Microsoft Azure RecoveryServicesBackupClient

What authentication does the Recovery Services Backup Config API use?

The API runs through Azure Resource Manager and uses OAuth 2.0 bearer tokens issued by Azure Active Directory under the azure_auth scheme with the user_impersonation scope. Through Jentic, the AAD client secret is held in the encrypted vault and a short-lived access token is supplied at execute time so the secret never appears in the agent's context.

Can I change a vault's storage redundancy after creation?

Yes, but only while the vault has no protected items. PATCH .../backupstorageconfig/vaultstorageconfig accepts storageType values of LocallyRedundant, GeoRedundant, or ZoneRedundant. Once items are protected, the redundancy is locked and the vault must be drained before changing it.

What are the rate limits for the Recovery Services Backup Config API?

Azure Resource Manager applies subscription-level read and write throttles (around 12,000 reads per hour and 1,200 writes per hour per region per subscription) and returns 429 with a Retry-After header when exceeded. These are vault-scoped configuration calls so traffic is typically very low.

How do I enable soft delete through Jentic?

Search Jentic for 'enable soft delete on recovery services vault', load the schema for PATCH .../backupconfig/vaultconfig, then execute with subscriptionId, resourceGroupName, vaultName, and a body that sets enhancedSecurityState and softDeleteFeatureState to Enabled. The pip install jentic Python SDK uses the async search, load, execute pattern.

Is the Recovery Services Backup Config API free?

There is no per-call charge for the management API itself; you pay for the Recovery Services vault, the storage consumed by backup data, and any cross-region replication implied by the redundancy setting. Configuration calls are not separately metered.

Can I limit what my agent is allowed to do with the Recovery Services Backup Client API?

Yes. Because you run Jentic One yourself, your own rules decide which operations and credentials the agent may use, and the subscription, resource group, and vault name all travel in the URL path, so you can pin the agent to a single Recovery Services vault. You can allow only read operations, such as getting the soft-delete and storage redundancy configs, while withholding the state-changing PATCH calls that update the vault config or change storage redundancy between LRS, GRS, and ZRS. The Azure AD credential is stored once by your own instance and a scoped bearer token is injected at execution time, so the agent only ever calls the operations you have granted.