Veeam Service Provider Console API

The common use is a ticket from a Veeam Service Provider Console alarm email in your PSA: the agent finds the triggered alarm and the job behind it, reads why it failed, retries it, reads the next run, and then resolves the alarm and closes the ticket or escalates it with the cause. It can also set up and change companies in the console.

Automatically enabled when you configure Veeam Service Provider Console permissions in your agent workflow.

What It Does

Read triggered alarms and their history, and resolve or acknowledge them
Read backup server, Veeam Agent and Microsoft 365 jobs: status, last run, failure message and each object’s result
Retry, start and stop jobs, and change their settings
Read and restart Veeam Agents and management agents
Read backup servers, repositories and their free space, protected machines and their restore points
Create and change companies, locations, quotas, Cloud Connect and Microsoft 365 resources, and subscription plans
Read licensing, usage and the console’s activity

Permission Groups

Group	Covers
Alarms	Triggered alarms: resolve, acknowledge, delete; alarm templates and a company’s alarm settings
Job Runs	Start, stop and retry backup server jobs, Veeam Agent jobs and Microsoft 365 jobs
Backup Jobs	Jobs on backup servers and Veeam Agents: status, last run, objects and settings; create, change, assign and delete
Backup Agents and Policies	Veeam Agents for Windows, Linux and Mac: settings, policies, activation, restart, update; backup policies
Backup Servers and Repositories	Backup servers, repositories, proxies, WAN accelerators, managed servers, protection groups and stored credentials; Veeam ONE and Enterprise Manager servers
Failover Plans	Failover plans and their objects; starting and undoing a failover
Protected Workloads and Backups	Protected VMs, computers, file shares, object storage and cloud workloads, their backups and restore points
Microsoft 365 Backup	Veeam Backup for Microsoft 365 servers, organizations, jobs, repositories, proxies and company resources
Cloud Connect and Vault	Cloud Connect sites, tenants and their resources, hosted server resources, Veeam Data Cloud Vault
Public Cloud Backup	Veeam Backup for AWS, Microsoft Azure and Google Cloud: accounts, appliances and policies
Management Agents and Discovery	Management agents: restart, settings, credentials, deployment; discovery rules and computers
Companies, Resellers and Locations	Companies, resellers, locations, containers and labels
Users and Access	Users, identities, identity providers, administrator portal users and permissions
Licensing and Billing	Licenses, usage reports, VCSP Pulse, subscription plans, billing settings and invoices
Console Settings and Activity	The console’s settings, certificates, webhooks, syslog, plugins, activity logs and asynchronous actions

Access Profiles

Profile	What runs on its own	What asks a technician
Read Only	Every read	No write is allowed
Helpdesk	Reads, resolving alarms, and starting, stopping or retrying jobs	A change to a job’s settings, a Veeam Agent or a management agent. Every other group stays read only
IT Admin	Every read and every write but the next column	Users and access, the console’s settings, and licensing and billing
Full Automation	Every read and write	Only the writes that always ask (below)

Safety Controls

Control	Behavior
Always ask	These always need a technician’s approval, whatever the profile: deleting a company, reseller, location, job, policy, backup, repository, stored credential, encryption password or invoice; any delete in Cloud Connect and Vault or in Microsoft 365 Backup; a delete that also removes backup files; starting or undoing a failover; an upgrade or patch of a backup server; deactivating a Veeam Agent or uninstalling its CBT driver; rebooting a managed computer; a change that sets a job script; any change to users and access or to the console’s settings; and storing a credential, such as a password
Hidden credentials	Passwords, secrets, keys and tokens read `[removed by Neo]` in every answer. A full update (PUT) that sends a record back as read gets the stored value back in that place; Neo refuses any other write that sends the marker, and a filter, sort or select on such a field
Ticket scope	On a ticket, the agent reaches only the console company mapped to the ticket’s company, by a name match or one you confirmed. A call goes out only when Neo can tie it to that company: a call under the company’s own path in the console, an alarm, job, server or agent Neo reads as that company’s, or a list Neo narrows to that company’s rows. Any other call, such as a list across every company or the console’s own settings, is for runs with no ticket company, such as a scheduled check or a chat
Never sent	Neo never asks the console for a token, an API key, a key pair or a TOTP secret, and does not upload or download files (license files, patches, setup packages, invoice PDFs, CSV reports)
Your console	Neo sends the key only over HTTPS to the console address you saved, which must be a public address, and never follows a redirect

Getting started

Core

Triggered & Scheduled Agents

Chat Agents

Integrations

Product

Workflows

Customizing Neo

Veeam Service Provider Console API

What It Does

Permission Groups

Access Profiles

Safety Controls

​What It Does

​Permission Groups

​Access Profiles

​Safety Controls

What It Does

Permission Groups

Access Profiles

Safety Controls