Spanning API Patterns — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited Spanning API Patterns (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
The MCP server (spanning-mcp) and SDK (@wyre-technology/node-spanning) are in development.
Spanning Cloud Backup provides daily SaaS backup for Microsoft 365, Google Workspace, and Salesforce. Each platform has its own REST API surface but a shared auth model.
Base URLs:
https://o365-api.spanningbackup.com/external/ (Microsoft 365)
https://api.spanningbackup.com/external/ (Google Workspace)
https://salesforce-api.spanningbackup.com/ (Salesforce)The MCP server takes a platform credential field (m365 | gws | salesforce) plus the appropriate region if applicable.
Spanning uses HTTP Basic auth per the public OpenAPI spec (<http://o365-docs.spanningbackup.com/swagger/json>):
Authorization: Basic base64(<admin_email>:<api_token>)The admin email and API token are pair-bound — both must match the pair on file in the Spanning admin console or the API returns 401.
Token issuance:
Org (a Spanning customer)
└── User (a backed-up M365 / GWS / Salesforce user)
└── Backup runs (one per day per service per user)
└── Restorable items (mail / drive / calendar / records)| Domain | Endpoint | Notes |
|---|---|---|
| Users | GET /external/users | All users in the org |
| Single user | GET /external/users/{userId} | License + backup state |
| User services | GET /external/users/{userId}/services | Mail, OneDrive, etc. |
| Backup runs | GET /external/users/{userId}/services/{service}/backups | |
| Restore (queue) | POST /external/users/{userId}/services/{service}/restores | |
| Restore status | GET /external/restores/{restoreId} | |
| Audit log | GET /external/audit | Date-ranged |
| License usage | GET /external/license | Seats used vs purchased |
Google Workspace and Salesforce surfaces mirror this with platform-appropriate substitutions.
Cursor-based:
GET /external/users?limit=100
→ { items: [...], next: "<cursor>" }
GET /external/users?limit=100&cursor=<cursor>Default limit 50, max 200.
Async, similar pattern to Datto SaaS Protection:
1. POST /external/users/{userId}/services/{service}/restores
body: { items: [...], restoreDestination: "..." }
→ { restoreId, status: "queued" }
2. Poll GET /external/restores/{restoreId} every 30s
3. status: queued → running → completed | failed100 req/min per token. HTTP 429 includes Retry-After. Long-running list operations (e.g. iterating audit logs across 90 days) should chunk by date and serialize.
| HTTP | Meaning | Action |
|---|---|---|
| 200 | OK | |
| 400 | Bad request | Validate |
| 401 | Bad / expired token, or admin email mismatch | Re-issue |
| 403 | Token lacks scope | Verify role |
| 404 | Unknown user / backup / restore | |
| 409 | Conflicting restore in flight | Surface to user |
| 429 | Rate limited | Back off |
| 500-503 | Transient | Exponential backoff |
When the build-out lands, expect domain skills for: users, backups, restores, audit, license.
~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.