Community OpenAPI document · agent-readyStorageBackup RecoveryapiKey72 EndpointsREST
Know of an official OpenAPI document? Contribute it →
For Agents
Schedule, run, and restore backups across AWS resources, manage backup vaults and retention policies, and surface compliance reports so an agent can keep customer data recoverable.
Use for: I need to create a daily backup plan for my RDS databases, Restore an EBS volume from yesterday's backup, List all recovery points in a backup vault, Put a legal hold on a critical recovery point
Not supported: Does not provide application-aware database log shipping, file-level on-prem backup agents, or long-term archival outside AWS. Use for AWS-resource backup, restore, and policy management only.
AWS Backup is a unified, policy-based backup service for AWS resources, including EBS volumes, EC2 instances, RDS and Aurora databases, DynamoDB tables, EFS, FSx, S3, and Storage Gateway. The API lets you define backup plans with schedules and retention rules, group resources via selections and tags, store recovery points in encrypted backup vaults with vault locks for immutability, restore on demand, and run audit frameworks with reports for compliance evidence. It also supports legal holds that block deletion of designated recovery points.
Install Jentic One Beta
Connect the AWS Backup to your agent
Jentic One is a self-hosted execution layer for AI agents. It lets your agent call the AWS Backup, or any other public or private API you need. You set the rules, the agent never sees your credentials, and every call is logged.
Two steps, two machines. Install the instance in a safe environment, then register your agent from wherever it runs.
1
Step 1: Jentic One Host machine
# On the machine that will host your Jentic One instance:
curl -fsSL "https://jentic.com/install.sh?src=apis&api=%2Fapis%2Famazonaws.com%2Fbackup" | sh2
Step 2: Agent machine
# On the machine where your agent runs (keep this separate from the instance):
curl -fsSL "https://jentic.com/install.sh?src=apis&api=%2Fapis%2Famazonaws.com%2Fbackup" | sh
jentic register # connects your agent to your Jentic One instanceJentic One is in public beta. The setup above keeps your agent separate from the instance, which is what you want before using real credentials: an agent running as the same OS user as Jentic One can read its stored keys directly. Just evaluating? A single local install is fine to start. See the secure deployment guide for the tiers.
Capabilities
What an agent can do with AWS Backup API.
Define backup plans with schedule expressions, retention windows, lifecycle to cold storage, and copy actions to other regions
Group resources into backup selections by ARN list or tag rules so the right resources are protected automatically
Create encrypted backup vaults and apply vault locks for write-once-read-many immutability against ransomware
Start an on-demand backup job, check job status, and stop a job mid-flight
Restore from a recovery point to a new resource (EBS volume, RDS instance, EFS file system) with restore parameters
Place legal holds on recovery points to prevent deletion during litigation or investigation
Run AWS Backup Audit Manager frameworks and generate compliance reports against backup posture
Use Cases
Patterns agents use AWS Backup API for, with concrete tasks.
★ Daily RDS Backup with 35-Day Retention
Protect production RDS databases with a daily backup plan and 35-day retention without writing custom Lambda jobs. Create a backup plan with a daily cron schedule and a lifecycle that moves recovery points to cold storage after 30 days, then create a backup selection that targets RDS instances tagged Backup=daily. AWS Backup runs the schedule, encrypts recovery points in the vault, and lets you restore to a new instance on demand. Initial setup takes about an hour.
Create a backup plan named rds-daily with a rule scheduled cron(0 2 * * ? *), DeleteAfterDays=35, and a backup selection IamRoleArn=arn:..., conditions targeting tag Backup=daily.
Ransomware-Resistant Vault Lock
Make backups truly immutable so a compromised IAM identity cannot delete or shorten retention on recovery points. Apply a vault lock to a backup vault with PutBackupVaultLockConfiguration and a minimum and maximum retention period; once the cooldown elapses the lock is permanent. Suitable for regulated industries and for recovery from ransomware attacks that target backups first.
Call PutBackupVaultLockConfiguration on vault prod-vault with MinRetentionDays=30, MaxRetentionDays=3650, and ChangeableForDays=3.
Disaster Recovery Restore
Recover a production resource from a recovery point during an incident, such as a corrupted EBS volume, a deleted DynamoDB table, or an unintentionally truncated EFS share. Use ListRecoveryPointsByBackupVault to find the right point, then StartRestoreJob with the resource-specific metadata to create a new resource. AWS Backup tracks the job status and the operator can attach the restored resource once the job completes.
Find the latest recovery point for resource arn:aws:ec2:...:volume/vol-0abc, then call StartRestoreJob with metadata including AvailabilityZone and encrypted=true to create a new EBS volume.
Agent-Driven Compliance Sweep
Let a compliance agent verify that every tagged production database, file system, and table has a recent successful backup, raising an alert otherwise. The agent calls AWS Backup through Jentic to list protected resources, fetch their last successful backup time, and compare against policy thresholds. AWS credentials never leave your Jentic One instance, and the same agent logic runs unmodified across customer accounts.
Search Jentic for 'list protected resources in AWS Backup', execute it filtered by tag Environment=production, and for each resource fetch the latest recovery point with ListRecoveryPointsByResource, raising an alert if no recovery point is younger than 24 hours.
Key Endpoints
72 endpoints — aws backup is a unified, policy-based backup service for aws resources, including ebs volumes, ec2 instances, rds and aurora databases, dynamodb tables, efs, fsx, s3, and storage gateway.
METHOD
PATH
DESCRIPTION
PUT
/backup/plans/
Create a backup plan
GET
/backup/plans/
List backup plans
PUT
/backup/plans/{backupPlanId}/selections/
Create a backup selection
PUT
/backup-vaults/{backupVaultName}
Create a backup vault
GET
/backup-vaults/{backupVaultName}
Describe a backup vault
POST
/legal-holds/
Create a legal hold
POST
/audit/frameworks
Create an audit framework
GET
/audit/frameworks
List audit frameworks
PUT
/backup/plans/
Create a backup plan
GET
/backup/plans/
List backup plans
PUT
/backup/plans/{backupPlanId}/selections/
Create a backup selection
PUT
/backup-vaults/{backupVaultName}
Create a backup vault
GET
/backup-vaults/{backupVaultName}
Describe a backup vault
POST
/legal-holds/
Create a legal hold
POST
/audit/frameworks
Create an audit framework
GET
/audit/frameworks
List audit frameworks
Jentic AI Readiness Score
This API is usable in Jentic One now. Its AI-readiness score against Jentic's framework shows where it stands today and where improvements would make it even easier for agents to use.
A
AWS Backup
- Foundational (C+)59/100
71
Foundational Compliance63
Developer Experience & Jentic Compatibility39
AI-Readiness & Agent Experience91
Agent Usability50
Security100
AI DiscoverabilityPowered by JenticScoring Framework 1.0.0 | Scoring Engine 0.4.0
Show dimension breakdown
71
Foundational Compliance
Base layer of spec validity and structural soundness.
Grade: A-Signals: 4
86%
Lint Results
Aggregated quality score from linter diagnostics, weighted by severity.
100%
Resolution Completeness
Percentage of `$ref` references that resolve successfully.
0%
Specification Validity
Checks whether the API description parses successfully and conforms to its declared specification (e.g., OpenAPI).
100%
Structural Integrity
Structural correctness score based on schema issues using logarithmic dampening.
63
Developer Experience & Jentic Compatibility
Clarity, completeness, and ingestion readiness for developers and tooling.
Grade: B-Signals: 4
0%
Example Density
How richly the API is illustrated with examples.
100%
Example Validity
Percentage of examples that conform to their schemas.
50%
Response Coverage
Percentage of operations with complete response definitions (success, client error, server error).
100%
Tooling Readiness
Health of API ingestion, bundling, and resolution within Jentic pipelines.
39
AI-Readiness & Agent Experience
Semantic breadth, depth, and agent comprehension for AI systems.
Grade: FSignals: 4
55%
Description Coverage
Coverage of descriptions across API elements.
0%
Error Standardization
Coverage of RFC 9457 Problem Details for error responses.
100%
OperationId Quality
Coverage, uniqueness, and casing consistency of operationIds for AI inference.
0%
Summary Coverage
Coverage of summaries across operations/tags/info.
91
Agent Usability
Functional utility, complexity comfort, and AI orchestration readiness.
Grade: A+Signals: 1
91%
Complexity Comfort
Agent comfort level based on API operational and structural complexity.
50
Security
Trust, risk posture, and security compliance.
Grade: C-Signals: 1
50%
Authentication Strength
Average quality of security schemes based on authentication method strength (weakest link for OAuth2).
100
AI Discoverability
Findability, semantic richness, and reasoning readiness.
Grade: A+Signals: 1
100%
Descriptive Richness
Clarity and depth of descriptions across API elements.
Score it yourself
Every API in the directory is allowlisted, so you can re-score it with no key required.
npx @jentic/api-scorecard-cli score <openapi-url>Why Jentic?
What agents get from Jentic-routed access to this vendor.
Setup
Wiring AWS Backup by hand means holding an access key ID and secret access key, computing an AWS Signature Version 4 signature on every request, resolving the correct regional backup host, and handling throttling and retries yourself. Through Jentic you install once, import AWS Backup from the API Directory, store the AWS access key once, and your agent calls it.
Permission scoping
Backup puts the plan and vault identifiers in the URL path (/backup/plans/{backupPlanId}/... and /backup-vaults/{backupVaultName}), so a rule can pin your agent to a specific plan or vault. You choose the operations it may call, so destructive ones like deleting a backup plan or vault are not included unless you add them.
Credential isolation
Your AWS access key ID and secret access key are stored once, encrypted, by your own Jentic One instance, and the Signature Version 4 signature is computed at execution time. The raw keys never enter the agent's prompt, logs, or context.
Intent-based discovery
Agents search Jentic by intent such as 'create a backup plan' or 'start a restore job', and Jentic returns the matching AWS Backup operation with its input schema so the agent calls the right endpoint without crawling the AWS reference.
Related APIs
Alternatives and complements available in the Jentic catalogue.
FAQs
Specific to using AWS Backup API through Jentic.
What authentication does the AWS Backup API use?
All requests are signed with AWS Signature Version 4 using an AWS access key ID and secret access key. Through Jentic, the keys live encrypted in the vault and Jentic computes the signature server-side; the agent only holds a scoped Jentic credential.
Which AWS services can AWS Backup protect?
AWS Backup supports EBS volumes, EC2 instances, RDS and Aurora databases, DynamoDB tables, EFS file systems, FSx file systems, Amazon S3 buckets, AWS Storage Gateway, Amazon Neptune, Amazon DocumentDB, Amazon Redshift, and Amazon Timestream, among others, all from a single backup plan.
Can I make backups immutable to defend against ransomware?
Yes. Apply a vault lock to a backup vault with PutBackupVaultLockConfiguration and a minimum retention. Once the cooldown elapses (governance lock) or immediately (compliance lock), even root cannot delete or shorten retention until the recovery point reaches its expiry.
How do I restore a resource from a backup through Jentic?
Search Jentic for 'restore from an AWS Backup recovery point', load the StartRestoreJob schema, and execute it with the recovery point ARN, the IAM role, and the service-specific metadata. The operation maps to POST /restore-jobs and Jentic returns the job ID so the agent can poll DescribeRestoreJob until completion.
What are the rate limits for the AWS Backup API?
AWS Backup applies standard AWS throttling and returns ThrottlingException when exceeded. Heavy job listings should be paginated with NextToken; high-volume restore creation should be batched and retried with exponential backoff.
How is AWS Backup priced?
You pay for storage of recovery points (with separate warm and cold pricing), restore charges per service, and any cross-region copy data transfer. The backup plan, vault, and policy infrastructure itself has no separate charge.
Can I limit what my agent is allowed to do with the AWS Backup API?
Yes. Because Jentic One is self-hosted, you set the rules that decide which AWS Backup operations and credentials your agent may use. AWS Backup puts the plan and vault identifiers in the URL path, such as /backup/plans/{backupPlanId} and /backup-vaults/{backupVaultName}, so you can pin the agent to a specific backup plan or vault. You also choose the exact operations it may call, so destructive ones like deleting a backup plan or a vault stay out of reach unless you explicitly add them.
GET STARTED