Veeam Backup & Replication 13
REST API Reference
Related documents

Login

The authorization process involves obtaining an access token and a refresh token. For details on the authorization process and security settings, see Authorization and Security.

Get Access Token

The HTTP POST request to the /api/oauth2/token path allows you to get an access token and a refresh token.

Available to: All built-in user roles. Authentication with custom roles is not allowed.

Request
header Parameters
x-api-version
required
string
Default: 1.3-rev0

Version and revision of the client REST API. Must be in the following format: <version>-<revision>.

Request Body schema: application/x-www-form-urlencoded
required
grant_type
required
string (ELoginGrantType)
Default: "password"

Authorization grant type.

Available values:

  • password — used to obtain an access token by providing a user name and password.
  • refresh_token — used to refresh an expired or lost access token by providing a refresh token.
  • authorization_code — used to obtain an access token by providing an authorization code.
  • vbr_token — used to obtain an access token by providing a Veeam Backup & Replication token. This grant type is only used in a restricted mode for integration with Veeam Backup & Replication.

Enum: "password" "refresh_token" "authorization_code" "vbr_token"
username
string

User name. Required if the grant_type value is password.

password
string <password>

Password. Required if the grant_type value is password.

refresh_token
string

Refresh token. Required if the grant_type value is refresh_token.

code
string

Authorization code. Required if the grant_type value is authorization_code.

use_short_term_refresh
boolean

If true, a short-term refresh token is used. Lifetime of the short-term refresh token is the access token lifetime plus 15 minutes.

vbr_token
string
Deprecated

Veeam Backup & Replication platform service token.

Responses
200

OK

400

Bad request. This error is related to POST/PUT requests. The request body is malformed, incomplete or otherwise invalid.

401

Unauthorized. The authorization header has been expected but not found (or found but is expired).

403

Forbidden. The user sending the request does not have adequate privileges to access one or more objects specified in the request.

500

Internal server error. The request has been received but could not be completed because of an internal error at the server side.

post/api/oauth2/token
Request samples
application/x-www-form-urlencoded
grant_type=password&username=string&password=pa%24%24word&refresh_token=string&code=string&use_short_term_refresh=true&vbr_token=string
Response samples
application/json
{
  • "access_token": "eyJhbGciOiJSUzUxMiIsImtpZCI6IjRFOTE2QjIwMTkzMENEOUFFNDRDMjAwMTlGODdGMkE0RUYyMjczMDMiLCJ0eXAiOiJKV1QifQ.eyJ1bmlxdWVfbmFtZSI6InNoZWlsYS5kLmNvcnkiLCJuYmYiOjE2NDMwMzA2NTgsImV4cCI6MTY0MzAzMTU1OCwiaWF0IjoxNjQzMDMwNjU4LCJhdWQiOiJhY2Nlc3MifQ.PYyLnd-AGcQDiMN6RibL_3D-IzngzGqM0Du0huiEbswyqB9JATF3PJvPPKQn1H27xYEiznDyhAnbs9qZNNXlK0E7yRZbifUat16C1XDCvKFXAkije_44xakcUf5aUeU5YVRyjHa-hTRTkwISj9lBCNf_WdpttkK2stgyRCafrj057ATgUyru6o5gZhTYIS4cioAXmhvLvB7Qrn4X080DHH0-KqYeSQwnQASi1HDuogfkEmxyu8380fbGJiyK4eKGLJ2hmq5DsMmL0BSSzIvUiifLPS5_Ei4-9EOFOv3RlLmk6eQNefaLrkRSsV7QSgGZDLc98zIBlD2yrUccx2cj9A",
  • "token_type": "bearer",
  • "refresh_token": "eyJhbGciOiJSUzUxMiIsImtpZCI6IjRFOTE2QjIwMTkzMENEOUFFNDRDMjAwMTlGODdGMkE0RUYyMjczMDMiLCJ0eXAiOiJKV1QifQ.eyJ1bmlxdWVfbmFtZSI6InNoZWlsYS5kLmNvcnkiLCJ0b2tlbl9pZCI6IjEwNTA4YWUyLTk0YzctNGRkNi04YzEyLWZjNGY1NDQ1MzM0YSIsInNob3J0X3Rlcm1fZXhwaXJhdGlvbiI6IkZhbHNlIiwibmJmIjoxNjQzMDMwNjU5LCJleHAiOjE2NDQyNDAyNTksImlhdCI6MTY0MzAzMDY1OSwiYXVkIjoicmVmcmVzaCJ9.RXx9xPlpoUuRwO7sTkBTXntpc3vixXc2kgfCPfRcpePdzOGbLqn64c1hCHTGgXPKgZ4ogEY58N2D3xUPd6spAdfbOkF_XwjEEDpxf03rl7LYMo-OXQ0PxVtUCJK3_o6Dfah0YV6IYu5yctvd-_1MKaac7vV5Zl87qhlF8w4e7LT0QPD_Vhp2JUoD3dSTvYw9WvNDqaRotYfaWj05yTB3PArVwSiPDg1oZXSLxROmDDtKf5FFqSgOdp4LxJmD6sYlv_2FQqG-tNwPqRyzKIaqiDDQXBR9MVmFHBl9iUcYOqvX9ZlCa7oPP_txjopks-NcpdyPkSH74hvoeOs3hujW8w",
  • "expires_in": 900,
  • ".issued": "2025-04-24T14:24:18+01:00",
  • ".expires": "2025-04-24T14:39:18+01:00"
}

Log Out

The HTTP POST request to the /api/oauth2/logout path allows you to perform the logout operation. After you log out, your access and refresh tokens are expired.

Available to: All user roles.

SecurityBearer
Request
header Parameters
x-api-version
required
string
Default: 1.3-rev0

Version and revision of the client REST API. Must be in the following format: <version>-<revision>.

Responses
200

OK

401

Unauthorized. The authorization header has been expected but not found (or found but is expired).

403

Forbidden. The user sending the request does not have adequate privileges to access one or more objects specified in the request.

500

Internal server error. The request has been received but could not be completed because of an internal error at the server side.

post/api/oauth2/logout
Request samples 
Response samples 
application/json
{ }