Authorization

Veeam Backup for Google Cloud REST API authorization process involves obtaining an access token — a string that represents authorization issued to the user and that must be sent in the Bearer <Access-Token> format in the Authorization header in all requests during the current logon session. The /token resource collection allows a Veeam Backup for Google Cloud user to authenticate himself and authorize his access to the Veeam Backup for Google Cloud REST API.
To learn more about the authorization process and security settings, see the Veeam Backup for Google Cloud REST API Reference Overview, section Authorization and Security.

Request Authorization Tokens

The HTTP POST request to the /token endpoint allows you to authorize your access to the Veeam Backup for Google Cloud REST API.

Request
header Parameters
x-api-version
required
string
Default: 1.4-rev0

Specifies the current revision of the Veeam Backup for Google Cloud REST API.

Request Body schema: application/x-www-form-urlencoded
required
grant_type
required
string

Grant type that will be used to authenticate a user.

Enum: "password" "refresh_token" "authorization_code" "mfa"
username
string

[Required if the grant_type parameter value is password] User name.

password
string <password>

[Required if the grant_type parameter value is password] Password of the user.

refresh_token
string

[Required if the grant_type parameter value is refresh_token] Refresh token.

use_short_term_refresh
boolean

Defines whether to decrease the refresh token lifetime to 60 minutes.

code
string

[Required if the grant_type parameter value is authorization_code] Authorization code.

mfa_token
string

[Required if the grant_type parameter value is mfa] MFA token.

mfa_code
string

[Required if the grant_type parameter value is mfa] Verification code.

Responses
200

OK

202

Accepted

400

Bad Request. The request body is malformed, incomplete or otherwise invalid.

401

Unauthorized. The authorization header has been expected but not found (or found but is expired).

403

Forbidden. The user sending a request does not have adequate privileges to access one or more objects specified in the request.

500

Internal Server Error. The request has been received but could not be completed because of an internal error at the server side.

post/api/v1/token
Request samples
application/x-www-form-urlencoded
grant_type=password&username=string&password=pa%24%24word&refresh_token=string&use_short_term_refresh=true&code=string&mfa_token=string&mfa_code=string
Response samples
application/json
{
  • "access_token": "string",
  • "token_type": "string",
  • "refresh_token": "string",
  • "expires_in": 0,
  • ".issued": "2019-08-24T14:15:22Z",
  • ".expires": "2019-08-24T14:15:22Z"
}

Logout

The HTTP DELETE request to the /token endpoint performs the logout operation for an authorized user.

SecurityBearer
Request
header Parameters
x-api-version
required
string
Default: 1.4-rev0

Specifies the current revision of the Veeam Backup for Google Cloud REST API.

Responses
204

No Content

400

Bad Request. The request body is malformed, incomplete or otherwise invalid.

401

Unauthorized. The authorization header has been expected but not found (or found but is expired).

500

Internal Server Error. The request has been received but could not be completed because of an internal error at the server side.

delete/api/v1/token
Request samples
Response samples
{
  • "errorCode": "AccessDenied",
  • "message": "string",
  • "type": "string",
  • "title": "string",
  • "status": 0,
  • "details": "string",
  • "instance": "string",
  • "resourceId": "string",
  • "Data": { }
}

Get Authorization Code

The HTTP POST request to the authorization_code endpoint returns an authorization code used to obtain an access and a refresh tokens.

NOTE
Only an authorized user can obtain the authorization code.
SecurityBearer
Request
header Parameters
x-api-version
required
string
Default: 1.4-rev0

Specifies the current revision of the Veeam Backup for Google Cloud REST API.

Responses
200

OK

400

Bad Request. The request body is malformed, incomplete or otherwise invalid

401

Unauthorized. The authorization header has been expected but not found (or found but is expired).

403

Forbidden. The user sending a request does not have adequate privileges to access one or more objects specified in the request.

500

Internal Server Error. The request has been received but could not be completed because of an internal error at the server side.

post/api/v1/authorizationCode
Request samples
Response samples
application/json
{
  • "code": "string"
}

Document updated 11/19/2025

Page content applies to build 7.0.0.47