Acronis API

The common uses are an EDR incident, where the agent reads its detections, verdict and workload, records the triage and, once approved, isolates the workload, and a failed backup, where the agent reads why it failed, runs the protection plan again for that workload, and dismisses the alert once a backup succeeds.

Automatically enabled when you configure Acronis permissions in your agent workflow.

What It Does

Read a customer’s EDR incidents with their detections, verdict, severity and workloads, and set an incident’s investigation state, priority and comment
Run a response action Acronis offers on an incident: isolate or release a workload, restart or shut it down, stop a process, quarantine or delete a file, roll back
Read and dismiss alerts, or mark one a false positive
Read why a backup failed from its activity, run the plan again for the workload, and read its recovery points
Read protection plans and their status, apply or revoke a plan, and change one
Read workloads and agents, and update agents
Read your customer tenants, their services, usage and users; turn a service off, and disable and delete a leaver’s user so Acronis stops charging for it
Read and update Advanced Automation (Acronis PSA) tickets, and read its contracts and invoices

Permission Groups

Group	Covers
EDR Incidents	Incidents, their detections and activities, and their investigation state
EDR Response Actions	Response actions on an incident’s workload
Alerts and Events	Alerts, alert status per workload, dismissing or marking a false positive, custom alert types, the event stream
Backups, Archives and Vaults	Recovery points, archives and vaults, and deleting backups
Tasks and Activities	Backup, recovery and scan runs with their result and error (read only)
Protection Plans	Plans and their status, running, applying and revoking a plan, drafts
Workloads and Agents	Workloads, groups, agents and their update settings
Disaster Recovery	Cloud servers, sites, test and production failover
Customers and Services	Customer tenants and units, services and quotas, edition, branding
Users	Users of each tenant and their activation
Roles, MFA and API Clients	A user’s roles, MFA, the sign-in provider, API clients without their secrets
Pricing, Usage and Reports	Usage, prices, price lists, usage reports
Advanced Automation Service Desk	Acronis PSA tickets, their updates, priorities, statuses and SLAs
Advanced Automation Sales and Billing	Acronis PSA products, sales items, contracts, taxes and invoices
File Sync & Share	Files, folders, members, share links, devices, the audit log and settings
Storage and Infrastructure	Storage infrastructure, locations, storage nodes and directories

Access Profiles

Profile	What runs on its own	What asks a technician
Read Only	Every read	No write is allowed
Helpdesk	Every read outside the Roles, MFA and API Clients, Pricing, Usage and Reports, Advanced Automation Sales and Billing, and Storage and Infrastructure groups; incident triage and alert changes	Response actions, plan changes and runs, and user changes; no other write is allowed
IT Admin	Every read; changes to incidents, alerts, backups, plans, workloads, disaster recovery, users, Advanced Automation tickets and files outside Safety Controls	Response actions, and changes in the Customers and Services, Roles, MFA and API Clients, Pricing, Usage and Reports, Advanced Automation Sales and Billing, and Storage and Infrastructure groups, and the changes in Safety Controls
Full Automation	Every read and write outside Safety Controls	The changes in Safety Controls

Safety Controls

Control	Behavior
The ticket’s customer only	On a run for a ticket that names a company, Neo sends a call only when it names the customer tenant the ticket’s company is mapped to: in the path, in the call’s own tenant filter, or in `customer_tenant_id`, for which Neo first confirms the alert, task, user, workload or plan belongs to that tenant. A record of a unit inside the customer is acted on outside the ticket
No every-customer writes	A write whose filter reaches every customer under a partner (`descendants(...)`, `direct_children(...)`), and a bulk delete or revoke that names no records by id, are refused
Always asks a technician	Turning a service or an offering item off for a customer (Acronis can then delete that service’s data, backups included), changing, deleting or restoring a customer tenant, changing or deleting an API client, reporting usage, unregistering an agent, removing a workload, deleting or revoking a plan, a plan change that turns something off, committing a plan draft, deleting an alert type, deleting a backup, archive, vault, storage, infrastructure record or location, and starting or stopping a production failover
Refused	The sign-in and token endpoints, creating an API client or a registration token (each answer returns a secret), a password reset link, a password check or change, the branding update (it carries the SMTP password Neo hides), replacing a plan draft’s whole settings, a vault’s password or credentials, adding a storage node, the vault manager’s sync, stats and validation writes (Acronis’s own agents report them), file downloads and uploads, and the sales item delete, which names no record. A write that sets a password, secret or token is refused too
The connection’s own API client	Neo does not change or delete the API client it connects with
Secrets	Fields that carry a credential, such as a registration token or the SMTP password, are hidden in every answer

Setup

See Connecting Acronis to Neo.

Getting started

Core

Triggered & Scheduled Agents

Chat Agents

Integrations

Product

Workflows

Customizing Neo

What It Does

Permission Groups

Access Profiles

Safety Controls

Setup

​What It Does

​Permission Groups

​Access Profiles

​Safety Controls

​Setup

What It Does

Permission Groups

Access Profiles

Safety Controls

Setup