VSA - Host Management Console API

[OliverW]

Hello,
there is an API for the Host Management Console, reachable with https://<vsa-ip>:10443/api/.
But I'm not able to login to this API to automate things like user creation, because login with MFA enabled accounts is not possible because of the missing OTP, with MFA disabled accounts it's generally not allowed to login.
Is there any way to login to the API?
I already opened support case #08042260 for it, but no help so far in regards to a successful login.

Thanks!

[Mildur]

Hi Oliver,

This is a private API used by our product and is not intended for customer use. You won’t be able to log in and use it.

If you want to automate user management today, I suggest leveraging external identity services such as SAML or Active Directory, where you already have options to automate user provisioning.

I can’t promise whether we will ever provide a supported API to manage users or other settings outside of the intended graphical interfaces or the backup server API, but I will take your request and discuss it internally. What other configurations would you like to see exposed via a supported API?

Best,
Fabian

[OliverW]

Hello Fabian,

thanks for the explanation.
Helpful for our cases would be the following possibilities:
- create / update / delete users
- check for updates and trigger installation (seems to be coming with VSPC?)
- get the status of Veeam services running on VSA (to implement in our monitoring)
- get events from event log

Would be great if you can discuss these topics internally, thank you!

[matteu]

Hello,
Are there some updates on it ?
Interesting query

[Mildur]

No updates regarding the API requests.

- get the status of Veeam services running on VSA (to implement in our monitoring)

V13.1 appliances will allow you to expose statistics on https://<appliance FQDN/IP>/metrics.
Veeam services can also be monitored that way.

get events from event log

Part of the events will be shared through our syslog integration. We are currently checking whether we can forward all events from Host Management through syslog.

Best,
Fabian

[fabbar]

If you want to automate user management today, I suggest leveraging external identity services such as SAML or Active Directory

Hi, just IMHO
first of all in the past best practice was VBR not joined to domain, so it's quite strange now is a suggestion.
Then, I think VSA APIs would be useful, even if to reset/synchronize passwords for service users (those ones will never die), with passwords saved in a proper manner (eg.: Hashicorp Vault or similar tool).
I think also regular users password would have been able to update via APIs: we use a central identity manager solution that pushes and synchronize password in many target, and we think it would be useful do this also with VSA. In this manner we have aligned password without a identity service dependency.

[Mildur]

In the past, the backup server was only Windows. Nowadays, with Linux via Veeam Software Appliance, I do not see it as a major risk.
Use MFA on VSA, and user accounts from a hijacked domain cannot be leveraged to access the backup software.

With Windows it was different: hijacked global admin accounts could easily give you access to the Windows OS and, from there, any installed application.
With Linux, a global Admin does not have just root access to the Linux OS. Also, SSH is disabled by default.

But we are still considering an official API for Host Management, but there is no ETA or news I can share today.

Best,
Fabian