canonical: https://jentic.com/apis/azure.com/azure-sql-server-backup-long-term-retention-vault

# Microsoft Azure Azure SQL Server Backup Long Term Retention Vault

Jentic publishes the only available OpenAPI specification for Azure SQL Server Backup Long Term Retention Vault, keeping it validated and agent-ready. The API associates an Azure SQL logical server with a Recovery Services vault that holds long-term retention backups, letting agents list current vault associations, retrieve a specific vault registration, or attach a new vault to a server. It targets the Microsoft.Sql resource provider on Azure Resource Manager and is intended for compliance and retention workflows that exceed the default backup window.

## For AI agents

Associate an Azure SQL server with a Recovery Services vault so backups can be retained beyond the default window.

## Scope

Does not trigger backups, list recovery points, or restore databases - use for registering a Recovery Services vault on a SQL server only.

## Capabilities

- List backup long-term retention vaults registered on a SQL server
- Retrieve a specific named vault registration on a server
- Register a Recovery Services vault as the LTR target for a SQL server
- Update the vault used for long-term retention on a server
- Audit vault registrations across servers in a subscription

## Use cases

### Enable long-term backup retention for compliance

Register a Recovery Services vault on a SQL server so that database backups can be retained for years rather than the default 35 days. The PUT /backupLongTermRetentionVaults/{vaultName} operation associates a vault id with the server in a single call. Required for industries with long retention mandates such as financial services and healthcare.

Example prompt: PUT /servers/{serverName}/backupLongTermRetentionVaults/RetentionVault with the recoveryServicesVaultResourceId and verify the GET returns the new association

### Compliance audit of LTR coverage

Walk every SQL server in a subscription and report which have an LTR vault registered and which fall back to the default backup window. The GET /backupLongTermRetentionVaults collection returns each server's vault association in a single call. Output supports auditor reports demonstrating retention coverage.

Example prompt: Iterate every SQL server in subscriptionId X, GET its backupLongTermRetentionVaults, and emit a CSV of servers without a registered vault

### Re-target backups to a new vault

Move LTR backups for a server to a different Recovery Services vault, for example to consolidate vaults across regions or migrate from a legacy vault. The same PUT operation accepts the new vault id, replacing the existing association. Use during vault consolidation initiatives.

Example prompt: PUT /servers/{serverName}/backupLongTermRetentionVaults/RetentionVault with the new recoveryServicesVaultResourceId and verify the previous vault no longer appears in the GET list

### Agent-driven retention setup

Let an AI agent register an LTR vault as part of an environment bring-up workflow without an operator hand-coding the long ARM URL. Through Jentic the agent searches by intent, loads the vault id schema, and executes the PUT. Removes a class of typos when constructing nested resource paths.

Example prompt: Search Jentic for 'register long term retention vault azure sql', load the vault association schema, and execute against the named server

## Key endpoints

| Method | Path | Description |
| --- | --- | --- |
| GET | /subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.Sql/servers/{serverName}/backupLongTermRetentionVaults | List LTR vaults on a SQL server |
| GET | /subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.Sql/servers/{serverName}/backupLongTermRetentionVaults/{backupLongTermRetentionVaultName} | Get a named vault registration |
| PUT | /subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.Sql/servers/{serverName}/backupLongTermRetentionVaults/{backupLongTermRetentionVaultName} | Register or update an LTR vault on a SQL server |

## Key resources

- **backupLongTermRetentionVaults** — Read or update the LTR vault registered to a SQL server

## Why Jentic

- **Setup:** Wiring the Azure SQL long-term retention vault API by hand means registering an Azure AD app for OAuth2 bearer auth against management.azure.com, building the nested Microsoft.Sql server path, and passing a Recovery Services vault resource id in the body while tracking the Azure-AsyncOperation header. Through Jentic you install once, import Azure SQL Server Backup Long Term Retention Vault from the API Directory, store the Azure AD credential once, and your agent calls it.
- **Permission scoping:** The server and vault name sit in the URL path (/servers/{serverName}/backupLongTermRetentionVaults/{backupLongTermRetentionVaultName}), so a rule can pin your agent to one server's vault registration. You choose the operations it may call, so the vault-attaching PUT is not included unless you add it, leaving an agent that can only list and read registrations.
- **Credential handling:** Your Azure AD credential is stored once, encrypted, by your own Jentic One instance and injected at execution time. It never enters the agent's prompt, logs, or context.
- **Discovery method:** Agents search Jentic by intent such as 'register a long term retention vault for an azure sql server' or 'list the vaults on a server', and Jentic returns the matching Microsoft.Sql backupLongTermRetentionVaults operation with its vault id input schema so the agent calls the right endpoint without constructing the ARM path itself.

## Related APIs

- **Azure SQL Database backup** — Manages individual database backups that the LTR vault retains
- **Azure SQL Database Import/Export spec** — Customer-managed BACPAC archives in Blob Storage rather than vault-based retention
- **Azure SQL Database backup long-term retention policy** — Defines the per-database retention policy that uses the registered vault

## FAQ

### Why is there no official OpenAPI spec for Azure SQL Server Backup Long Term Retention Vault?

Microsoft Azure does not publish an OpenAPI specification. Jentic generates and maintains this spec so that AI agents and developers can call Azure SQL Server Backup Long Term Retention Vault via structured tooling. It is validated against the live API and kept up to date. Get started with Jentic One, the self-hosted execution layer.

### What authentication does this API use?

The API uses Azure AD OAuth 2.0 with the implicit flow, scoped to user_impersonation against management.azure.com. Through Jentic, the bearer token is held in your Jentic One instance and exchanged for a scoped access token at execution time.

### Can I register more than one vault on a server?

At this API version (2014-04-01) the backupLongTermRetentionVaults collection holds a single named registration per server, addressed as /backupLongTermRetentionVaults/{backupLongTermRetentionVaultName}. Subsequent versions of the broader long-term retention API expose richer policy controls.

### What are the rate limits for this API?

Azure Resource Manager applies tenant-level throttling - typically 12,000 reads and 1,200 writes per hour per subscription. The PUT operation may return 202 Accepted; track completion via the Azure-AsyncOperation header.

### How do I register a vault through Jentic?

Run pip install jentic, then search for 'register long term retention vault azure sql'. Jentic returns the PUT /backupLongTermRetentionVaults/{name} operation, loads the recoveryServicesVaultResourceId schema, and executes against the server you specify.

### Does this API trigger or restore individual backups?

No. This API only manages the vault association on a SQL server. Triggering a backup, listing recovery points, or restoring to a point in time is handled by the related backup and Recovery Services APIs.

### Can I limit what my agent is allowed to do with the Azure SQL Server Backup Long Term Retention Vault API?

Yes. Because you run Jentic One yourself, your own rules decide which of the three operations the agent can reach: listing the vaults on a server, reading a named vault registration, or the PUT that registers or updates a vault. You can grant only the two read operations, so the vault-attaching PUT is not included unless you add it, leaving an agent that can only list and inspect registrations. Since the server and vault name sit in the request path, a rule can also pin the agent to a single server's vault registration.