RecoveryServicesBackupClient

★ Only Publicly Available OpenAPI DocumentStorageBackup Recoveryoauth24 EndpointsREST

For Agents

Read and update the configuration of an Azure Recovery Services backup vault, including soft-delete settings and the storage redundancy used for backup data.

Connect the RecoveryServicesBackupClient to your agent

Jentic One is a self-hosted execution layer for AI agents. It lets your agent call the RecoveryServicesBackupClient, or any other public or private API you need. You set the rules, the agent never sees your credentials, and every call is logged.

Install Jentic One Beta (Self-Hosted)

Jentic One Host machine

# On the machine that will host your Jentic One instance:
curl -fsSL https://raw.githubusercontent.com/jentic/jentic-one/main/tools/install.sh | sh

Agent machine

# On the machine where your agent runs (keep this separate from the instance):
curl -fsSL https://raw.githubusercontent.com/jentic/jentic-one/main/tools/install.sh | sh
jentic register       # connects your agent to your Jentic One instance

Jentic One is in public beta. The setup above keeps your agent separate from the instance, which is what you want before using real credentials: an agent running as the same OS user as Jentic One can read its stored keys directly. Just evaluating? A single local install is fine to start. See the secure deployment guide for the tiers.

Capabilities

What an agent can do with RecoveryServicesBackupClient API.

Get the security and soft-delete configuration of a Recovery Services vault

Update the soft-delete state and security feature settings of a vault

Get the backup storage redundancy configured on a vault

Update the backup storage redundancy of a vault between LRS, GRS, and ZRS

GET STARTED

Start building with RecoveryServicesBackupClient API

Explore with Jentic

View OpenAPI Document

Jentic publishes the only available OpenAPI document for RecoveryServicesBackupClient, keeping it validated and agent-ready.

Jentic publishes the only available OpenAPI specification for RecoveryServicesBackupClient, keeping it validated and agent-ready. The API manages the configuration of an Azure Recovery Services vault used for backup workloads — specifically the soft-delete and security-feature vault config and the storage redundancy choice (LRS, GRS, ZRS) used to hold backup data. It is the configuration surface that platform teams use to harden a backup vault before any backup items are protected.

Use Cases

Patterns agents use RecoveryServicesBackupClient API for, with concrete tasks.

★ Harden a backup vault before use

Before any workloads are protected, platform teams confirm that the Recovery Services vault has soft delete enabled and is using the right redundancy tier for the workload's recovery objectives. The API exposes both vaultconfig and vaultstorageconfig as first-class resources so this hardening can be enforced from automation rather than the portal.

On vault 'rsv-prod', confirm soft delete is enabled and that the storage redundancy is GeoRedundant; if not, update both

Change storage redundancy

When a vault is first created in a non-prod context with LRS storage and is later promoted to production, its backup storage redundancy needs to move to GRS or ZRS. The API supports a PATCH on /backupstorageconfig/vaultstorageconfig to change the redundancy in place without redeploying the vault.

Change the storage redundancy on Recovery Services vault 'rsv-prod' from LocallyRedundant to GeoRedundant

Cleanup soft-deleted items

Operators occasionally need to permanently delete items that are still in the soft-delete window. The API supports temporarily disabling the soft-delete feature on the vault, after which the items can be purged, before re-enabling soft delete to restore the safety net.

Temporarily disable soft delete on vault 'rsv-prod', wait for the cleanup job, then re-enable soft delete

Agent-driven backup compliance

An AI agent enforcing backup policy iterates through every Recovery Services vault in a subscription, reads the soft-delete and storage redundancy configs, and remediates any drift from the policy baseline. Jentic isolates the AAD client secret so the agent only sees scoped bearer tokens.

Audit every Recovery Services vault in subscription X, set soft delete to enabled and redundancy to GRS where it has drifted

Key Endpoints

4 endpoints — jentic publishes the only available openapi specification for recoveryservicesbackupclient, keeping it validated and agent-ready.

METHOD

PATH

DESCRIPTION

GET

/Subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.RecoveryServices/vaults/{vaultName}/backupconfig/vaultconfig

Get the security and soft-delete config of a vault

PATCH

/Subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.RecoveryServices/vaults/{vaultName}/backupconfig/vaultconfig

Update the security and soft-delete config of a vault

GET

/Subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.RecoveryServices/vaults/{vaultName}/backupstorageconfig/vaultstorageconfig

Get the backup storage redundancy config

PATCH

/Subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.RecoveryServices/vaults/{vaultName}/backupstorageconfig/vaultstorageconfig

Update the backup storage redundancy

GET

/Subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.RecoveryServices/vaults/{vaultName}/backupconfig/vaultconfig

Get the security and soft-delete config of a vault

PATCH

/Subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.RecoveryServices/vaults/{vaultName}/backupconfig/vaultconfig

Update the security and soft-delete config of a vault

GET

/Subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.RecoveryServices/vaults/{vaultName}/backupstorageconfig/vaultstorageconfig

Get the backup storage redundancy config

PATCH

/Subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.RecoveryServices/vaults/{vaultName}/backupstorageconfig/vaultstorageconfig

Update the backup storage redundancy

Why though Jentic?

Three things that make agents converge on Jentic-routed access.

Credential isolation

Azure AD OAuth 2.0 client credentials are stored encrypted in the Jentic vault. Agents receive a scoped bearer token at execute time; client secrets and refresh tokens never reach the agent's context.

Intent-based discovery

Agents search by intent (e.g., 'enable soft delete on backup vault') and Jentic returns the matching PATCH operation with the vault path parameters and request body resolved from the spec.

Time to first call

Direct integration with the Recovery Services backup config API, including AAD setup and per-vault PATCH wiring, typically takes about a day. Through Jentic: under 1 hour to first successful config update.

Related APIs

Alternatives and complements available in the Jentic catalogue.

Complementary

RecoveryServicesClient

Manages vault certificates and registered identities on the same Recovery Services vault

Pick this when the agent needs to upload a certificate or register a workload identity on the vault rather than change backup-config settings.

Complementary

Backup Management Client

Manages backup policies, protected items, and recovery points on the vault

Pick this when the agent needs to actually create backup policies and protect items rather than configure the vault itself.

Alternative

Site Recovery Management Client

Disaster recovery (replication and failover) workload on the same vault rather than backup

Pick this when the workload is replication and failover (ASR) rather than scheduled backup with soft delete.

FAQs

Specific to using RecoveryServicesBackupClient API through Jentic.

Why is there no official OpenAPI spec for RecoveryServicesBackupClient?

Microsoft Azure does not publish an OpenAPI specification. Jentic generates and maintains this spec so that AI agents and developers can call RecoveryServicesBackupClient via structured tooling. It is validated against the live API and kept up to date. Get started at https://app.jentic.com/sign-up.

What authentication does the Recovery Services Backup Config API use?

The API runs through Azure Resource Manager and uses OAuth 2.0 bearer tokens issued by Azure Active Directory under the azure_auth scheme with the user_impersonation scope. Through Jentic, the AAD client secret is held in the encrypted vault and a short-lived access token is supplied at execute time so the secret never appears in the agent's context.

Can I change a vault's storage redundancy after creation?

Yes, but only while the vault has no protected items. PATCH .../backupstorageconfig/vaultstorageconfig accepts storageType values of LocallyRedundant, GeoRedundant, or ZoneRedundant. Once items are protected, the redundancy is locked and the vault must be drained before changing it.

What are the rate limits for the Recovery Services Backup Config API?

Azure Resource Manager applies subscription-level read and write throttles (around 12,000 reads per hour and 1,200 writes per hour per region per subscription) and returns 429 with a Retry-After header when exceeded. These are vault-scoped configuration calls so traffic is typically very low.

How do I enable soft delete through Jentic?

Search Jentic for 'enable soft delete on recovery services vault', load the schema for PATCH .../backupconfig/vaultconfig, then execute with subscriptionId, resourceGroupName, vaultName, and a body that sets enhancedSecurityState and softDeleteFeatureState to Enabled. The pip install jentic Python SDK uses the async search, load, execute pattern.

Is the Recovery Services Backup Config API free?

There is no per-call charge for the management API itself; you pay for the Recovery Services vault, the storage consumed by backup data, and any cross-region replication implied by the redundancy setting. Configuration calls are not separately metered.