Veeam Recovery Orchestrator 7.2
REST API Reference
Related documents

Token

To start working with the Orchestrator REST API, users must first authenticate themselves. Orchestrator REST API authorization process is based on the OAuth 2.0 Authorization Framework and involves obtaining an access token and a refresh token.

  • Access token is a string that represents authorization issued to the client and that must be used in all requests during the current logon session.
  • Refresh token is a string that represents authorization granted to the client and that can be used to obtain a new access token if the current access token expires or becomes lost.

userAuth

To start working with the Orchestrator REST API, users must first authenticate themselves.

A user must provide credentials of an account with the Orchestrator Administrator, Plan Author or Plan Operator privileges. For more information on user authentication, see Authorization and Security.

Security Scheme Type: OAuth2
Flow type: password
Token URL: /api/token

clientAuth

The Orchestrator REST API allows various client applications to authenticate themselves using client credentials. This type of credentials helps applications work with the REST API simultaneously and avoid interference from each other. For more information on client authentication, see Working with Clients.

Security Scheme Type: OAuth2
Flow type: clientCredentials
Token URL: /api/token

Get Authorization Tokens

The HTTP POST request to the /api/token path retrieves an access token and a refresh token.

SecurityuserAuth or clientAuth
Request
Request Body schema: multipart/form-data
grant_type
required
string
Default: "password"

Authorization type.

Enum: "password" "refresh_token" "client_credentials" "mfa"
username
string

[Required if the grant_type parameter value is password] User name.

password
string

[Required if the grant_type parameter value is password] Password of the user.

client_id
string

[Required if the grant_type parameter value is client_credentials] Client ID.

client_secret
string

[Required if the grant_type parameter value is client_credentials] Client secret key.

refresh_token
string

[Required if the grant_type parameter value is refresh_token] Previously received refresh token.

mfa_token
string

[Required if the grant_type parameter value is mfa] MFA token.

mfa_passcode
integer <int32>

[Required if the grant_type parameter value is mfa] Six-digit verification code generated by an authentication application.

Responses
200

OK

400

Bad request. The request body is malformed, incomplete or otherwise invalid.

401

Unauthorized request. The authorization header has been expected but not found (or found but expired).

post/api/token
Request samples 
Response samples 
{
  • "access_token": "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJuYW1lIjoiSm9obiBEb2UiLCJpYXQiOjE1MTYyMzkwMjJ9.hqWGSaFpvbrXkOWc6lrnffhNWR19W_S1YKFBx2arWBk",
  • "token_type": "bearer",
  • "refresh_token": "iAtow6zC8+36D/wzn3DFUsgqX/qAZYIG3XPlysUzo4k=",
  • "expires_in": "899"
}
Logout
The HTTP DELETE request to the /api/token endpoint performs logout from the Orchestrator REST API for an authorized user or client.


SecurityuserAuth or clientAuth 
Responses 
204
No Content


delete/api/token
Request samples