Veeam Backup & Replication 13
REST API Reference
Related documents

Malware Detection

The Malware Detection section defines operations for managing malware events, configuring malware detection settings (suspicious file masks, trusted file extensions and indicators of compromise), managing the malware detection state and exclusions of backup objects, scanning backups with antivirus software or YARA rules, and analyzing backups for signs of encryption.

Get All Malware Events

The HTTP GET request to the /api/v1/malwareDetection/events endpoint gets an array of all malware events created on the backup server.

Available to: Backup Administrator, Security Administrator, Backup Operator, Restore Operator, Backup Viewer, Incident API Operator. Also available to custom roles that have backup or restore permissions.

SecurityBearer
Request
query Parameters
skip
integer <int32>

Number of events to skip.

limit
integer <int32>
Default: 200

Maximum number of events to return.

orderColumn
string (ESuspiciousActivityEventsFiltersOrderColumn)

Sorts events by one of the event parameters.

Enum: "Type" "DetectionTimeUtc" "CreationTimeUtc" "BackupObjectId" "State" "Source" "Severity" "CreatedBy" "Engine" "Details" "MachineName"
orderAsc
boolean

If true, sorts events in ascending order by the orderColumn parameter.

typeFilter
Array of strings (ESuspiciousActivityType)

Filters events by event type.

Items Enum: "Unknown" "DeletedUsefulFiles" "RansomwareNotes" "MalwareExtensions" "EncryptedData" "YaraScan" "AntivirusScan" "RenamedFiles" "IndicatorOfCompromise"
detectedAfterTimeUtcFilter
string <date-time>

Returns events detected after the specified time, in UTC.

detectedBeforeTimeUtcFilter
string <date-time>

Returns events detected before the specified time, in UTC.

createdAfterTimeUtcFilter
string <date-time>

Returns events created after the specified time, in UTC.

createdBeforeTimeUtcFilter
string <date-time>

Returns events created before the specified time, in UTC.

backupObjectIdFilter
string <uuid>

Filters events by backup object ID.

stateFilter
Array of strings (ESuspiciousActivityState)

Filters events by state.

Items Enum: "Created" "FalsePositive"
sourceFilter
Array of strings (ESuspiciousActivitySourceType)

Filters events by source type.

Items Enum: "Manual" "InternalVeeamDetector" "External" "MarkAsCleanEvent"
severityFilter
Array of strings (ESuspiciousActivitySeverity)

Filters events by severity.

Items Enum: "Clean" "Suspicious" "Infected" "Informative"
createdByFilter
string

Filters events by the createdBy pattern. To substitute one or more characters, use the asterisk (*) character at the beginning, at the end or both.

engineFilter
string

Filters events by the engine pattern. To substitute one or more characters, use the asterisk (*) character at the beginning, at the end or both.

machineNameFilter
string

Filters events by the machine.displayName pattern. To substitute one or more characters, use the asterisk (*) character at the beginning, at the end or both.

header Parameters
x-api-version
required
string
Default: 1.3-rev2

Version and revision of the client REST API. Must be in the following format: <version>-<revision>.

Responses
200

OK

401

Unauthorized. The authorization header has been expected but not found (or found but is expired).

403

Forbidden. The user sending the request does not have adequate privileges to access one or more objects specified in the request.

500

Internal server error. The request has been received but could not be completed because of an internal error at the server side.

get/api/v1/malwareDetection/events
Request samples 
Response samples 
application/json
{
  • "data": [
    ],
  • "pagination": {
    }
}
Create Malware Event
The HTTP POST request to the /api/v1/malwareDetection/events endpoint creates a new malware event.
Available to: Backup Administrator, Incident API Operator.


SecurityBearer 
Request 
header Parameters
x-api-version
required
string
 Default:  1.3-rev2
Version and revision of the client REST API. Must be in the following format: <version>-<revision>.


 
Request Body schema: application/json
required
detectionTimeUtc
required
string <date-time> 
Detection date and time, in UTC.


 
required
object (SuspiciousActivityMachineSpec) 
Machine that you want to mark with the malware event. Specify at least 2 parameters.
 Note that Veeam Backup & Replication can identify a machine by its FQDN, IPv4 address and IPv6 address only if the machine has been powered on during the backup. If you back up a powered-off machine, Veeam Backup & Replication will not get the machine IP addresses and domain name and will not be able to identify the machine.


 
details
required
string
Event description.


 
engine
required
string
Detection engine.


 
severity
string (ECreatingSuspiciousActivitySeverity) 
 Default:  "Infected"
Malware status enum for creating suspicious activity operation.


 Enum: "Infected" "Suspicious"  
Responses 
201
Malware event has been created.


400
Bad request. This error is related to POST/PUT requests. The request body is malformed, incomplete or otherwise invalid.


401
Unauthorized. The authorization header has been expected but not found (or found but is expired).


403
Forbidden. The user sending the request does not have adequate privileges to access one or more objects specified in the request.


500
Internal server error. The request has been received but could not be completed because of an internal error at the server side.


post/api/v1/malwareDetection/events
Request samples 
application/json
{
  • "detectionTimeUtc": "2026-05-20T10:28:00Z",
  • "machine": {
    },
  • "details": "Encrypted data detected on the protected machine.",
  • "engine": "Veeam Threat Hunter",
  • "severity": "Infected"
}
Response samples 
application/json
{
  • "data": [
    ],
  • "pagination": {
    }
}
Get Malware Event
The HTTP GET request to the /api/v1/malwareDetection/events/{id} endpoint gets a malware event that has the specified id.
Available to: Backup Administrator, Security Administrator, Backup Operator, Restore Operator, Backup Viewer, Incident API Operator. Also available to custom roles that have backup or restore permissions.


SecurityBearer 
Request 
path Parameters
id
required
string <uuid> 
Event ID. To get the ID, run the Get All Malware Events request.


 
header Parameters
x-api-version
required
string
 Default:  1.3-rev2
Version and revision of the client REST API. Must be in the following format: <version>-<revision>.


 
Responses 
200
OK


401
Unauthorized. The authorization header has been expected but not found (or found but is expired).


403
Forbidden. The user sending the request does not have adequate privileges to access one or more objects specified in the request.


404
Not found. No object was found with the path parameter specified in the request.


500
Internal server error. The request has been received but could not be completed because of an internal error at the server side.


get/api/v1/malwareDetection/events/{id}
Request samples 
Response samples 
application/json
{
  • "id": "8f3c1a20-9b6e-4d11-bb52-1c2d3e4f5a60",
  • "type": "EncryptedData",
  • "creationTimeUtc": "2026-05-20T10:30:00Z",
  • "detectionTimeUtc": "2026-05-20T10:28:00Z",
  • "machine": {
    },
  • "state": "Created",
  • "details": "Potential malware activity detected",
  • "source": "InternalVeeamDetector",
  • "severity": "Infected",
  • "createdBy": "TECH\\Administrator",
  • "engine": "Veeam Threat Hunter"
}
Get All Malware Detection Settings
The HTTP GET request to the /api/v1/malwareDetection/settings/general endpoint gets all malware detection settings.
Available to: Backup Administrator, Security Administrator, Backup Operator, Restore Operator, Backup Viewer. Also available to custom roles that have backup or restore permissions.


SecurityBearer 
Request 
header Parameters
x-api-version
required
string
 Default:  1.3-rev2
Version and revision of the client REST API. Must be in the following format: <version>-<revision>.


 
Responses 
200
OK


401
Unauthorized. The authorization header has been expected but not found (or found but is expired).


403
Forbidden. The user sending the request does not have adequate privileges to access one or more objects specified in the request.


404
Not found. No object was found with the path parameter specified in the request.


500
Internal server error. The request has been received but could not be completed because of an internal error at the server side.


get/api/v1/malwareDetection/settings/general
Request samples 
Response samples 
application/json
{
  • "encryptionDetectionSettings": {
    },
  • "fileDetectionSettings": {
    },
  • "notificationSettings": {
    },
  • "incidentAPISettings": {
    },
  • "signatureDetectionSettings": {
    }
}
Edit Malware Detection Settings
The HTTP PUT request to the /api/v1/malwareDetection/settings/general endpoint edits malware detection settings.
Available to: Backup Administrator.


SecurityBearer 
Request 
header Parameters
x-api-version
required
string
 Default:  1.3-rev2
Version and revision of the client REST API. Must be in the following format: <version>-<revision>.


 
Request Body schema: application/json
required
object (MalwareEncryptionDetectionSettingsModel) 
Malware encryption detection settings.


 
object (MalwareFileDetectionSettingsModel) 
Malware file detection settings.


 
object (MalwareDetectionEmailNotificationSettingsModel) 
Malware detection email notification settings.


 
object (MalwareDetectionIncidentAPISettingsModel) 
Malware detection incident API settings.


 
object (MalwareSignatureDetectionSettingsModel) 
Malware signature detection settings.


 
Responses 
200
Malware detection settings have been updated.


400
Bad request. This error is related to POST/PUT requests. The request body is malformed, incomplete or otherwise invalid.


401
Unauthorized. The authorization header has been expected but not found (or found but is expired).


403
Forbidden. The user sending the request does not have adequate privileges to access one or more objects specified in the request.


404
Not found. No object was found with the path parameter specified in the request.


500
Internal server error. The request has been received but could not be completed because of an internal error at the server side.


put/api/v1/malwareDetection/settings/general
Request samples 
application/json
{
  • "encryptionDetectionSettings": {
    },
  • "fileDetectionSettings": {
    },
  • "notificationSettings": {
    },
  • "incidentAPISettings": {
    },
  • "signatureDetectionSettings": {
    }
}
Response samples 
application/json
{
  • "encryptionDetectionSettings": {
    },
  • "fileDetectionSettings": {
    },
  • "notificationSettings": {
    },
  • "incidentAPISettings": {
    },
  • "signatureDetectionSettings": {
    }
}
Get Malware Suspicious File Masks Settings
The HTTP GET request to the /api/v1/malwareDetection/settings/fileDetection/suspiciousFileMasks endpoint gets malware suspicious file masks settings.
Available to: Backup Administrator, Security Administrator, Backup Operator, Restore Operator, Backup Viewer. Also available to custom roles that have backup or restore permissions.


SecurityBearer 
Request 
header Parameters
x-api-version
required
string
 Default:  1.3-rev2
Version and revision of the client REST API. Must be in the following format: <version>-<revision>.


 
Responses 
200
OK


401
Unauthorized. The authorization header has been expected but not found (or found but is expired).


403
Forbidden. The user sending the request does not have adequate privileges to access one or more objects specified in the request.


404
Not found. No object was found with the path parameter specified in the request.


500
Internal server error. The request has been received but could not be completed because of an internal error at the server side.


get/api/v1/malwareDetection/settings/fileDetection/suspiciousFileMasks
Request samples 
Response samples 
application/json
{
  • "suspiciousObjects": [
    ],
  • "trustedExtensions": [
    ],
  • "trustedPaths": [
    ]
}
Edit Malware Suspicious File Masks Settings
The HTTP PUT request to the /api/v1/malwareDetection/settings/fileDetection/suspiciousFileMasks endpoint edits malware suspicious file masks settings.
Available to: Backup Administrator.


SecurityBearer 
Request 
header Parameters
x-api-version
required
string
 Default:  1.3-rev2
Version and revision of the client REST API. Must be in the following format: <version>-<revision>.


 
Request Body schema: application/json
required
suspiciousObjects
Array of strings
Array of suspicious file masks.


 
trustedExtensions
Array of strings
Array of trusted file extensions.


 
trustedPaths
Array of strings
Array of trusted file paths.


 
Responses 
200
Malware suspicious file masks settings have been updated.


400
Bad request. This error is related to POST/PUT requests. The request body is malformed, incomplete or otherwise invalid.


401
Unauthorized. The authorization header has been expected but not found (or found but is expired).


403
Forbidden. The user sending the request does not have adequate privileges to access one or more objects specified in the request.


404
Not found. No object was found with the path parameter specified in the request.


500
Internal server error. The request has been received but could not be completed because of an internal error at the server side.


put/api/v1/malwareDetection/settings/fileDetection/suspiciousFileMasks
Request samples 
application/json
{
  • "suspiciousObjects": [
    ],
  • "trustedExtensions": [
    ],
  • "trustedPaths": [
    ]
}
Response samples 
application/json
{
  • "suspiciousObjects": [
    ],
  • "trustedExtensions": [
    ],
  • "trustedPaths": [
    ]
}
Get Malware Allowed Trusted Extensions
The HTTP GET request to the /api/v1/malwareDetection/settings/fileDetection/allowedTrustedExtensions endpoint gets malware allowed trusted extensions.
Available to: Backup Administrator, Security Administrator, Backup Operator, Restore Operator, Backup Viewer, Incident API Operator. Also available to custom roles that have backup or restore permissions.


SecurityBearer 
Request 
header Parameters
x-api-version
required
string
 Default:  1.3-rev2
Version and revision of the client REST API. Must be in the following format: <version>-<revision>.


 
Responses 
200
OK


401
Unauthorized. The authorization header has been expected but not found (or found but is expired).


403
Forbidden. The user sending the request does not have adequate privileges to access one or more objects specified in the request.


404
Not found. No object was found with the path parameter specified in the request.


500
Internal server error. The request has been received but could not be completed because of an internal error at the server side.


get/api/v1/malwareDetection/settings/fileDetection/allowedTrustedExtensions
Request samples 
Response samples 
application/json
{
  • "allowedExtensions": [
    ]
}
Get Malware File Detection Indicators of Compromise
The HTTP GET request to the /api/v1/malwareDetection/settings/fileDetection/indicatorsOfCompromise endpoint gets the list of indicators of compromise.
Available to: Backup Administrator, Security Administrator, Backup Operator, Restore Operator, Backup Viewer. Also available to custom roles that have backup or restore permissions.


SecurityBearer 
Request 
header Parameters
x-api-version
required
string
 Default:  1.3-rev2
Version and revision of the client REST API. Must be in the following format: <version>-<revision>.


 
Responses 
200
OK


401
Unauthorized. The authorization header has been expected but not found (or found but is expired).


403
Forbidden. The user sending the request does not have adequate privileges to access one or more objects specified in the request.


404
Not found. No object was found with the path parameter specified in the request.


500
Internal server error. The request has been received but could not be completed because of an internal error at the server side.


get/api/v1/malwareDetection/settings/fileDetection/indicatorsOfCompromise
Request samples 
Response samples 
application/json
{
  • "data": [
    ]
}
Enable Monitoring of Indicators of Compromise
The HTTP POST request to the /api/v1/malwareDetection/settings/fileDetection/indicatorsOfCompromise/enable endpoint enables monitoring of indicators of compromise.
Available to: Backup Administrator.


SecurityBearer 
Request 
header Parameters
x-api-version
required
string
 Default:  1.3-rev2
Version and revision of the client REST API. Must be in the following format: <version>-<revision>.


 
Request Body schema: application/json
required
indicatorsOfCompromise
required
Array of strings  unique 
Array of objects containing details on indicators of compromise.


 
Responses 
200
OK


401
Unauthorized. The authorization header has been expected but not found (or found but is expired).


403
Forbidden. The user sending the request does not have adequate privileges to access one or more objects specified in the request.


404
Not found. No object was found with the path parameter specified in the request.


500
Internal server error. The request has been received but could not be completed because of an internal error at the server side.


post/api/v1/malwareDetection/settings/fileDetection/indicatorsOfCompromise/enable
Request samples 
application/json
{
  • "indicatorsOfCompromise": [
    ]
}
Response samples 
application/json
{
  • "data": [
    ]
}
Disable Monitoring of Indicators of Compromise
The HTTP POST request to the /api/v1/malwareDetection/settings/fileDetection/indicatorsOfCompromise/disable endpoint disables monitoring of indicators of compromise.
Available to: Backup Administrator.


SecurityBearer 
Request 
header Parameters
x-api-version
required
string
 Default:  1.3-rev2
Version and revision of the client REST API. Must be in the following format: <version>-<revision>.


 
Request Body schema: application/json
required
indicatorsOfCompromise
required
Array of strings  unique 
Array of objects containing details on indicators of compromise.


 
Responses 
200
OK


401
Unauthorized. The authorization header has been expected but not found (or found but is expired).


403
Forbidden. The user sending the request does not have adequate privileges to access one or more objects specified in the request.


404
Not found. No object was found with the path parameter specified in the request.


500
Internal server error. The request has been received but could not be completed because of an internal error at the server side.


post/api/v1/malwareDetection/settings/fileDetection/indicatorsOfCompromise/disable
Request samples 
application/json
{
  • "indicatorsOfCompromise": [
    ]
}
Response samples 
application/json
{
  • "data": [
    ]
}
Get Logs for SureBackup Scan Task Session
The HTTP GET request to the /api/v1/malwareDetection/scanSessionLog/{id} endpoint gets an array of all log lines for the SureBackup task session with the specified id.
Available to: Backup Administrator, Backup Operator, Restore Operator, Backup Viewer. Also available to custom roles that have backup or restore permissions.


SecurityBearer 
Request 
path Parameters
id
required
string <uuid> 
Task session ID. To get the ID, run the Get All Task Sessions request.


 
header Parameters
x-api-version
required
string
 Default:  1.3-rev2
Version and revision of the client REST API. Must be in the following format: <version>-<revision>.


 
Responses 
200
OK


401
Unauthorized. The authorization header has been expected but not found (or found but is expired).


403
Forbidden. The user sending the request does not have adequate privileges to access one or more objects specified in the request.


404
Not found. No object was found with the path parameter specified in the request.


500
Internal server error. The request has been received but could not be completed because of an internal error at the server side.


get/api/v1/malwareDetection/scanSessionLog/{id}
Request samples 
Response samples 
application/json
{
  • "lines": [
    ]
}
Mark Backup Objects as Clean
The HTTP POST request to the /api/v1/malwareDetection/backupObjects/markAsClean endpoint marks as clean backup objects that were flagged as suspicious or infected. Use this request if you cleaned the machine of malware or the malware detection event was a false positive.
Available to: Backup Administrator, Incident API Operator.


SecurityBearer 
Request 
header Parameters
x-api-version
required
string
 Default:  1.3-rev2
Version and revision of the client REST API. Must be in the following format: <version>-<revision>.


 
Request Body schema: application/json
required
objectIds
required
Array of strings <uuid> 
Array of backup object IDs to be marked as clean.


 
reason
string
Reason why the backup objects are marked as clean.


 
markRestorePointsAsClean
boolean
If true, marks all previous restore points as clean and all previous suspicious/infected events as false positives.


 
excludeFromDetection
boolean
If true, excludes the objects from the further scanning process.


 
noteForExclusion
string
Note for exclusion from detection.


 
Responses 
200
OK


400
Bad request. This error is related to POST/PUT requests. The request body is malformed, incomplete or otherwise invalid.


401
Unauthorized. The authorization header has been expected but not found (or found but is expired).


403
Forbidden. The user sending the request does not have adequate privileges to access one or more objects specified in the request.


500
Internal server error. The request has been received but could not be completed because of an internal error at the server side.


post/api/v1/malwareDetection/backupObjects/markAsClean
Request samples 
application/json
{
  • "objectIds": [
    ],
  • "reason": "False positive",
  • "markRestorePointsAsClean": true,
  • "excludeFromDetection": true,
  • "noteForExclusion": "False positive"
}
Response samples 
application/json
{ }
Get All Malware Detection Objects
The HTTP GET request to the /api/v1/malwareDetection/backupObjects endpoint gets an array of all malware detection objects created on the backup server.
Available to: Backup Administrator, Security Administrator, Backup Operator, Restore Operator, Backup Viewer. Also available to custom roles that have backup or restore permissions.


SecurityBearer 
Request 
query Parameters
skip
integer <int32> 
Number of malware detection objects to skip.


 
limit
integer <int32> 
 Default:  200
Maximum number of malware detection objects to return.


 
orderColumn
string (EMalwareDetectionObjectsFiltersOrderColumn) 
Sorts malware detection objects by one of the object parameters.


 Enum: "DetectionTimeUtc" "BackupObjectName" "Severity"  
orderAsc
boolean
If true, sorts malware detection objects in ascending order by the orderColumn parameter.


 
detectedAfterTimeUtcFilter
string <date-time> 
Returns malware detection objects detected after the specified time, in UTC.


 
detectedBeforeTimeUtcFilter
string <date-time> 
Returns malware detection objects detected before the specified time, in UTC.


 
backupObjectIdFilter
string <uuid> 
Filters malware detection objects by backup object ID.


 
backupObjectNameFilter
string
Filters malware detection objects by backup object name.


 
platformFilter
string
Filters malware detection objects by platform.


 
severityFilter
Array of strings (ESuspiciousActivitySeverity) 
Filters malware detection objects by severity.


Items Enum: "Clean" "Suspicious" "Infected" "Informative"  
header Parameters
x-api-version
required
string
 Default:  1.3-rev2
Version and revision of the client REST API. Must be in the following format: <version>-<revision>.


 
Responses 
200
OK


401
Unauthorized. The authorization header has been expected but not found (or found but is expired).


403
Forbidden. The user sending the request does not have adequate privileges to access one or more objects specified in the request.


500
Internal server error. The request has been received but could not be completed because of an internal error at the server side.


get/api/v1/malwareDetection/backupObjects
Request samples 
Response samples 
application/json
{
  • "data": [
    ],
  • "pagination": {
    }
}
Get Malware Detection Object
The HTTP GET request to the /api/v1/malwareDetection/backupObjects/{id} endpoint gets a malware detection object that has the specified id.
Available to: Backup Administrator, Security Administrator, Backup Operator, Restore Operator, Backup Viewer. Also available to custom roles that have backup or restore permissions.


SecurityBearer 
Request 
path Parameters
id
required
string <uuid> 
Object ID. To get the ID, run the Get All Malware Detection Objects request.


 
header Parameters
x-api-version
required
string
 Default:  1.3-rev2
Version and revision of the client REST API. Must be in the following format: <version>-<revision>.


 
Responses 
200
OK


401
Unauthorized. The authorization header has been expected but not found (or found but is expired).


403
Forbidden. The user sending the request does not have adequate privileges to access one or more objects specified in the request.


404
Not found. No object was found with the path parameter specified in the request.


500
Internal server error. The request has been received but could not be completed because of an internal error at the server side.


get/api/v1/malwareDetection/backupObjects/{id}
Request samples 
Response samples 
application/json
{
  • "objectId": "c3d4e5f6-a7b8-4901-9cde-f01234567890",
  • "objectName": "linuxsrv014",
  • "detectedTime": "2026-05-20T10:30:00Z",
  • "severity": "Infected",
  • "platform": "VMware",
  • "objectHostName": "enterprise01.tech.local",
  • "sourceTypes": [
    ]
}
Get All Malware Detection Exclusions
The HTTP GET request to the /api/v1/malwareDetection/backupObjects/exclusions endpoint gets an array of malware detection exclusions.
Available to: Backup Administrator, Security Administrator, Backup Operator, Restore Operator, Backup Viewer. Also available to custom roles that have backup or restore permissions.


SecurityBearer 
Request 
query Parameters
skip
integer <int32> 
Number of exclusions to skip.


 
limit
integer <int32> 
 Default:  200
Maximum number of exclusions to return.


 
orderColumn
string (EMalwareObjectExclusionsFiltersOrderColumn) 
Sorts exclusions by one of the exclusion parameters.


 Enum: "Name" "Platform"  
orderAsc
boolean
If true, sorts exclusions in ascending order by the orderColumn parameter.


 
header Parameters
x-api-version
required
string
 Default:  1.3-rev2
Version and revision of the client REST API. Must be in the following format: <version>-<revision>.


 
Responses 
200
OK


401
Unauthorized. The authorization header has been expected but not found (or found but is expired).


403
Forbidden. The user sending the request does not have adequate privileges to access one or more objects specified in the request.


500
Internal server error. The request has been received but could not be completed because of an internal error at the server side.


get/api/v1/malwareDetection/backupObjects/exclusions
Request samples 
Response samples 
application/json
{
  • "data": [
    ],
  • "pagination": {
    }
}
Create or Update Malware Detection Exclusions
The HTTP POST request to the /api/v1/malwareDetection/backupObjects/exclusions endpoint creates new malware detection exclusions and updates existing ones.
Available to: Backup Administrator.


SecurityBearer 
Request 
header Parameters
x-api-version
required
string
 Default:  1.3-rev2
Version and revision of the client REST API. Must be in the following format: <version>-<revision>.


 
Request Body schema: application/json
required
Array of objects (MalwareDetectionCommonSpec) 
Array of malware detection exclusions to import.


 
Responses 
200
OK


401
Unauthorized. The authorization header has been expected but not found (or found but is expired).


403
Forbidden. The user sending the request does not have adequate privileges to access one or more objects specified in the request.


500
Internal server error. The request has been received but could not be completed because of an internal error at the server side.


post/api/v1/malwareDetection/backupObjects/exclusions
Request samples 
application/json
{
  • "data": [
    ]
}
Response samples 
application/json
{
  • "data": [
    ]
}
Delete Malware Detection Exclusions
The HTTP POST request to the /api/v1/malwareDetection/backupObjects/exclusions/delete endpoint deletes malware detection exclusions specified in the request body by their IDs.
Available to: Backup Administrator.


SecurityBearer 
Request 
header Parameters
x-api-version
required
string
 Default:  1.3-rev2
Version and revision of the client REST API. Must be in the following format: <version>-<revision>.


 
Request Body schema: application/json
 Array 
string <uuid> 
 
Responses 
204
Removed.


401
Unauthorized. The authorization header has been expected but not found (or found but is expired).


403
Forbidden. The user sending the request does not have adequate privileges to access one or more objects specified in the request.


500
Internal server error. The request has been received but could not be completed because of an internal error at the server side.


post/api/v1/malwareDetection/backupObjects/exclusions/delete
Request samples 
application/json
[
  • "5b8c2a14-7d3e-4f90-a1b2-c3d4e5f60718",
  • "6c9d3b25-8e4f-40a1-b2c3-d4e5f6071829"
]
Response samples 
application/json
{
  • "errorCode": "AccessDenied",
  • "message": "Unauthorized. Get bearer JWT token at /api/login"
}
Get YARA Rules
The HTTP GET request to the /api/v1/malwareDetection/yaraRules endpoint gets YARA rules located in the Veeam Backup & Replication installation folder. The default path is %ProgramFiles%\Veeam\Backup and Replication\Backup\YaraRules for Microsoft Windows-based backup servers and /var/lib/veeam/yara_rules for Linux-based backup servers. 
Available to: Backup Administrator, Restore Operator, Incident API Operator. Also available to custom roles that have restore permissions.


SecurityBearer 
Request 
header Parameters
x-api-version
required
string
 Default:  1.3-rev2
Version and revision of the client REST API. Must be in the following format: <version>-<revision>.


 
Responses 
200
OK


401
Unauthorized. The authorization header has been expected but not found (or found but is expired).


403
Forbidden. The user sending the request does not have adequate privileges to access one or more objects specified in the request.


404
Not found. No object was found with the path parameter specified in the request.


500
Internal server error. The request has been received but could not be completed because of an internal error at the server side.


get/api/v1/malwareDetection/yaraRules
Request samples 
Response samples 
application/json
{
  • "data": [
    ],
  • "pagination": {
    }
}
Scan Backups with Antivirus or YARA Rules
The HTTP POST request to the /api/v1/malwareDetection/scanBackup endpoint scans backups with antivirus or YARA rules.
Available to: Backup Administrator.


SecurityBearer 
Request 
header Parameters
x-api-version
required
string
 Default:  1.3-rev2
Version and revision of the client REST API. Must be in the following format: <version>-<revision>.


 
Request Body schema: application/json
required
type
required
string (EMalwareBackupScanSpecType) 
Malware backup scan specification type.


 
scanMode
required
string (EMalwareBackupScanMode) 
Backup scan mode.


 Enum Value Description
MostRecent
Use this mode if you think a cyber-attack started recently. Restore points will be scanned sequentially, starting from the most recent restore point, until a malware-free restore point is found.


AllInInterval
Use this mode to scan backup content with necessary YARA rules. Restore points will be scanned sequentially and a malware event will be initiated.


FirstInInterval
Use this mode if you are not sure when the attack started. Restore points will be scanned in optimal order until a malware-free restore point is found.


Specific
Use this mode to scan a specific restore point. Requires the restorePointId field.


 
required
object (MalwareBackupScanSpecEngine) 
Type of backup scan engine.


 
required
Array of objects (BackupObjectPair) 
Array of objects containing the backup IDs and backup object IDs.


 
restorePointId
string <uuid> 
ID of the restore point to scan. Required when scanMode is Specific.


 
object (MalwareBackupScanRange) 
Backup scan range. If you do not specify this parameter, Veeam Backup & Replication will scan all available restore points.


 
continueScan
boolean
If true, the backup scan will continue even after it finds affected restore points.


 
Responses 
201
A SureBackup session has been created to scan the backup. To check the progress, track the session state.


400
Bad request. This error is related to POST/PUT requests. The request body is malformed, incomplete or otherwise invalid.


401
Unauthorized. The authorization header has been expected but not found (or found but is expired).


403
Forbidden. The user sending the request does not have adequate privileges to access one or more objects specified in the request.


500
Internal server error. The request has been received but could not be completed because of an internal error at the server side.


post/api/v1/malwareDetection/scanBackup
Request samples 
application/json
{
  • "type": "Backup",
  • "backupObjectPair": [
    ],
  • "scanMode": "AllInInterval",
  • "scanEngine": {
    }
}
Response samples 
application/json
{
  • "sessionType": "SureBackup",
  • "state": "Stopped",
  • "id": "a330c612-07b2-4c3a-adbf-0007f904bbfd",
  • "name": "Scan Backup",
  • "jobId": "34b77de9-d5e2-4752-aff8-929bc428e80f",
  • "creationTime": "2024-11-11T12:34:46.027793",
  • "endTime": "2024-11-11T12:45:22.123456",
  • "progressPercent": 100,
  • "result": {
    },
  • "resourceId": "a330c612-07b2-4c3a-adbf-0007f904bbfd",
  • "usn": 0
}
Start Malware Encryption Analysis
The HTTP POST request to the /api/v1/malwareDetection/analyzeEncryption endpoint starts a malware encryption analysis job based on a suspicious activity event. The request returns a session model that tracks the analysis job progress.
Available to: Backup Administrator.


SecurityBearer 
Request 
header Parameters
x-api-version
required
string
 Default:  1.3-rev2
Version and revision of the client REST API. Must be in the following format: <version>-<revision>.


 
Request Body schema: application/json
required
eventId
required
string <uuid> 
ID of the suspicious activity event to analyze. To get the ID, run the Get All Malware Events request.


 
Responses 
202
Accepted. The encryption analysis job has been started.


400
Bad request. This error is related to POST/PUT requests. The request body is malformed, incomplete or otherwise invalid.


401
Unauthorized. The authorization header has been expected but not found (or found but is expired).


403
Forbidden. The user sending the request does not have adequate privileges to access one or more objects specified in the request.


404
Not found. No object was found with the path parameter specified in the request.


500
Internal server error. The request has been received but could not be completed because of an internal error at the server side.


post/api/v1/malwareDetection/analyzeEncryption
Request samples 
application/json
{
  • "eventId": "8f3c1a20-9b6e-4d11-bb52-1c2d3e4f5a60"
}
Response samples 
application/json
{
  • "id": "497f6eca-6276-4993-bfeb-53cbbbba6f08",
  • "name": "string",
  • "jobId": "9d222c6d-893e-4e79-8201-3c9ca16a0f39",
  • "sessionType": "Infrastructure",
  • "creationTime": "2019-08-24T14:15:22Z",
  • "endTime": "2019-08-24T14:15:22Z",
  • "state": "Stopped",
  • "progressPercent": 0,
  • "result": {
    },
  • "resourceId": "026d60bb-63a8-407e-bf67-01dcfc6022e6",
  • "resourceReference": "string",
  • "parentSessionId": "b1d7834e-fe2f-4cad-b0e5-ff5c5615f344",
  • "usn": 0,
  • "platformName": "VMware",
  • "platformId": "32a6e381-64f4-4911-86b6-3bf681b64d23",
  • "initiatedBy": "string",
  • "relatedSessionId": "f3a08375-4fc2-4154-a968-538c1da6dd56",
  • "algorithm": "Full",
  • "progress": {
    },
  • "originalSessionId": "1db29c85-df48-4dff-a498-05491cf54d6f",
  • "retryInfo": {
    }
}
Download Malware Encryption Analysis Logs
The HTTP GET request to the /api/v1/malwareDetection/analyzeEncryption/{sessionId}/logs endpoint downloads the log file from a completed malware encryption analysis session. 
Available to: Backup Administrator.


SecurityBearer 
Request 
path Parameters
sessionId
required
string <uuid> 
Session ID of the completed encryption analysis job. To get the session ID, run the Start Malware Encryption Analysis request or check the Get Session endpoint.


 
header Parameters
x-api-version
required
string
 Default:  1.3-rev2
Version and revision of the client REST API. Must be in the following format: <version>-<revision>.


 
Responses 
200
OK. The log file is returned.


401
Unauthorized. The authorization header has been expected but not found (or found but is expired).


403
Forbidden. The user sending the request does not have adequate privileges to access one or more objects specified in the request.


404
Not found. No object was found with the path parameter specified in the request.


500
Internal server error. The request has been received but could not be completed because of an internal error at the server side.


get/api/v1/malwareDetection/analyzeEncryption/{sessionId}/logs
Request samples 
Response samples 
application/json
{
  • "errorCode": "AccessDenied",
  • "message": "Unauthorized. Get bearer JWT token at /api/login"
}