> ## Documentation Index
> Fetch the complete documentation index at: https://docs.neoagent.io/llms.txt
> Use this file to discover all available pages before exploring further.

# Veeam Backup & Replication API

> Work backup job tickets on a client's own backup server: read why a job failed, retry it, check repositories, and start restores

The common use is a ticket from a Veeam Backup & Replication job email in your PSA: the agent finds the job and its session on the client's backup server, reads why each machine failed, retries the job, reads the result, and then closes the ticket or escalates it with the cause. It can also check repository space and start a restore, which asks a technician first under the Helpdesk and IT Admin profiles.

> [!NOTE]
>
> Automatically enabled when you configure Veeam Backup & Replication permissions in your agent workflow.

## What It Does

* Read every job's state and last result, its sessions, each machine's result and the session log
* Start, stop, retry, enable and disable jobs, and change their settings
* Read repositories with their capacity and free space, protected machines, backups and restore points
* Start an instant recovery, an entire VM restore or a file restore, and migrate or stop an instant recovery
* Read malware events, protection groups and Veeam Agents, managed servers and proxies, the server's version and license

## Permission Groups

| Group | Covers |
| - | - |
| Jobs & Sessions | Jobs and their state, sessions, task sessions and logs, tasks; start, stop, retry, enable and disable a job, a quick backup of one machine |
| Job Settings | Create, edit, clone and delete jobs, apply a policy, clear a job's cache, export and import jobs, global VM exclusions |
| Backups & Restore Points | Backups, their machines and files, restore points, replicas; delete, move, copy and health-check backups |
| Restore & Failover | Instant recovery, entire VM, file, file share, object storage, volume and Microsoft Entra ID restores, the backup browser, disk publishing and management, failover and failback |
| Repositories & Storage | Backup and scale-out repositories, their capacity and state, sealed and maintenance modes, cloud storage and Veeam Data Cloud Vault |
| Servers & Proxies | Managed servers, proxies, mount servers, WAN accelerators, helper appliances, the high availability cluster, traffic rules, the inventory, Microsoft Entra ID tenants and Active Directory domains |
| Agents & Protection Groups | Protection groups and their computers, Veeam Agent installs and upgrades, reboots, recovery tokens and recovery appliances |
| Malware Detection & Security | Malware events and settings, marking a backup clean or infected, scans and exclusions, the Security & Compliance Analyzer, authorization events |
| Credentials & Encryption | Credentials records, cloud credentials, encryption passwords and KMS servers |
| Users & Roles | Users and groups, their roles, custom roles, multi-factor authentication settings and access control lists |
| Server Settings & License | Server information, general options, the license, configuration backup, log export and My Account registration |

## Access Profiles

| Profile | What runs on its own | What asks a technician |
| - | - | - |
| **Read Only** | Every read | No write is allowed |
| **Helpdesk** | Reads, and starting, stopping, retrying, enabling and disabling jobs | A restore. Every other group stays read only |
| **IT Admin** | Every read and every write but the next column | A restore or failover, users and roles, and malware detection |
| **Full Automation** | Every read and write | Only the writes that always ask (below) |

## Safety Controls

| Control | Behavior |
| - | - |
| **Always ask** | These always need a technician's approval, whatever the profile: deleting a backup, a machine's backups, a job, a repository or a scale-out repository; a write that sets a command a job runs on the backup server before or after it, or a script it runs inside the protected machines; rebooting computers or recovery appliances; failing replicas over, for good or as planned, failing back to production, switching over, committing a failback, and undoing a failover or a failback; erasing a disk, and removing, resizing or restoring a partition or applying a disk layout during a bare-metal restore; deleting or failing over the high availability cluster; removing the server's or a machine's license; any change to Credentials & Encryption; an update of a record that holds a stored password, key or community string; a write that sends a password, key or code; uninstalling Veeam Agent, its driver or every Veeam component from computers, or removing a protection group together with its agents; resetting a user's multi-factor authentication, changing whether a user signs in without it, and changing its settings |
| **Hidden credentials** | Passwords, passphrases, private keys, secret and shared keys, key files, certificate files, community strings, recovery tokens and keys, codes and tokens read `[hidden by Neo]` in every answer. An update keeps each stored value it leaves out; Neo refuses a write that sends the marker |
| **One server per client** | A call reaches the backup server of the client it names, which on a ticket is the ticket's company |
| **Never sent** | Neo signs in and out itself, does not download files (recovery media, packages, logs, reports, downloaded files), and does not read a BitLocker recovery key or generate passwords for restored users |
| **Your server** | Neo sends the password only over HTTPS to the server address you saved, which must be a public address, and never follows a redirect |


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.