This section contains quick start guides on how to perform complex scenarios with Veeam Backup & Replication REST API.

You can perform mass deployment of your backup infrastructure by using the Automation section of the REST API. The section includes methods that let you import and export resources in the JSON format. You can use these methods, for example, to set up your backup infrastructure from a JSON specification or to migrate your infrastructure from one backup server to another.

The Automation section includes dedicated methods for individual resources, so you can export and import resources granularly.

Exported resources do not include IDs. All credentials are exported with empty passwords, passphrases and private keys. Before you export resources that contain sensitive data, you can mark them by using tag parameters.

As soon as you can import an entire collection of resources with one HTTP request, you may need to check the progress of the import operation. In response to your request, you receive a session. Within this session, Veeam Backup & Replication adds the specified objects to the backup infrastructure. To check the import progress, you can track the session state. For more information, see Tracking Import Operation.

To set up backup infrastructure using the automation methods, you must import resources in the following order:

1. Credentials and encryption passwords
2. Managed servers
3. Backup repositories
4. Backup proxies
5. Backup jobs

In this example, you will migrate backup infrastructure from one backup server to another. You have a backup server backupserver01 where a VMware vSphere infrastructure is deployed. It includes managed Microsoft Windows and Linux servers, backup repositories and backup proxies, and configured backup jobs. You need to migrate the infrastructure to another backup server backupserver02.

To migrate backup infrastructure from backupserver01 to backupserver02, take the following steps:

1. To log in to backupserver01 and backupserver02, send the HTTP POST requests to the /api/oauth2/token paths. In response, you receive access and refresh tokens.
   For more information, see Requesting Authorization.

2. Export credentials records from backupserver01 with the Export Credentials request.
   In response, you receive an array of credentials records. Each record contains empty values of sensitive parameters: passwords, passphrases and private keys.

3. Import the credentials to backupserver02 with the Import Credentials request. In the request body, specify the imported credentials. Fill in passwords, passphrases and private keys manually.

4. Export servers managed by backupserver01 with the Export Servers request.
   In response, you receive an array of servers. The array does not include backupserver01 itself — the server where Veeam Backup & Replication is installed.

5. Import managed servers to backupserver02 with the Import Servers request. In the request body, specify the array of servers exported from backupserver01.
   In response, you receive an automation session. Within the session, the specified servers are added to the backupserver02 infrastructure. For more information on tracking the session state, see Tracking Import Operation.

6. Export backup repositories from backupserver01 with the Export Repositories request. In response, you receive an array of backup repositories.

7. Import backup repositories to backupserver02 with the Import Repositories request. In the request body, specify the repositories exported from backupserver01.
   In response, you receive an automation session. Within the session, the specified backup repositories are added to the backupserver02 infrastructure. For more information on tracking the session state, see Tracking Import Operation.

8. If you use backup proxies and encryption keys in your backup jobs, migrate them similarly.

9. Export backup jobs from backupserver01 with the Export Jobs request. In response, you receive an array of jobs.

10. Import backup jobs to backupserver02 with the Import Jobs request. In the request body, specify the jobs imported from backupserver01.
    In response you receive an automation session. Within the session, the specified backup jobs are created on backupserver02. For more information on tracking the session state, see Tracking Import Operation.

When you perform an import operation, you send the POST HTTP request. In response, you receive a session of the Automation type. Within this session, Veeam Backup & Replication adds new objects (for example, credentials, managed servers or backup jobs) to the infrastructure of the backup server. To check the import progress, track the session state. If the import fails, you can view debug logs for detailed information on each object.

For example, you import credentials records. In response, you receive an automation session. To track the session state, run the Get Automation Session request.

If some of the credentials records are not imported, you can view debug logs for detailed information on each record. To do this, send the Get Automation Session request.

With Veeam Backup & Replication REST API, you can add the following types of object storage repositories:

• Microsoft Azure Blob storage, Microsoft Azure Archive storage, and Microsoft Azure Data Box storage
• Amazon S3 storage, Amazon S3 Glacier storage, and AWS Snowball Edge storage
• Google Cloud storage
• S3 compatible storage
• IBM Cloud storage
• Wasabi Cloud storage
• Veeam Data Cloud Vault (revision 1.3-rev0 and later)

To add an object storage repository, take the following steps:

1. Add a cloud credentials record required for connection to the object storage repository. For details, see Add Cloud Credentials Record.

   In response, you receive a model of the created cloud credentials record with its ID. Save the ID, you will require it later.

2. Choose a location (cloud container and folder) that you want to map to new object storage repository. Save folder names and container names.

   • To browse existing folders, send the Get Cloud Hierarchy request.
   • To create a new folder, send the New Folder request. Note Veeam Backup & Replication REST API does not create new containers, you can create a folder inside an existing container only.

3. Add a new object storage repository with the Add Repository requests.

   In the request body among other parameters, specify the following parameters obtained in the previous steps:

   • Cloud credentials required for connection to the object storage repository.
   • Cloud location you want to map to the object storage repository.

The REST API allows you to backup and restore Microsoft Hyper-V data.

Before you can create a Hyper-V backup job, you must configure the Hyper-V infrastructure.

Adding Microsoft Hyper-V Servers

You can add the following types of Hyper-V servers:

To add a Microsoft Hyper-V server, use the Add Server request. In the request body, specify the HvServer server type and other server properties.

To add a Microsoft Hyper-V cluster and include only specific Hyper-V hosts, follow these steps:

1. Add the credentials used to connect to the Microsoft Hyper-V cluster: Add Credentials Record. You will need to specify the credentials ID in the following requests.
2. Discover the hosts managed by the cluster: Get Hyper-V Servers Managed by Hyper-V Cluster or SCVMM Server.
3. Add the Microsoft Hyper-V cluster using the Add Server request. In the request body specify the necessary hosts.

To add an SCVMM server and include only specific Hyper-V hosts, follow these steps:

1. Add the credentials used to connect to the SCVMM server: Add Credentials Record. You will need to specify the credentials ID in the following requests.
2. To add an SCVMM server without hosts, use the Add Server request, setting addAllServers to false in the request body.
3. Discover the hosts managed by the SCVMM server: Get Hyper-V Servers Managed by Hyper-V Cluster or SCVMM Server.
4. To add the necessary hosts, edit the SCVMM server: Edit Server.

Adding Off-Host Backup Proxies

You can deploy an off-host backup proxy to remove unwanted overhead on the production Hyper-V host. To add an off-host backup proxy, use the Add Proxy request. In the request body, specify the HvProxy proxy type and other proxy properties.

To create a backup job, use the Create Job request. In the request body, specify the HyperVBackup backup job type. Note that replication jobs of Hyper-V data are not supported.

You can perform the following recovery operations for Microsoft Hyper-V data:

• Entire VM restore
• Instant Recovery to Microsoft Hyper-V
• File restore

The REST API allows you to backup and restore entire Microsoft Entra ID items (users, groups, administrative units, applications and roles) and item properties as well as audit and sign-in logs.

Before you can back up Microsoft Entra ID data, you must add a Microsoft Entra ID tenant to your backup infrastructure. When adding a Microsoft Entra ID tenant, you need to specify an existing Microsoft Entra ID app registration or let Veeam Backup & Replication create a new one.

If you choose to create a new app registration, you must generate a verification code and register the new application before you start adding a tenant:

1. To generate a code, use the Get Microsoft Entra ID Verification Code request.
2. To register the new application, use the Register Microsoft Entra ID Application request.

To add a tenant, use the Add Microsoft Entra ID Tenant request.

You can create the following types of backup jobs:

To create a backup job, use the Create Job request. In the request body, specify a job type and other job settings.

To enable backup of Conditional Access policies, add the following registry key:

New-ItemProperty -Path "HKLM:SOFTWARE\Veeam\Veeam Backup and Replication" -Name "EntraIdBackupSupportsConditionalAccessPolicyRestore" -Value "1" -PropertyType DWORD -Force

Additionally, make sure that the Microsoft Entra application used for tenant backup and restore has required permissions. For details, see the Considerations and Limitations section of the Veeam Backup & Replication User Guide.

Restoring Microsoft Entra ID Items and Item Properties

To restore entire Microsoft Entra ID items or item properties, take the following steps:

1. To get a backup ID of the Microsoft Entra ID tenant backup that you want to use for restore, send the Get All Backups request.

2. To start a mount session and mount the tenant backup to the mount point, use the Mount Microsoft Entra ID Tenant request. In response, you receive a mount session ID that you will need later. You can also get existing mount sessions using the Get Mount Points for All Entra ID Tenants request.

3. To browse the Microsoft Entra ID tenant backup for the items that you want to restore, send the Get Microsoft Entra ID Items request.

4. Choose the restore points from which to restore your items:

   • To choose a restore point from the list of all tenant's restore points, send the Get Restore Points of Microsoft Entra ID Tenant request.

   • To check that the selected restore point contains all the items that you want to restore, send the Validate Microsoft Entra ID Tenant Items request. In the response body, you receive an array of items that are missing in the restore point. To browse restore points that are available for each of the missing items, use the Get Restore Points of Microsoft Entra ID Item request.

   • If you want to check if there are any differences between two restore points for a specific item, you can either synchronous or asynchronous request:

     • When you send a synchronous request, the client will stop execution until comparison results are ready. For details, see Compare Microsoft Entra ID Item Properties.

     • When you send an asynchronous request, you receive a comparison session immediately so the client can continue execution, and you can process the comparison results later when the session changes its state to Success. For details, see Start Comparing Microsoft Entra ID Item Properties and Get Comparison Results for Microsoft Entra ID Items.

     • To compare Conditional Access policies, use the Start Comparing Microsoft Entra ID Conditional Access Policy asynchronous requests. To get the comparison results send the Get Comparison Results for Microsoft Entra ID Conditional Access Policy request.

5. If you want to check if a backed up item exists in the production environment, send the Check Microsoft Entra ID Items in Production request.

6. If you restore users, send the Generate Microsoft Entra ID User Passwords request to generate custom passwords for restored Microsoft Entra ID users. Alternatively, you can specify one default password for all restored users.

7. [Delegated restore] If you perform the restore operation under the Restore Operator role, you must obtain credentials to connect to the production Microsoft Entra ID tenant:

   a. Obtain a user code. For details, see Get User Code for Delegated Restore of Microsoft Entra ID Items.

   b. To get the credentials required for restore, send the Get Credentials for Delegated Restore of Microsoft Entra ID Items request. Use the obtained credentials ID in the request body oh the restore requests.

8. To restore Microsoft Entra ID items, send the Restore Microsoft Entra ID Items request. The request starts a restore session.

9. To restore item properties, send the Restore Microsoft Entra ID Item Properties request.

10. To stop restore sessions, send the Stop Restore Session of Microsoft Entra ID Tenant request.

11. To stop the mount session and unmount the tenant backup from the mount point, send the Unmount Microsoft Entra ID Tenant request.

Restoring Microsoft Entra ID Audit Logs

To restore Microsoft Entra ID audit and sign-in logs, take the following steps:

1. To get the ID of the Microsoft Entra ID log backup that you want to use for restore, send the Get All Backups request.

2. To start a mount session and mount log files to the mount point, use the Start Microsoft Entra ID Audit Log Restore request. In response, you receive a mount session ID that you will need later. You can also get existing mount sessions using the Get All File Restore Mount Points request.

3. To browse the hierarchy tree of the mounted log files, use the Compare Files and Folders request. If you specify an empty path in the request body, you will browse the root folder, and then you can go deeper into the tree.

4. If you want to search for a specific file or folder, use the Search for Files and Folders and Browse Search Results requests.

5. To restore log files, send the Copy Files and Folders to Specific Folder request.

6. To stop the mount session and unmount the log files from the mount point, send the Unmount Microsoft Entra ID Audit Logs request.

Starting from Veeam Backup & Replication REST API 1.3-rev0, you can create protection groups, add protected computers, clusters and domains, install the agent on the added objects, as well as backup and restore those objects.

1. [For individual computer, CSV file, Active Directory protection group types] Get the necessary credentials ID for the protected computer with the Get All Credentials request. To add a new credentials record, use the Add Credentials Record request.
2. If you want to add a Microsoft Active Directory domain to a protection group, use the Add Active Directory Domain request.
   a. If you have added multiple domains to Veeam Backup & Replication, run the Get Active Directory Domains request.
   b. To get a domain using its ID, run the Get Active Directory Domain request.
   c. To remove the domain, run the Remove Active Directory Domain request.
3. Run the Add Protection Group request to create a protection group and add protected computers.
4. [For the pre-installed agents protection group type] To download agent packages that you can install on the computers you want to add to the protection group, run the Download Protection Group Packages request.
   • To download Windows packages, set the includeWindowsPackages property of the restore body to true.
   • To download Mac packages, set the includeMacPackages property of the restore body to true.
   • To get the Linux packages you can download run the Get Linux Agent Packages request.
   • To get the Unix packages you can download, run the Get Unix Agent Packages request.
5. If you have multiple protection groups, you can get them with the Get Protection Groups request. You can also use the Get Protection Group request to get a protection group with a specified ID.
6. If necessary, you can edit the protection group settings with the Edit Protection Group request.
7. To rescan, or manually start the discovery process for the protection group, run the Rescan Protection Group request. To rescan specific entities without rescanning the entire protection group, run the Rescan Discovered Entities request.
8. To disable automatic discovery of protected computers added to a protection group, run the Disable Protection Group request. To enable automatic discovery of protected computers, run the Enable Protection Group request.
9. To get all discovered computers from a protection group with a specified ID, run the Get Discovered Entities request. To get a specific computer from a protection group, run the Get Discovered Entity request.
10. To install an agent on the protected computers, run the Install Agent on Discovered Entities request.
11. To uninstall the agent from one or several discovered entities, run the Uninstall Agent from Discovered Entities request. To uninstall all components, run the Uninstall All Components from Discovered Entities request.
12. You can remove objects from the protection group with the Remove Discovered Entity request. To remove the entire protection group, run the Remove Protection Group request.

To backup the contents of a protection group, perform the following steps:

1. To get an array of computers added to protection groups, run the Get All Protection Groups request. To get inventory objects from a protection group with a specific id, run the Get Inventory Objects for Specific Protection Group request.
2. To create a backup job, use the Create Job request. In the request body, specify the WindowsAgentBackup or LinuxAgentBackup backup job type.

1. [Optional] If necessary, Veeam Backup & Replication REST API allows you to use recovery tokens to allow the agents authenticated access to backups created by Veeam Agents.
   a. To get all recovery tokens, run the Get All Recovery Tokens request. To create a recovery token, run the Create Recovery Token request.
   b. To get a specific recovery token using the recovery token id, run the Get Recovery Token request.
   c. To edit the settings of a recovery token with a specified id, run the Edit Recovery Token request.
   d. To delete the recovery token, run the Delete Recovery Token request.
2. Veeam Backup & Replication REST API only supports file-level restore from backups of agent-managed objects. For more details on how to perform this operation, see the Restoring Files and Folders how-to guide.

Using Veeam Backup & Replication REST API, you can restore files and folders from backups (Microsoft Windows and other file systems) and replicas (Microsoft Windows file systems).

To restore files and folders, take the following steps:

1. Start the restore session and mount the machine file system to the mount server.
2. Perform restore operations.
3. Stop the restore session.

To mount the file system to the mount server, do the following:

1. Get a restore point from a backup or a replica.

   • To get a restore point from a backup, perform the following steps:

     1. To get the backup object from which you want to restore files or folders, send the Get All Backup Objects request. Save the backup object ID that you need.

     2. To get the necessary restore point from the backup object, use the Get Restore Points request, using the backup object ID. Save the restore point ID that you need.

     Alternatively, you can use the Get All Restore Points request to get an array of all backup restore points created on the backup server. Save the restore point ID that you need.

   • To get a restore point from a replica, perform the following steps:

     1. To get the replica from which you want to restore files or folders, send the Get All Replicas request. Save the replica ID that you need.

     2. To get the necessary restore point from the replica, use the Get All Replica Restore Points request, using the replica ID. Save the restore point ID that you need.

     Alternatively, you can use the Get All Replica Restore Points request to get an array of all replica restore points created on the backup server. Save the restore point ID that you need.

2. Get the necessary credentials ID with the Get All Credentials request. To add a new credentials record, use the Add Credentials Record request. This step is not necessary when restoring files or folders from a Windows-based server to the original location.

3. Mount the file system to the mount server with the Start File Restore request. In response, you will receive a FileLevelRestore session. Save the restore session ID to use it for restore operations.

To restore files and folders, take the following steps:

1. [Optional] If you have a Windows machine, use the Compare Files and Folders request to compare file system items (drives, folders, files and links) on the production machine with the items available in the FileLevelRestore session.

2. [Optional] If you want to search for a specific file or folder, use the Search for Files and Folders and Browse Search Results requests. These requests allow you to preview the hierarchy tree of the mounted files and folders. If you specify an empty path in the request body, you will browse the root folder, and then you can go deeper into the tree.

3. To restore the necessary files or folders you can perform any of the following operations:

   • To restore files and folders, send the Restore Files and Folders to Original Location or Restore Files and Folders to Another Location request.

   • To download a ZIP archive with files and folders to the machine where the Veeam Backup & Replication console is installed, send the Download Files and Folders request.

   • [For unstructured data] To copy files and folders to the machine where the Veeam Backup & Replication console is installed or to a network shared folder, send the Copy Files and Folders to Specific Folder request.

To stop the mount session and unmount the file system from the mount point, send the Unmount File System request. This step is obligatory if you have disabled autoUnmount in the Start File Restore request body.

Starting from Veeam Backup & Replication REST API 1.3-rev0, you can perform Instant Recovery of Windows and Linux machines to Azure.

NOTE: Deploying a helper appliance template with REST API is not supported. Before you run this request, you must deploy a helper appliance template in the Veeam Backup & Replication UI or with the Deploy-VBRAzureApplianceTemplate cmdlet.

1. Run the Get All Restore Points request to get the RestorePointId property value of the machine that you want to restore.
2. Run the Get Restore Point Disks request to get the diskUid property value.
3. Run the Get All Cloud Credentials request to get the subscriptionId property value.
   If you do not have an Azure subscription added, you must add it with the request.
4. Run the Get Cloud Hierarchy request to get the values for the remaining required properties.
5. Run the Start Instant Recovery to Azure request using the responses of the previous requests in the request body. An Instant Recovery session will be started. Note that there are multiple types of sessions associated the Instant Recovery to Azure operation. You can get an overview of all these sessions with the Get All Mount Sessions for Instant Recovery to Azure request.

1. After you start the Instant Recovery session, an Instant Recovery mount point will be created in Azure. You can get the mount point using the Get Mount Point for Instant Recovery to Azure request.
2. To start the process of migrating the machine to Azure, run the Start Migrating Machine to Azure request.
3. To get the selected switchover settings, run the Get Settings for Switchover to Azure request.
4. To edit the the switchover settings, run the Update Settings for Switchover to Azure request.
5. [For Manual and Scheduled Switchover Options] To manually initiate switchover to Azure, run the Start Switchover to Azure request.
6. After a successful operation, you can unmount the mount point with the Stop Publishing Machine to Azure request.