Veeam Backup & Replication API

The common use is a ticket from a Veeam Backup & Replication job email in your PSA: the agent finds the job and its session on the client’s backup server, reads why each machine failed, retries the job, reads the result, and then closes the ticket or escalates it with the cause. It can also check repository space and start a restore, which asks a technician first under the Helpdesk and IT Admin profiles.

Automatically enabled when you configure Veeam Backup & Replication permissions in your agent workflow.

What It Does

Read every job’s state and last result, its sessions, each machine’s result and the session log
Start, stop, retry, enable and disable jobs, and change their settings
Read repositories with their capacity and free space, protected machines, backups and restore points
Start an instant recovery, an entire VM restore or a file restore, and migrate or stop an instant recovery
Read malware events, protection groups and Veeam Agents, managed servers and proxies, the server’s version and license

Permission Groups

Group	Covers
Jobs & Sessions	Jobs and their state, sessions, task sessions and logs, tasks; start, stop, retry, enable and disable a job, a quick backup of one machine
Job Settings	Create, edit, clone and delete jobs, apply a policy, clear a job’s cache, export and import jobs, global VM exclusions
Backups & Restore Points	Backups, their machines and files, restore points, replicas; delete, move, copy and health-check backups
Restore & Failover	Instant recovery, entire VM, file, file share, object storage, volume and Microsoft Entra ID restores, the backup browser, disk publishing and management, failover and failback
Repositories & Storage	Backup and scale-out repositories, their capacity and state, sealed and maintenance modes, cloud storage and Veeam Data Cloud Vault
Servers & Proxies	Managed servers, proxies, mount servers, WAN accelerators, helper appliances, the high availability cluster, traffic rules, the inventory, Microsoft Entra ID tenants and Active Directory domains
Agents & Protection Groups	Protection groups and their computers, Veeam Agent installs and upgrades, reboots, recovery tokens and recovery appliances
Malware Detection & Security	Malware events and settings, marking a backup clean or infected, scans and exclusions, the Security & Compliance Analyzer, authorization events
Credentials & Encryption	Credentials records, cloud credentials, encryption passwords and KMS servers
Users & Roles	Users and groups, their roles, custom roles, multi-factor authentication settings and access control lists
Server Settings & License	Server information, general options, the license, configuration backup, log export and My Account registration

Access Profiles

Profile	What runs on its own	What asks a technician
Read Only	Every read	No write is allowed
Helpdesk	Reads, and starting, stopping, retrying, enabling and disabling jobs	A restore. Every other group stays read only
IT Admin	Every read and every write but the next column	A restore or failover, users and roles, and malware detection
Full Automation	Every read and write	Only the writes that always ask (below)

Safety Controls

Control	Behavior
Always ask	These always need a technician’s approval, whatever the profile: deleting a backup, a machine’s backups, a job, a repository or a scale-out repository; a write that sets a command a job runs on the backup server before or after it, or a script it runs inside the protected machines; rebooting computers or recovery appliances; failing replicas over, for good or as planned, failing back to production, switching over, committing a failback, and undoing a failover or a failback; erasing a disk, and removing, resizing or restoring a partition or applying a disk layout during a bare-metal restore; deleting or failing over the high availability cluster; removing the server’s or a machine’s license; any change to Credentials & Encryption; an update of a record that holds a stored password, key or community string; a write that sends a password, key or code; uninstalling Veeam Agent, its driver or every Veeam component from computers, or removing a protection group together with its agents; resetting a user’s multi-factor authentication, changing whether a user signs in without it, and changing its settings
Hidden credentials	Passwords, passphrases, private keys, secret and shared keys, key files, certificate files, community strings, recovery tokens and keys, codes and tokens read `[hidden by Neo]` in every answer. An update keeps each stored value it leaves out; Neo refuses a write that sends the marker
One server per client	A call reaches the backup server of the client it names, which on a ticket is the ticket’s company
Never sent	Neo signs in and out itself, does not download files (recovery media, packages, logs, reports, downloaded files), and does not read a BitLocker recovery key or generate passwords for restored users
Your server	Neo sends the password only over HTTPS to the server address you saved, which must be a public address, and never follows a redirect

Getting started

Core

Triggered & Scheduled Agents

Chat Agents

Integrations

Product

Workflows

Customizing Neo

Veeam Backup & Replication API

What It Does

Permission Groups

Access Profiles

Safety Controls

​What It Does

​Permission Groups

​Access Profiles

​Safety Controls

What It Does

Permission Groups

Access Profiles

Safety Controls