Getting started with the Veeam REST API for Nutanix

[mikkeland]

Hi,

I'm getting started with the REST API for Nutanix, but have some issues getting off the ground.
According to the v8 API reference i need to connect to https://<hostname>/extension/799a5a3e-ae1e-4eaf-86eb-8a9acc2670e2/api/v8 and this is where I'm hitting a roadblock.
My Veeam server is not listening on port 443.

I can connect (and authenticate) to the regular Veeam API on port 4129 just fine, but cannot seem to figure out the connection to the Nutanix specific API.
I've tried the Nutanix/Veeam proxy which does have a listen on port 443, but that appears to not working.

My simple goal is to get a list of jobs with the current status and a list of (un)protected VMs

Pretty sure it's a simple thing I'm missing.

/mikkel

[mikkeland]

Should probably add that this is a fully updated v12.3 running ong Windows Server 2025

[ronnmartin61]

@mikkeland in terms of the overall process you'll need to authenticate to the standard VBR RestAPI via port 9419 e.g. https://hostnameorip:9419/api/oauth2/token and then like you note hit 443 with the access token for remaining calls e.g. https://hostnameorip/extension/799a5a3e ... properties

Please refer to https://helpcenter.veeam.com/references ... ctionAbout for details. Also note that the Nutanix RestAPI is not in a very complete state at the moment with the functional merge into core VBR. This is something we're actively working on but had to defer in order to complete the migration into VBR and support v13.

[ronnmartin61]

@mikkeland apologies as I didn't see you added this was VBR 12.3. Please refer to this guide for the RestAPI support you're looking for - https://helpcenter.veeam.com/references ... ctionAbout

[mikkeland]

I've made some progress, mostly by reading https://github.com/mcruise40/Veeam-NutanixAhv/tree/main
- I need to connect and authenticate to the Veeam proxy running as a VM in Nutanix. Makes sense.
- I get the access token (and refresh token and exipries)

Access established and now the parsing of the response will be the next challenge.

What initially threw me off was v7 vs. v8 and once i settled on v7 i made a bone headed mistake in the syntax for the auhtorization header. Live and learn ...

/Mikkel

[ronnmartin61]

Feel free to check out this Git site also - https://github.com/VeeamHub/veeam-nutanix

[mikkeland]

I will be working on this some more - for now I have figured out the access and some (very) basic reporting.
Still extremely basic, but it's a start

Code: Select all

$proxyIP= "ip of the ntnx proxy"
$username = "username"
$Password = "password"

$body = @{
    "grant_type" = "password"
    "username" = $username
    "password" = $password
    "refresh_token" = ""
    "code" = ""
    "use_short_term_refresh" = ""
    "vbr_token" = ""
}

$response = Invoke-WebRequest -Uri "https://${proxyIP}/api/oauth2/token" `
    -Method Post `
    -Headers $headers `
    -ContentType "application/x-www-form-urlencoded" `
    -Body $body `
    -SkipCertificateCheck

$token = ($response.Content | ConvertFrom-Json).AccessToken

$headers = @{
    "Authorization" = "Bearer $token"
}

$resp = Invoke-WebRequest -Uri "https://$proxyIP/api/v7/protectedVms" -Headers $headers -SkipCertificateCheck
$protectedvms = ($resp.content | convertfrom-json).Results | Select Name, Snapshots, Backups, ClusterName, lastProtectionDateUtc | Sort Name

$resp = Invoke-WebRequest -Uri "https://$proxyIP/api/v7/jobs" -Headers $headers -SkipCertificateCheck
$jobs = ($resp.content | convertfrom-json).Results | Sort Name | FT Name, Status, Mode, lastRunUtc, nextRunUtc 

[mikkeland]

Me again ... Sorry

Hit an odd snag - the Nutanix setup I'm working with has two clusters (two sites) and single Prism Central.
The Veeam Backup for Nutanix AHV has been deployed to cluster A and second worker to cluster B

The initial appliance deployed is - of course - the "brains" of the Nutanix integration, and that's the vm i direct all API request to. So far so good - I can see both clusters, all vms and all jobs.

All jobs are based on Nutanix catagories and looking in the VBR GUI, the resulting backups all match what I expect.

Querying the protectedVms API endpoint i only get 72 VMs with a backup within the last 24 hours, but the appliance webinterface gives the correct amount, 153.

Seeing how I'm getting pretty close to 50% it stands to reason I'm missing the vms where the backup was handled by the secondary worker.

Nutanix shuts down the secondary proxy when not needed, so now I have two question
1. Is my assumption correct, that I need to queury all proxies to get the protection status of all vms?
2. how do i make sure the secondary worker don't shut down?

... or am i missing something else?

Sincerely
Mikkel

[Kochkin]

Workers do not have own database, all the orchestration and management in v7 is done by the main backup appliance.
Web UI uses both private and public REST API, so sometimes it is a good trick to check in dev tools where does it take info and do the same

/protectedVms returns only such VMs which have at least one restore point. It corresponds to what you see on "Protected VMs" tab in Web UI.

To get all the VMs you need one of:
* prismCentrals/{id}/vms
* clusters/{id}/vms

[mikkeland]

Hi,

That was my understanding as well. Unfortunately it doesn't match what i see.

Every backup job once pr. day
All backup jobs completed sometime in the last 24 hours. A few failed and reran with either success or warning.
The backup jobs are quite simple. Store locally and copy to immutable.
The backup jobs contain a total of 151 VMs according to the Veeam Nutanix appliance webinterface
This is the number i was expecting
What I am seing is this

Code: Select all

PS C:\Users\Administrator\Documents> $resp = Invoke-WebRequest -Uri "https://$proxyIP/api/v7/protectedVms" -Headers $headers -SkipCertificateCheck
PS C:\Users\Administrator\Documents> $protectedvms = ($resp.content | convertfrom-json).Results
PS C:\Users\Administrator\Documents> # Filter protected vms and veeam protection
PS C:\Users\Administrator\Documents> $24h = $protectedvms  | Where-Object { $_.lastProtectionDateUtc -ge (Get-Date).AddDays(-1)}
PS C:\Users\Administrator\Documents> $24hVeeamBackups = $24h | Where-Object { $_.backups -gt 0}
PS C:\Users\Administrator\Documents> $protectedvms.count
100
PS C:\Users\Administrator\Documents> $24h.count
73
PS C:\Users\Administrator\Documents> $24hVeeamBackups.count
73
PS C:\Users\Administrator\Documents>

Using developer tools and focusing on the pie chart i get this

Code: Select all

{
    "totalVms": 225,
    "protectedVms": 151,
    "protectedVmsWithSnapshots": 0,
    "unprotectedVms": 74
}

100 vms are protected totally
73 vms have been protected within the last 24 hours
73 vms are protected using a veeam backup as oppsed to a snapshot

Specifically I have a VM named "ad2" which has a restore point "less than a day ago". This VM is not included in protectedVMs unfiltered
It is included when i'm looking at the webinterface.
The vm called "ad3" is part of the same job and that vm is included in protectedVMs when using the API unfiltered

This is what puzzles me

/mikkel

[Kochkin]

Pie chart does not limit to 24h if I remember correctly. Old appliance logic consider any VM added to a job as protected in this chart