Veeam Enterprise Manager RestAPI

[jjnts]

Hi all,
we are trying to automate role creation for veeam enterprise manager for one of our customers. Specific AD user groups should be able to do restores for specific VMs at branch offices (VM tags should be used). We are able to create a role and set a scope for the specific AD group via VM tags, but we are not able to define the permissions via RestAPI (user should be able to restore files and databases, but not full VMs for example).
We don't find any information regarding permissions in the RestAPI documentation.
Anyone out there who could help us?
Best regards,
Johnny

[nikolaj]

Hi Johnny,

Could these /security/accounts methods be what you're looking for?

Thanks.

[jjnts]

Hi,

we already read through the documentation but it seeams to be incomplete. we are able to set restore scope, "allow restore of files with these extensions only" and "deny in-place database restores (safer)". But we are note able to modify the other settings.

API Post we are using:

Code: Select all

{{vem-url}}/api/security/accounts

<?xml version="1.0" encoding="utf-8"?>
<EnterpriseAccountCreateSpec xmlns="http://www.veeam.com/ent/v1.0" xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance">
    <AccountType>Group</AccountType>
    <AccountName>NTSLAB\adm-DI-I-DC</AccountName>
    <Roles>
        <EnterpriseRole>
            <EnterpriseRoleUid>d19a3d33-cb77-4ffe-94e6-001432483a4e</EnterpriseRoleUid>
        </EnterpriseRole>
    </Roles>
    <AllowRestoreAllVms>false</AllowRestoreAllVms>
    <HierarchyScopeObjects>
        <HierarchyScopeItem>
            <HierarchyObjRef>urn:VMware:Tag:8c8ab89c-d71c-4432-9d9e-bf870420068d.urn:vmomi:InventoryServiceTag:37655ce5-0e78-4153-97df-90f61c8868fd:GLOBAL</HierarchyObjRef>
            <ObjectName>JJU</ObjectName>
        </HierarchyScopeItem>
    </HierarchyScopeObjects>
    <FlrSettings>
        <FlrInplaceOnly>true</FlrInplaceOnly>
    </FlrSettings>
    <SqlSettings>
        <DenyInPlaceRestore>true</DenyInPlaceRestore>
    </SqlSettings>
</EnterpriseAccountCreateSpec>

I am trying to add a screenshot of the result.

BR

[jjnts]

the result of the API post above is:
https://ibb.co/XJ91Wnp

[jjnts]

we have solved this now although its badly documented.
after adding an account you have to assing roles (SQL restore operator and file restore operator role in our case). then the checkboxes are activated accordingly.

[nikolaj]

Thanks for sharing!
Would you care to leave feedback on the specific endpoint article in the user guide ('Send feedback' button at the bottom) so that our technical writers could make it more obvious right away?