API Changelog

New: Webhooks

Three new webhooks describe the requests Eon sends to your webhook endpoint:

• Audit Log Event: Reports an audit log event. Eon sends it for the audit log events you’ve subscribed a webhook to.

• Event Notification: Reports an event notification. Eon sends it when an event you’re subscribed to occurs.

• Test Notification: Reports a test notification. Eon sends it once, when you configure a notification policy with a webhook, to confirm that Eon can deliver to your endpoint.

For how Eon delivers notifications and which response it expects, see Webhooks.

New: Action approval rules

Five new methods manage the action approval rules that protect your methods:

• Create Action Approval Rule: Creates a rule.

• List Action Approval Rules: Retrieves a list of rules for a project.

• Get Action Approval Rule: Retrieves a rule.

• Update Action Approval Rule: Updates a rule. Only properties included in the request are changed.

• Delete Action Approval Rule: Deletes a rule.

New: Threat finding exclusions

Finding exclusions keep matching files, tables, or databases out of threat detection. You can scope an exclusion to a single resource or to every resource in the Eon account. Five new methods manage them:

• Create Finding Exclusion: Creates an exclusion for a path, table, database, or KMS key (PATH, TABLE, DATABASE, or KMS_KEY) and a detector type (RANSOMWARE_BEHAVIOR, DATA_ANOMALY, or MALWARE). For MALWARE, you can exclude only paths.

• List Finding Exclusions: Retrieves a list of exclusions in the Eon account.

• Get Finding Exclusion: Retrieves an exclusion.

• Update Finding Exclusion: Replaces an exclusion. Omitted properties are overwritten.

• Delete Finding Exclusion: Deletes an exclusion.

Creating, updating, or deleting an exclusion has no effect on in-progress scans.

New: Restore templates

Two new methods let you manage restore templates:

• Create Restore Template: Creates a restore template for an EC2 instance (EC2_INSTANCE) or S3 bucket (S3_BUCKET), with the settings in ec2Params or s3Params.

• Bulk Attach Restore Template: Attaches a restore template to multiple resources, by Eon-assigned resource ID. Existing restore template assignments on the resources are overwritten.

For more information, see About Restore Templates.

New: Object-store scan methods

Two new methods let you read and change how Eon scans an Amazon S3 or Google Cloud Storage bucket:

• Get Object-Store Scan Method: Retrieves the scan mode and change detection mode for a bucket.

• Update Object-Store Scan Method: Updates the scan mode (inventoryBackup) and change detection mode (cdcBackup) for a bucket.

New: AWS restore account assets

Six new methods list what Eon can see in an AWS restore account, so you can choose valid values when you configure connectivity and restores:

• List S3 Buckets: Retrieves a list of S3 buckets available to Eon in the restore account.

• List Encryption Keys: Retrieves a list of encryption keys available to Eon in a region of the restore account.

• List Security Groups: Retrieves a list of security groups available to Eon in a region of the restore account.

• List Subnets: Retrieves a list of subnets available to Eon in a region of the restore account.

• List VPCs: Retrieves a list of VPCs available to Eon in a region of the restore account.

• List Instance Types: Retrieves a list of EC2 instance types available for restore in a subnet and region.

Updated: Resource configuration and compliance status

List Resources and Get Resource now return two properties:

• configurationStatus: Whether backup is configured for the resource, and if not, the reason.

• complianceStatus: Whether the resource meets the backup posture controls applied to it. Values are COMPLIANT, VIOLATIONS, and ALL_MUTED.

List Resources also accepts a new filters.configurationStatus request property. These properties replace the deprecated backupStatus.

Updated: Resource name filters

The filters.resourceName request property in List Resources adds four conditions:

• startsWith and notStartsWith match on a prefix of the resource name.

• endsWith and notEndsWith match on a suffix of the resource name.

Updated: Snapshot hold details

Get Snapshot and List Snapshots now return three optional properties that explain a snapshot that’s past its retention but not deleted:

• holdReason: Why the snapshot is held. Values are USER_HOLD, SECURITY_SCAN_BASELINE, REPLAY_ANCHOR, LAST_SNAPSHOT_GRACE, LINEAGE_ANCHOR_GRACE, and RECENT_RESTORE.

• holdReasonMessage: An explanation of holdReason, including how to end the hold, if possible.

• effectiveExpirationTime: The date and time Eon expects to delete the snapshot, accounting for any hold that defers it. It’s absent when a hold has no end date of its own.

Updated: Vault labels and filters

Create Vault and Update Vault accept an optional labels property, which is returned in Get Vault and List Vaults. Labels help you filter and search for vaults. They don’t affect backup behavior, access control, or the tags Eon sets on your cloud resources.

The vault object in List Backup Jobs, Get Backup Job, List Restore Jobs, and Get Restore Job also returns labels.

List Vaults now accepts an optional request body with a filters property. You can filter on name, cloudProvider, region, status, and vaultType.

Updated: Backup policy labels and source storage size

Create Backup Policy and Update Backup Policy accept two new optional properties, returned in Get Backup Policy and List Backup Policies:

• labels help you filter and search for backup policies. They don’t affect backup behavior, access control, or the tags Eon sets on your cloud resources.

• resourceSelector.expression.sourceStorageSize matches resources by the size of their source data, in bytes, using an operator and sizeBytes. Eon re-evaluates the condition as a resource grows and shrinks, and attaches the resource to or detaches it from the policy accordingly.

Updated: Encryption type in backup posture controls

Backup posture control resource selectors accept a new optional resourceSelector.expression.encryptionType condition, with an operator and a list of encryptionTypes. Valid values are UNENCRYPTED, PROVIDER_MANAGED_KEY, and CUSTOMER_MANAGED_KEY. It’s available in Create Backup Posture Control and Update Backup Posture Control, and returned in Get Backup Posture Control and List Backup Posture Controls.

Updated: Restore limits in roles

Create Role and Update Role accept two new optional properties, returned in Get Role and List Roles:

• restoreDestinationTagLimits limits the restore accounts a role can use as restore destinations, based on the tags the cloud provider holds against the account. Set subject to TAG_KEYS or TAG_KEY_VALUES, operator to CONTAINS_ANY_OF, CONTAINS_ALL_OF, or CONTAINS_NONE_OF, and the tags to match in values. A destination must satisfy this limit and restoreDestinationLimits.

• sameSourceAccountRestoreLimits restricts restoring applicable resources to the source account they were backed up from. Set enabled to turn it on, and optionally scope it with dataAccessRuleId.

Updated: Discovery regions for source accounts

You can now limit the regions Eon discovers resources in. Set sourceAccountAttributes.aws.regions, sourceAccountAttributes.azure.regions, or sourceAccountAttributes.gcp.regions in Connect Source Account and Update Source Account, and regions in Connect Source AWS Organizational Unit. The properties are returned in the source account and source AWS organizational unit responses.

If you omit the property, or leave it empty when connecting, Eon discovers in all supported regions. In Update Source Account, omit it to leave the current regions unchanged, and pass an empty list to discover in all supported regions.

Updated: AWS account alias

Source and restore account responses now return an optional providerAccountAlias property with the account alias inherited from the cloud provider. It applies to AWS only, and can coexist with providerAccountName.

Updated: AWS restore account connectivity

Update Restore Account Connectivity Configuration and Get Restore Account Connectivity Configuration add two optional properties to each item in aws.vpcConfigs:

• privateSubnetEnabled: Whether to allow cross-region restores into subnets that have no internet access.

• restoreServerKmsKeyArn: The ARN of the KMS key for the temporary restore server that Eon launches in the VPC.

Updated: Azure restore encryption and network interface

Azure restore methods add two ways to control encryption and networking:

• diskEncryptionSetId, the ARM resource ID of a disk encryption set whose customer-managed key encrypts the restored disk. It’s available in Restore Azure Disk as destination.azureDisk.diskEncryptionSetId, and in Restore Azure VM Instance as destination.azureVm.disks[].diskEncryptionSetId.

• destination.azureVm.networkInterfaceConfig in Restore Azure VM Instance lets you attach an existing network interface or create one.

Updated: Optional volume encryption key for EC2 restore

In Restore EC2 Instance, destination.awsEc2.volumeRestoreParameters[].volumeEncryptionKeyId is now optional.

Updated: New enum values

Four existing request and response properties accept new values:

• backupStatus in List Resources and Get Resource, and filters.backupStatus in List Resources, add ACCESS_LOST and CLASSIFICATION_FAILED.

• sorts[].field in List Resources adds configurationStatus.

• The permission type in List Permissions, Create Role, Update Role, Get Role, and List Roles adds sensitivity_level.override.

• usageUnit in Query Cost Data adds OBJECTS, which is also returned in records[].costs[].usage.unit.

Clients that map these values to a fixed set need updating to handle the new ones.

Deprecations

Two properties are deprecated:

• The backupStatus response property in List Resources and Get Resource, and the filters.backupStatus request property in List Resources. Use configurationStatus and complianceStatus in responses, and filters.configurationStatus in requests, instead. Support for the deprecated properties ends on April 30, 2027.

• The destination.azureVm.networkInterface request property in Restore Azure VM Instance. Use destination.azureVm.networkInterfaceConfig instead.