Commvault API

The common use is a ticket from a Commvault alert email in your PSA: the agent finds the job on the client’s CommServe, reads why it failed, resubmits it, reads the result, and then closes the ticket or escalates it with the cause. It can also pause a server’s backups for maintenance, check storage space, and start a restore or a workflow, which asks a technician first under the Helpdesk and IT Admin profiles.

Automatically enabled when you configure Commvault permissions in your agent workflow.

What It Does

Read jobs, their failed items, details and events, and the CommServe’s triggered alerts
Suspend, resume, kill and resubmit jobs, and start a backup of a subclient, a VM or a plan
Read servers, agents and subclients; add a server by installing the Commvault software, retire or delete one, and turn its backup, restore and data aging activity off or on
Read storage pools with their capacity and free space, and their media agents
Browse backed-up data, start a file or virtual machine restore, and run a Commvault workflow
Read plans, schedules, companies, licence use and the CommServe’s version

Permission Groups

Group	Covers
Jobs & Events	Jobs and their details, failed items, task details, logs and history, CommServe events; suspend, resume, kill and resubmit a job, start a backup
Alerts & Monitoring	Triggered alerts and console alerts, alert definitions and rules, anomaly reports, syslog, SNMP and SIEM connectors
Clients & Agents	Servers and server groups, agents, instances, backup sets and subclients, hypervisors and VM groups, Kubernetes, Microsoft 365 and SaaS apps, software installs; add, retire or delete a server, activity control
Plans & Schedules	Plans, backup destinations, RPO and retention, schedules and schedule policies, blackout windows and operation rules
Restores & Recovery	Browsing backed-up data; file, database, VM and Microsoft 365 restores; recalls; failover, replication and recovery groups, runbooks and clean rooms
Storage & Media Agents	Storage pools, backup locations, libraries and tape, media agents, storage policies and copies, deduplication databases, storage arrays and snapshots
Workflows & Commands	Workflows, running a workflow as a job or through its API, webhooks, external endpoints and QCommands
Data Insights & Compliance	Data insights and eDiscovery projects, data sources and crawls, compliance searches and exports, data rooms, cyber resilience, threat scans and cost assessments
Users, Roles & Security	Users and user groups, roles and security associations, access tokens, stored credentials, key management servers, encryption and sign-in settings
CommCell, Companies & Reports	The CommServe and CommCell settings, CommCell-wide activity control, companies, licences, DR backups, reports, regions, network topologies and email server

Access Profiles

Profile	What runs on its own	What asks a technician
Read Only	Every read	No write is allowed
Helpdesk	Reads; job control, starting backups and working alerts	Changes to servers and their activity, a restore and a workflow. Every other group stays read only
IT Admin	Every read and every write but the next column	A restore, a workflow, data insights, and users and security
Full Automation	Every read and write	Only the writes that always ask (below)

Safety Controls

Control	Behavior
Always ask	These always need a technician’s approval, whatever the profile: every delete but a light one (alerts and alert rules, alert definitions, triggered alerts, event and grid filters, tags, schedule policies and their associations, operation and blackout windows, regions, webhooks, external endpoints, SIEM connectors, data cube entities, eDiscovery requests, plan rules, Kubernetes restore modifiers and a server group’s data classification plan), such as deleting a server, a server group, an agent, an instance, a backup set, a subclient, a VM or VM group, a hypervisor, a plan or a backup destination, storage, a backup location, a media agent, a failover, recovery or replication group, a company, a user, a user group, a role, a credential or a workflow; retiring, deconfiguring or offboarding a server, a VM or a company; releasing a licence; a failover group’s DR operation and its schedules, and the CommServe’s LiveSync failover settings; stopping backups, restores or any other activity for the whole CommCell (its activity switches and its activity properties); turning data aging on; encryption, data privacy (allowing or denying it) and password encryption settings; a QCommand; importing, deploying or deleting a workflow or a report; restarting services or changing the CommServe’s host name; stored credentials and a hypervisor’s credentials, deleting a key management server, S3 access keys, company authorization codes, and the sign-in settings (SAML, OpenID Connect, LDAP and Active Directory domains, a company’s local sign-in); a multi-job operation and a backup destination’s job operations; tape media operations and WORM retention; uploading a file to a server; an uninstall, data aging or an admin task run as a task, and a task Neo cannot read; a write that sends a password, key or token
Hidden credentials	Passwords, pass-keys, secrets, private, SSH and encryption keys, API keys, tokens, authorization codes and connection strings read `[removed by Neo]` in every answer. Neo refuses a write that sends the marker, and a credential in a query string
Refusals in a success	Commvault answers some refused calls with HTTP 200 and an error code; Neo reports them as refused, never as done
One CommServe per client	A call reaches the CommServe of the client it names, which on a ticket is the ticket’s company
Never sent	Neo signs in and out itself, does not create access tokens or one-time passwords, and does not download files
Your server	Neo sends the password only over HTTPS to the web server address you saved, which must be a public address, and never follows a redirect

Getting started

Core

Triggered & Scheduled Agents

Chat Agents

Integrations

Product

Workflows

Customizing Neo

What It Does

Permission Groups

Access Profiles

Safety Controls

​What It Does

​Permission Groups

​Access Profiles

​Safety Controls

What It Does

Permission Groups

Access Profiles

Safety Controls