /restorePoints GET /restorePoints/{ID} GET /restorePoints/{ID}/vAppRestorePoints /restoreSessions (all) /tasks (all) /vAppReplicaPoints (all) /vAppRestorePoints (all) /vmReplicaPoints: GET /vmReplicaPoints GET /vmReplicaPoints/{ID} POST /vmReplicaPoints/{ID}?action=failover GET /vmReplicaPoints/{ID}/mounts/{ID}/{filepath} /vmRestorePoints: GET /vmRestorePoints GET /vmRestorePoints/{ID} POST /vmRestorePoints/{ID}?action=restore GET /vmRestorePoints/{ID}/mounts/{ID}/{filepath}	Operations of the following resources: /agents: GET /agents/discoveredComputers GET /agents/discoveredComputers/{ID} GET /agents/protectionGroups GET /agents/protectionGroups/{ID} GET /agents/protectionGroups/{ID}/discoveredComputers GET /agents/jobs GET /agents/jobs/{ID} POST /agents/jobs/{ID}?action=start POST /agents/jobs/{ID}?action=stop POST /agents/jobs/{ID}?action=retry POST /agents/jobs/{ID}?action=toggleScheduleEnabled GET /agents/jobs/{ID}/includes GET /agents/jobs/{ID}/includes/{ID} GET /agents/backupFiles GET /agents/backupSessions GET /agents/agentRestorePoints GET /agents/agentRestorePoints/{ID} POST /agents/agentRestorePoints/{ID}/mounts GET /agents/agentRestorePoints/{ID}/mounts GET /agents/agentRestorePoints/{ID}/mounts/{ID} DELETE /agents/agentRestorePoints/{ID}/mounts/{ID} POST /agents/agentRestorePoints/{ID}/mounts/{ID}/{filepath}?action=restore /backupFiles: GET /backupFiles GET /backupFiles/{ID} GET /backupFiles/{ID}/vmRestorePoints /backupServers (all) /backupSessions (all) /backupTaskSessions (all) /cdpPolicies (all) /cdpReplicas (all) /cdpReplicaSessions (all) /cdpReplicaTaskSessions (all) /cloud: /cloud/gateways (all) /cloud/gatewayPools (all) /cloud/tenants (all) /cloud/hardwarePlans (all) /cloud/publicIpAddresses (all) /cloud/replicas (all) /cloud/vmReplicaPoints (all) PUT /cloud/cloudFailoverPlans/{ID} DELETE /cloud/cloudFailoverPlans/{ID} /cloud/vlans (all) /externalRepositories (all) /failoverPlans: PUT /failoverPlans/{ID} /hierarchyRoots (all) /jobs (all) /lookupSvc (all) /managedServers (all) /nas (all) /querySvc: GET /query?type=AgentBackupJob GET /query?type=AgentProtectionGroup GET /query?type=AgentRestorePoint GET /query?type=BackupFile GET /query?type=BackupJobSession GET /query?type=BackupServer GET /query?type=BackupTaskSession GET /query?type=CdpPolicy GET /query?type=CdpReplica GET /query?type=CdpReplicaSession GET /query?type=CdpReplicaTaskSession GET /query?type=CloudGatewayPool GET /query?type=Credentials GET /query?type=DiscoveredComputer GET /query?type=FileServer GET /query?type=HierarchyRoot GET /query?type=Job GET /query?type=ManagedServer GET /query?type=NasJob GET /query?type=NasObject GET /query?type=ObjectInJob GET /query?type=Passwords GET /query?type=ReplicaJobSession GET /query?type=ReplicaTaskSession GET /query?type=Repository GET /query?type=VCloudOrganizationConfig GET /query?type=VlanConfiguration GET /query?type=VsphereSelfServiceConfig GET /query?type=WanAccelerator /replicaSessions (all) /replicaTaskSessions (all) /reports/summary (all) /repositories (all) /restorePoints: GET /restorePoints/{ID}/backupFiles GET /restorePoints/{ID}/vmRestorePoints GET /restorePoints/{ID}/agentRestorePoints /security (all) /selfService/vSphere (all) /vCloud (all) /vmReplicaPoints: POST /vmReplicaPoints/{ID}/mounts GET /vmReplicaPoints/{ID}/mounts GET /vmReplicaPoints/{ID}/mounts/{ID} DELETE /vmReplicaPoints/{ID}/mounts/{ID} POST /vmReplicaPoints/{ID}/mounts/{ID}/{filepath}?action=restore /vmRestorePoints: POST /vmRestorePoints/{ID}/mounts GET /vmRestorePoints/{ID}/mounts GET /vmRestorePoints/{ID}/mounts/{ID} DELETE /vmRestorePoints/{ID}/mounts/{ID} POST /vmRestorePoints/{ID}/mounts/{ID}/{filepath}?action=restore /wanAccelerators (all)
File Restore Operator	Operations of the following resources: /agents: GET /agents GET /agents/backups GET /agents/restorePoints POST /agents/agentRestorePoints/{ID}/mounts GET /agents/agentRestorePoints/{ID}/mounts GET /agents/agentRestorePoints/{ID}/mounts/{ID} DELETE /agents/agentRestorePoints/{ID}/mounts/{ID} GET /agents/agentRestorePoints/{ID}/mounts/{ID}/{filepath} POST /agents/agentRestorePoints/{ID}/mounts/{ID}/{filepath}?action=restore /backupFiles: GET /backupFiles/{ID}/restorePoints /backups (all) /catalog/vms (all) /cloud: GET /cloud/cloudFailoverPlans GET /cloud/cloudFailoverPlans/{ID} POST /cloud/cloudFailoverPlans/{ID}?action=start POST /cloud/cloudFailoverPlans/{ID}?action=test POST /cloud/cloudFailoverPlans/{ID}?action=undo GET /cloud/cloudFailoverPlans/{ID}/includes GET /cloud/cloudFailoverPlans/{ID}/includes/{ID} /cloud/failoverSessions (all) /failoverPlans: GET /failoverPlans GET /failoverPlans/{ID} POST /failoverPlans/{ID}?action=start POST /failoverPlans/{ID}?action=undo } /querySvc: GET /querySvc GET /query?type=Backup GET /query?type=FailoverPlan GET /query?type=Replica GET /query?type=RestorePoint GET /query?type=RestoreSession GET /query?type=Task GET /query?type=vAppReplicaPoint GET /query?type=vAppRestorePoint GET /query?type=VmReplicaPoint GET /query?type=VmRestorePoint /replicas (all) /restorePoints: GET /restorePoints GET /restorePoints/{ID} GET /restorePoints/{ID}/vAppRestorePoints /restoreSessions (all) /tasks (all) /vAppReplicaPoints (all) /vAppRestorePoints (all) /vmReplicaPoints (all) /vmRestorePoints: GET /vmRestorePoints GET /vmRestorePoints/{ID} POST /vmRestorePoints/{ID}/mounts GET /vmRestorePoints/{ID}/mounts GET /vmRestorePoints/{ID}/mounts/{ID} DELETE /vmRestorePoints/{ID}/mounts/{ID} POST /vmRestorePoints/{ID}/mounts/{ID}/{filepath}?action=restore GET /vmRestorePoints/{ID}/mounts/{ID}/{filepath}	Operations of the following resources: /agents: GET /agents/discoveredComputers GET /agents/discoveredComputers/{ID} GET /agents/protectionGroups GET /agents/protectionGroups/{ID} GET /agents/protectionGroups/{ID}/discoveredComputers GET /agents/jobs GET /agents/jobs/{ID} POST /agents/jobs/{ID}?action=start POST /agents/jobs/{ID}?action=stop POST /agents/jobs/{ID}?action=retry POST /agents/jobs/{ID}?action=toggleScheduleEnabled GET /agents/jobs/{ID}/includes GET /agents/jobs/{ID}/includes/{ID} GET /agents/backupFiles GET /agents/backupSessions GET /agents/agentRestorePoints GET /agents/agentRestorePoints/{ID} /backupFiles: GET /backupFiles GET /backupFiles/{ID} GET /backupFiles/{ID}/vmRestorePoints /backupServers (all) /backupSessions (all) /backupTaskSessions (all) /cdpPolicies (all) /cdpReplicas (all) /cdpReplicaSessions (all) /cdpReplicaTaskSessions (all) /cloud: /cloud/gateways (all) /cloud/gatewayPools (all) /cloud/tenants (all) /cloud/hardwarePlans (all) /cloud/publicIpAddresses (all) /cloud/replicas (all) /cloud/vmReplicaPoints (all) PUT /cloud/cloudFailoverPlans/{ID} DELETE /cloud/cloudFailoverPlans/{ID} /cloud/vlans (all) /externalRepositories (all) /failoverPlans: PUT /failoverPlans/{ID} /hierarchyRoots (all) /jobs (all) /lookupSvc (all) /managedServers (all) /nas (all) /querySvc: GET /query?type=AgentBackupJob GET /query?type=AgentProtectionGroup GET /query?type=AgentRestorePoint GET /query?type=BackupFile GET /query?type=BackupJobSession GET /query?type=BackupServer GET /query?type=BackupTaskSession GET /query?type=CdpPolicy GET /query?type=CdpReplica GET /query?type=CdpReplicaSession GET /query?type=CdpReplicaTaskSession GET /query?type=CloudGatewayPool GET /query?type=Credentials GET /query?type=DiscoveredComputer GET /query?type=FileServer GET /query?type=HierarchyRoot GET /query?type=Job GET /query?type=ManagedServer GET /query?type=NasJob GET /query?type=NasObject GET /query?type=ObjectInJob GET /query?type=Passwords GET /query?type=ReplicaJobSession GET /query?type=ReplicaTaskSession GET /query?type=Repository GET /query?type=VCloudOrganizationConfig GET /query?type=VlanConfiguration GET /query?type=VsphereSelfServiceConfig GET /query?type=WanAccelerator /replicaSessions (all) /replicaTaskSessions (all) /reports/summary (all) /repositories (all) /restorePoints: GET /restorePoints/{ID}/backupFiles GET /restorePoints/{ID}/vmRestorePoints GET /restorePoints/{ID}/agentRestorePoints /security (all) /selfService/vSphere (all) /vCloud (all) /vmRestorePoints: POST /vmRestorePoints/{ID}?action=restore /wanAccelerators (all)
Exchange Restore Operator, Oracle Restore Operator, SQL Restore Operator	Operations of the following resources: /catalog/vms (all) /failoverPlans: GET /failoverPlans GET /failoverPlans/{ID} POST /failoverPlans/{ID}?action=start POST /failoverPlans/{ID}?action=undo /restoreSessions (all) /tasks (all)	Operations of the following resources: /agents (all) /backupFiles (all) /backups (all) /backupServers (all) /backupSessions (all) /backupTaskSessions (all) /cdpPolicies (all) /cdpReplicas (all) /cdpReplicaSessions (all) /cdpReplicaTaskSessions (all) /cloud (all) /externalRepositories (all) /failoverPlans: PUT /failoverPlans/{ID} /hierarchyRoots (all) /jobs (all) /lookupSvc (all) /managedServers (all) /nas (all) /querySvc (all) /replicas (all) /replicaSessions (all) /replicaTaskSessions (all) /reports/summary (all) /repositories (all) /restorePoints (all) /security (all) /selfService/vSphere (all) /vAppReplicaPoints (all) /vAppRestorePoints (all) /vCloud (all) /vmReplicaPoints (all) /vmRestorePoints (all) /wanAccelerators (all)