Skip to content
Authrim

Authorize periodic export for one replication pair

POST
/api/admin/replication-backups/grants
Code sample: Shell / cURL 
curl --request POST \
  --url https://auth.example.com/api/admin/replication-backups/grants \
  --header 'Authorization: Bearer <token>' \
  --header 'Content-Type: application/json' \
  --data '{ "pairId": "example", "sourceDeploymentId": "example", "destinationDeploymentId": "example", "selection": { "settings": true, "users": true, "admin": true, "artifacts": true, "logs": { "audit": true, "other": true, "sensitive": true, "period": 7 } }, "expiresAt": 1 }'

Fresh human session MFA within five minutes and backup read, manage and export permissions are required. Sensitive selections additionally require the sensitive-backup permission. Audit persistence is required before any grant mutation. Returns a random 256-bit bearer credential once. Only its SHA-256 hash is stored. The immutable grant fixes source tenant, pair, source and destination deployment, issuer and selection. Expiry must be within thirty days. This credential cannot import data, approve restores or access the ordinary Admin API. The source must match installed replication configuration; the administrator explicitly approves the destination deployment identifier. No backup passphrase is accepted.

Authorizations

Section titled “Authorizations ”

Request Body required

Section titled “Request Body required ”
Media type application/json
object
pairId
required
string
/^[A-Za-z0-9_.:-]{1,128}$/
sourceDeploymentId
required
string
/^[A-Za-z0-9_.:-]{1,128}$/
destinationDeploymentId
required
string
/^[A-Za-z0-9_.:-]{1,128}$/
selection
required
object
settings
required
boolean
users
required
boolean
admin
required
boolean
artifacts
required
boolean
logs
required
object
audit
required
boolean
other
required
boolean
sensitive
required
boolean
period
required
One of:
integer
Allowed values: 7 30 90
key
additional properties
key
additional properties
expiresAt
required

Unix milliseconds; after now and no more than thirty days from now.

integer
key
additional properties

Responses

Section titled “ Responses ”

201

Section titled “201 ”

Operation result. Responses are not cacheable.

Media type application/json
object
grant
required
object
id
required
string
/^[A-Za-z0-9_.:-]{1,128}$/
createdBy
required
string
/^[A-Za-z0-9_.:-]{1,128}$/
createdAt
required
integer
expiresAt
required
integer
revokedAt
required
integer
nullable
scope
required
object
version
required
integer
Allowed values: 1
kind
required
string
Allowed values: tenant_backup_export
tenantId
required
string
/^[A-Za-z0-9_.:-]{1,128}$/
pairId
required
string
/^[A-Za-z0-9_.:-]{1,128}$/
sourceDeploymentId
required
string
/^[A-Za-z0-9_.:-]{1,128}$/
destinationDeploymentId
required
string
/^[A-Za-z0-9_.:-]{1,128}$/
issuer
required
string format: uri
selection
required
object
settings
required
boolean
users
required
boolean
admin
required
boolean
artifacts
required
boolean
logs
required
object
audit
required
boolean
other
required
boolean
sensitive
required
boolean
period
required
One of:
integer
Allowed values: 7 30 90
key
additional properties
key
additional properties
key
additional properties
key
additional properties
credential
required
string
/^[a-f0-9]{64}$/
key
additional properties
Example 
{
  "grant": {
    "scope": {
      "version": 1,
      "kind": "tenant_backup_export",
      "selection": {
        "logs": {
          "period": 7
        }
      }
    }
  }
}

400

Section titled “400 ”

Request rejected; no additional capability is granted.

403

Section titled “403 ”

Request rejected; no additional capability is granted.

404

Section titled “404 ”

Request rejected; no additional capability is granted.

409

Section titled “409 ”

Request rejected; no additional capability is granted.

503

Section titled “503 ”

Request rejected; no additional capability is granted.