> This page is for What's New.

> For clean Markdown of any page, append .md to the page URL.
> For a complete documentation index, see https://docs.eon.io/llms.txt.
> For AI client integration (Claude Code, Cursor, etc.), connect to the MCP server at https://docs.eon.io/_mcp/server.

# October 29, 2026

## New: Webhooks

webhooks

Three new webhooks describe the requests Eon sends to your webhook endpoint:

* [Audit Log Event]: Reports an audit log event. Eon sends it for the audit log events you've subscribed a webhook to.

* [Event Notification]: Reports an event notification. Eon sends it when an event you're subscribed to occurs.

* [Test Notification]: Reports a test notification. Eon sends it once, when you configure a notification policy with a webhook, to confirm that Eon can deliver to your endpoint.

For how Eon delivers notifications and which response it expects, see [Webhooks].

## New: Action approval rules

access-management

Five new methods manage the action approval rules that protect your methods:

* [Create Action Approval Rule]: Creates a rule.

* [List Action Approval Rules]: Retrieves a list of rules for a project.

* [Get Action Approval Rule]: Retrieves a rule.

* [Update Action Approval Rule]: Updates a rule. Only properties included in the request are changed.

* [Delete Action Approval Rule]: Deletes a rule.

## New: Threat finding exclusions

threat-detection

Finding exclusions keep matching files, tables, or databases out of threat detection.
You can scope an exclusion to a single resource or to every resource in the Eon account.
Five new methods manage them:

* [Create Finding Exclusion]: Creates an exclusion for a path, table, database, or KMS key (`PATH`, `TABLE`, `DATABASE`, or `KMS_KEY`) and a detector type (`RANSOMWARE_BEHAVIOR`, `DATA_ANOMALY`, or `MALWARE`).
  For `MALWARE`, you can exclude only paths.

* [List Finding Exclusions]: Retrieves a list of exclusions in the Eon account.

* [Get Finding Exclusion]: Retrieves an exclusion.

* [Update Finding Exclusion]: Replaces an exclusion. Omitted properties are overwritten.

* [Delete Finding Exclusion]: Deletes an exclusion.

Creating, updating, or deleting an exclusion has no effect on in-progress scans.

## New: Restore templates

restore

Two new methods let you manage restore templates:

* [Create Restore Template]: Creates a restore template for an EC2 instance (`EC2_INSTANCE`) or S3 bucket (`S3_BUCKET`), with the settings in `ec2Params` or `s3Params`.

* [Bulk Attach Restore Template]: Attaches a restore template to multiple resources, by Eon-assigned resource ID. Existing restore template assignments on the resources are overwritten.

For more information, see [About Restore Templates].

## New: Object-store scan methods

resources

Two new methods let you read and change how Eon scans an Amazon S3 or Google Cloud Storage bucket:

* [Get Object-Store Scan Method]: Retrieves the scan mode and change detection mode for a bucket.

* [Update Object-Store Scan Method]: Updates the scan mode (`inventoryBackup`) and change detection mode (`cdcBackup`) for a bucket.

## New: AWS restore account assets

aws, restore, accounts

Six new methods list what Eon can see in an AWS restore account, so you can choose valid values when you configure connectivity and restores:

* [List S3 Buckets]: Retrieves a list of S3 buckets available to Eon in the restore account.

* [List Encryption Keys]: Retrieves a list of encryption keys available to Eon in a region of the restore account.

* [List Security Groups]: Retrieves a list of security groups available to Eon in a region of the restore account.

* [List Subnets]: Retrieves a list of subnets available to Eon in a region of the restore account.

* [List VPCs]: Retrieves a list of VPCs available to Eon in a region of the restore account.

* [List Instance Types]: Retrieves a list of EC2 instance types available for restore in a subnet and region.

## Updated: Resource configuration and compliance status

resources

[List Resources] and [Get Resource] now return two properties:

* `configurationStatus`: Whether backup is configured for the resource, and if not, the reason.

* `complianceStatus`: Whether the resource meets the backup posture controls applied to it. Values are `COMPLIANT`, `VIOLATIONS`, and `ALL_MUTED`.

[List Resources] also accepts a new `filters.configurationStatus` request property.
These properties replace the deprecated `backupStatus`.

## Updated: Resource name filters

resources

The `filters.resourceName` request property in [List Resources] adds four conditions:

* `startsWith` and `notStartsWith` match on a prefix of the resource name.

* `endsWith` and `notEndsWith` match on a suffix of the resource name.

## Updated: Snapshot hold details

snapshots, backups

[Get Snapshot] and [List Snapshots] now return three optional properties that explain a snapshot that's past its retention but not deleted:

* `holdReason`: Why the snapshot is held. Values are `USER_HOLD`, `SECURITY_SCAN_BASELINE`, `REPLAY_ANCHOR`, `LAST_SNAPSHOT_GRACE`, `LINEAGE_ANCHOR_GRACE`, and `RECENT_RESTORE`.

* `holdReasonMessage`: An explanation of `holdReason`, including how to end the hold, if possible.

* `effectiveExpirationTime`: The date and time Eon expects to delete the snapshot, accounting for any hold that defers it. It's absent when a hold has no end date of its own.

## Updated: Vault labels and filters

vaults, jobs

[Create Vault] and [Update Vault] accept an optional `labels` property, which is returned in [Get Vault] and [List Vaults].
Labels help you filter and search for vaults.
They don't affect backup behavior, access control, or the tags Eon sets on your cloud resources.

The vault object in [List Backup Jobs], [Get Backup Job], [List Restore Jobs], and [Get Restore Job] also returns `labels`.

[List Vaults] now accepts an optional request body with a `filters` property.
You can filter on `name`, `cloudProvider`, `region`, `status`, and `vaultType`.

## Updated: Backup policy labels and source storage size

backups

[Create Backup Policy] and [Update Backup Policy] accept two new optional properties, returned in [Get Backup Policy] and [List Backup Policies]:

* `labels` help you filter and search for backup policies. They don't affect backup behavior, access control, or the tags Eon sets on your cloud resources.

* `resourceSelector.expression.sourceStorageSize` matches resources by the size of their source data, in bytes, using an `operator` and `sizeBytes`.
  Eon re-evaluates the condition as a resource grows and shrinks, and attaches the resource to or detaches it from the policy accordingly.

## Updated: Encryption type in backup posture controls

backups

Backup posture control resource selectors accept a new optional `resourceSelector.expression.encryptionType` condition, with an `operator` and a list of `encryptionTypes`.
Valid values are `UNENCRYPTED`, `PROVIDER_MANAGED_KEY`, and `CUSTOMER_MANAGED_KEY`.
It's available in [Create Backup Posture Control] and [Update Backup Posture Control], and returned in [Get Backup Posture Control] and [List Backup Posture Controls].

## Updated: Restore limits in roles

roles, restore

[Create Role] and [Update Role] accept two new optional properties, returned in [Get Role] and [List Roles]:

* `restoreDestinationTagLimits` limits the restore accounts a role can use as restore destinations, based on the tags the cloud provider holds against the account.
  Set `subject` to `TAG_KEYS` or `TAG_KEY_VALUES`, `operator` to `CONTAINS_ANY_OF`, `CONTAINS_ALL_OF`, or `CONTAINS_NONE_OF`, and the tags to match in `values`.
  A destination must satisfy this limit and `restoreDestinationLimits`.

* `sameSourceAccountRestoreLimits` restricts restoring applicable resources to the source account they were backed up from.
  Set `enabled` to turn it on, and optionally scope it with `dataAccessRuleId`.

## Updated: Discovery regions for source accounts

accounts

You can now limit the regions Eon discovers resources in.
Set `sourceAccountAttributes.aws.regions`, `sourceAccountAttributes.azure.regions`, or `sourceAccountAttributes.gcp.regions` in [Connect Source Account] and [Update Source Account], and `regions` in [Connect Source AWS Organizational Unit].
The properties are returned in the source account and source AWS organizational unit responses.

If you omit the property, or leave it empty when connecting, Eon discovers in all supported regions.
In [Update Source Account], omit it to leave the current regions unchanged, and pass an empty list to discover in all supported regions.

## Updated: AWS account alias

accounts, aws

Source and restore account responses now return an optional `providerAccountAlias` property with the account alias inherited from the cloud provider.
It applies to AWS only, and can coexist with `providerAccountName`.

## Updated: AWS restore account connectivity

aws, restore, accounts

[Update Restore Account Connectivity Configuration] and [Get Restore Account Connectivity Configuration] add two optional properties to each item in `aws.vpcConfigs`:

* `privateSubnetEnabled`: Whether to allow cross-region restores into subnets that have no internet access.

* `restoreServerKmsKeyArn`: The ARN of the KMS key for the temporary restore server that Eon launches in the VPC.

## Updated: Azure restore encryption and network interface

azure, restore

Azure restore methods add two ways to control encryption and networking:

* `diskEncryptionSetId`, the ARM resource ID of a disk encryption set whose customer-managed key encrypts the restored disk.
  It's available in [Restore Azure Disk] as `destination.azureDisk.diskEncryptionSetId`, and in [Restore Azure VM Instance] as `destination.azureVm.disks[].diskEncryptionSetId`.

* `destination.azureVm.networkInterfaceConfig` in [Restore Azure VM Instance] lets you attach an existing network interface or create one.

## Updated: Optional volume encryption key for EC2 restore

aws, restore

In [Restore EC2 Instance], `destination.awsEc2.volumeRestoreParameters[].volumeEncryptionKeyId` is now optional.

## Updated: New enum values

enum-values, resources, roles, billing

Four existing request and response properties accept new values:

* `backupStatus` in [List Resources] and [Get Resource], and `filters.backupStatus` in [List Resources], add `ACCESS_LOST` and `CLASSIFICATION_FAILED`.

* `sorts[].field` in [List Resources] adds `configurationStatus`.

* The permission type in [List Permissions], [Create Role], [Update Role], [Get Role], and [List Roles] adds `sensitivity_level.override`.

* `usageUnit` in [Query Cost Data] adds `OBJECTS`, which is also returned in `records[].costs[].usage.unit`.

Clients that map these values to a fixed set need updating to handle the new ones.

## Deprecations

deprecation, resources, azure

Two properties are deprecated:

* The `backupStatus` response property in [List Resources] and [Get Resource], and the `filters.backupStatus` request property in [List Resources].
  Use `configurationStatus` and `complianceStatus` in responses, and `filters.configurationStatus` in requests, instead.
  Support for the deprecated properties ends on April 30, 2027.

* The `destination.azureVm.networkInterface` request property in [Restore Azure VM Instance].
  Use `destination.azureVm.networkInterfaceConfig` instead.

[Audit Log Event]: /api/api-reference/webhooks/webhook-v-1-audit-log

[Event Notification]: /api/api-reference/webhooks/webhook-v-1-notification-event

[Test Notification]: /api/api-reference/webhooks/webhook-v-1-notification-test

[Create Action Approval Rule]: /api/api-reference/access-management/action-approvals/action-approval-rules/create-action-approval-rule

[List Action Approval Rules]: /api/api-reference/access-management/action-approvals/action-approval-rules/list-action-approval-rules

[Get Action Approval Rule]: /api/api-reference/access-management/action-approvals/action-approval-rules/get-action-approval-rule

[Update Action Approval Rule]: /api/api-reference/access-management/action-approvals/action-approval-rules/update-action-approval-rule

[Delete Action Approval Rule]: /api/api-reference/access-management/action-approvals/action-approval-rules/delete-action-approval-rule

[Create Finding Exclusion]: /api/api-reference/threat-detection/finding-exclusions/create-finding-exclusion

[List Finding Exclusions]: /api/api-reference/threat-detection/finding-exclusions/list-finding-exclusions

[Get Finding Exclusion]: /api/api-reference/threat-detection/finding-exclusions/get-finding-exclusion

[Update Finding Exclusion]: /api/api-reference/threat-detection/finding-exclusions/update-finding-exclusion

[Delete Finding Exclusion]: /api/api-reference/threat-detection/finding-exclusions/delete-finding-exclusion

[Create Restore Template]: /api/api-reference/restore-connections/restore-templates/create-restore-template

[Bulk Attach Restore Template]: /api/api-reference/restore-connections/restore-templates/bulk-attach-restore-template

[About Restore Templates]: /data-protection/restoring/restore-templates/about-restore-templates

[Get Object-Store Scan Method]: /api/api-reference/resources/object-store-scan-methods/get-object-store-scan-method

[Update Object-Store Scan Method]: /api/api-reference/resources/object-store-scan-methods/update-object-store-scan-method

[List S3 Buckets]: /api/api-reference/restore-connections/restore-accounts/aws-restore-account-assets/list-s-3-buckets

[List Encryption Keys]: /api/api-reference/restore-connections/restore-accounts/aws-restore-account-assets/list-encryption-keys

[List Security Groups]: /api/api-reference/restore-connections/restore-accounts/aws-restore-account-assets/list-aws-security-groups

[List Subnets]: /api/api-reference/restore-connections/restore-accounts/aws-restore-account-assets/list-aws-subnets-v-2

[List VPCs]: /api/api-reference/restore-connections/restore-accounts/aws-restore-account-assets/list-aws-vpcs

[List Instance Types]: /api/api-reference/restore-connections/restore-accounts/aws-restore-account-assets/list-aws-instance-types

[Webhooks]: /api/using-the-api/webhooks

[List Resources]: /api/api-reference/resources/list-resources

[Get Resource]: /api/api-reference/resources/get-resource

[Get Snapshot]: /api/api-reference/backup-management/snapshots/get-snapshot

[List Snapshots]: /api/api-reference/backup-management/snapshots/list-resource-snapshots

[Create Vault]: /api/api-reference/vaults/create-vault

[Update Vault]: /api/api-reference/vaults/update-vault

[Get Vault]: /api/api-reference/vaults/get-vault

[List Vaults]: /api/api-reference/vaults/list-vaults

[List Backup Jobs]: /api/api-reference/jobs/backup-jobs/list-backup-jobs

[Get Backup Job]: /api/api-reference/jobs/backup-jobs/get-backup-job

[List Restore Jobs]: /api/api-reference/jobs/restore-jobs/list-restore-jobs

[Get Restore Job]: /api/api-reference/jobs/restore-jobs/get-restore-job

[Create Backup Policy]: /api/api-reference/backup-management/backup-policies/create-backup-policy

[Update Backup Policy]: /api/api-reference/backup-management/backup-policies/update-backup-policy

[Get Backup Policy]: /api/api-reference/backup-management/backup-policies/get-backup-policy

[List Backup Policies]: /api/api-reference/backup-management/backup-policies/list-backup-policies

[Create Backup Posture Control]: /api/api-reference/backup-management/backup-posture-controls/create-backup-posture-control

[Update Backup Posture Control]: /api/api-reference/backup-management/backup-posture-controls/update-backup-posture-control

[Get Backup Posture Control]: /api/api-reference/backup-management/backup-posture-controls/get-backup-posture-control

[List Backup Posture Controls]: /api/api-reference/backup-management/backup-posture-controls/list-backup-posture-controls

[Create Role]: /api/api-reference/access-management/roles/create-role

[Update Role]: /api/api-reference/access-management/roles/update-role

[Get Role]: /api/api-reference/access-management/roles/get-role

[List Roles]: /api/api-reference/access-management/roles/list-roles

[List Permissions]: /api/api-reference/access-management/roles/list-permissions

[Connect Source Account]: /api/api-reference/source-connections/source-accounts/connect-source-account

[Update Source Account]: /api/api-reference/source-connections/source-accounts/update-source-account

[Connect Source AWS Organizational Unit]: /api/api-reference/source-connections/source-aws-ous/connect-source-aws-organizational-unit

[Update Restore Account Connectivity Configuration]: /api/api-reference/restore-connections/restore-accounts/connectivity-configuration/update-restore-account-connectivity-config

[Get Restore Account Connectivity Configuration]: /api/api-reference/restore-connections/restore-accounts/connectivity-configuration/get-restore-account-connectivity-config

[Restore Azure Disk]: /api/api-reference/restore/restore-azure/restore-azure-disk

[Restore Azure VM Instance]: /api/api-reference/restore/restore-azure/restore-azure-vm-instance

[Restore EC2 Instance]: /api/api-reference/restore/restore-aws/restore-ec-2-instance

[Query Cost Data]: /api/api-reference/billing/query-cost-data