canonical: https://jentic.com/apis/azure.com/recoveryservicesbackupclient

# Microsoft Azure RecoveryServicesBackupClient

Jentic publishes the only available OpenAPI specification for RecoveryServicesBackupClient, keeping it validated and agent-ready. The API manages the configuration of an Azure Recovery Services vault used for backup workloads - specifically the soft-delete and security-feature vault config and the storage redundancy choice (LRS, GRS, ZRS) used to hold backup data. It is the configuration surface that platform teams use to harden a backup vault before any backup items are protected.

## For AI agents

Read and update the configuration of an Azure Recovery Services backup vault, including soft-delete settings and the storage redundancy used for backup data.

## Scope

Does not create backup policies, protect items, or trigger restores - use for the soft-delete and storage redundancy configuration of a Recovery Services vault only.

## Capabilities

- Get the security and soft-delete configuration of a Recovery Services vault
- Update the soft-delete state and security feature settings of a vault
- Get the backup storage redundancy configured on a vault
- Update the backup storage redundancy of a vault between LRS, GRS, and ZRS
- Inspect whether soft delete is enabled before storing protected items

## Use cases

### Harden a backup vault before use

Before any workloads are protected, platform teams confirm that the Recovery Services vault has soft delete enabled and is using the right redundancy tier for the workload's recovery objectives. The API exposes both vaultconfig and vaultstorageconfig as first-class resources so this hardening can be enforced from automation rather than the portal.

Example prompt: On vault 'rsv-prod', confirm soft delete is enabled and that the storage redundancy is GeoRedundant; if not, update both

### Change storage redundancy

When a vault is first created in a non-prod context with LRS storage and is later promoted to production, its backup storage redundancy needs to move to GRS or ZRS. The API supports a PATCH on /backupstorageconfig/vaultstorageconfig to change the redundancy in place without redeploying the vault.

Example prompt: Change the storage redundancy on Recovery Services vault 'rsv-prod' from LocallyRedundant to GeoRedundant

### Cleanup soft-deleted items

Operators occasionally need to permanently delete items that are still in the soft-delete window. The API supports temporarily disabling the soft-delete feature on the vault, after which the items can be purged, before re-enabling soft delete to restore the safety net.

Example prompt: Temporarily disable soft delete on vault 'rsv-prod', wait for the cleanup job, then re-enable soft delete

### Agent-driven backup compliance

An AI agent enforcing backup policy iterates through every Recovery Services vault in a subscription, reads the soft-delete and storage redundancy configs, and remediates any drift from the policy baseline. Jentic isolates the AAD client secret so the agent only sees scoped bearer tokens.

Example prompt: Audit every Recovery Services vault in subscription X, set soft delete to enabled and redundancy to GRS where it has drifted

## Key endpoints

| Method | Path | Description |
| --- | --- | --- |
| GET | /Subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.RecoveryServices/vaults/{vaultName}/backupconfig/vaultconfig | Get the security and soft-delete config of a vault |
| PATCH | /Subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.RecoveryServices/vaults/{vaultName}/backupconfig/vaultconfig | Update the security and soft-delete config of a vault |
| GET | /Subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.RecoveryServices/vaults/{vaultName}/backupstorageconfig/vaultstorageconfig | Get the backup storage redundancy config |
| PATCH | /Subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.RecoveryServices/vaults/{vaultName}/backupstorageconfig/vaultstorageconfig | Update the backup storage redundancy |

## Key resources

- **Vault Backup Config** — Soft-delete and security feature configuration on a Recovery Services vault
- **Vault Storage Config** — Backup storage redundancy choice (LRS, GRS, ZRS) for a Recovery Services vault

## Why Jentic

- **Setup:** Wiring the RecoveryServicesBackupClient by hand means registering an Azure AD app for OAuth 2.0, acquiring bearer tokens against management.azure.com, and constructing the vaultconfig and vaultstorageconfig PATCH bodies yourself. Through Jentic you install once, import the RecoveryServicesBackupClient from the API Directory, store the Azure AD credential once, and your agent calls it.
- **Permission scoping:** The subscription, resource group, and vault name travel in the URL path (/Subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.RecoveryServices/vaults/{vaultName}/...), so a rule can pin your agent to one vault and the operations it needs, such as reading the soft-delete and storage configs. You choose the operations it may call, so state-changing ones like updating the vault config or changing storage redundancy are not included unless you add them.
- **Credential handling:** Your Azure AD OAuth 2.0 credential is stored once, encrypted, by your own Jentic One instance and a scoped bearer token is injected at execution time. The client secret never enters the agent's prompt, logs, or context.
- **Discovery method:** Agents search Jentic by intent such as 'enable soft delete on a recovery services vault' or 'change backup storage redundancy to GRS', and Jentic returns the matching operation with its input schema so the agent supplies the vault path and config body without browsing the reference docs.

## Related APIs

- **RecoveryServicesClient** — Manages vault certificates and registered identities on the same Recovery Services vault
- **Backup Management Client** — Manages backup policies, protected items, and recovery points on the vault
- **Site Recovery Management Client** — Disaster recovery (replication and failover) workload on the same vault rather than backup

## FAQ

### Why is there no official OpenAPI spec for RecoveryServicesBackupClient?

Microsoft Azure does not publish an OpenAPI specification. Jentic generates and maintains this spec so that AI agents and developers can call RecoveryServicesBackupClient via structured tooling. It is validated against the live API and kept up to date. Get started with Jentic One, the self-hosted execution layer.

### What authentication does the Recovery Services Backup Config API use?

The API runs through Azure Resource Manager and uses OAuth 2.0 bearer tokens issued by Azure Active Directory under the azure_auth scheme with the user_impersonation scope. Through Jentic, the AAD client secret is held in the encrypted vault and a short-lived access token is supplied at execute time so the secret never appears in the agent's context.

### Can I change a vault's storage redundancy after creation?

Yes, but only while the vault has no protected items. PATCH .../backupstorageconfig/vaultstorageconfig accepts storageType values of LocallyRedundant, GeoRedundant, or ZoneRedundant. Once items are protected, the redundancy is locked and the vault must be drained before changing it.

### What are the rate limits for the Recovery Services Backup Config API?

Azure Resource Manager applies subscription-level read and write throttles (around 12,000 reads per hour and 1,200 writes per hour per region per subscription) and returns 429 with a Retry-After header when exceeded. These are vault-scoped configuration calls so traffic is typically very low.

### How do I enable soft delete through Jentic?

Search Jentic for 'enable soft delete on recovery services vault', load the schema for PATCH .../backupconfig/vaultconfig, then execute with subscriptionId, resourceGroupName, vaultName, and a body that sets enhancedSecurityState and softDeleteFeatureState to Enabled. The pip install jentic Python SDK uses the async search, load, execute pattern.

### Is the Recovery Services Backup Config API free?

There is no per-call charge for the management API itself; you pay for the Recovery Services vault, the storage consumed by backup data, and any cross-region replication implied by the redundancy setting. Configuration calls are not separately metered.

### Can I limit what my agent is allowed to do with the Recovery Services Backup Client API?

Yes. Because you run Jentic One yourself, your own rules decide which operations and credentials the agent may use, and the subscription, resource group, and vault name all travel in the URL path, so you can pin the agent to a single Recovery Services vault. You can allow only read operations, such as getting the soft-delete and storage redundancy configs, while withholding the state-changing PATCH calls that update the vault config or change storage redundancy between LRS, GRS, and ZRS. The Azure AD credential is stored once by your own instance and a scoped bearer token is injected at execution time, so the agent only ever calls the operations you have granted.