Unitrends API Patterns — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited Unitrends API Patterns (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
The MCP server (unitrends-mcp) and SDK (@wyre-technology/node-unitrends) are in development.
Unitrends Backup appliances expose a REST API on each appliance. Reference: <https://github.com/unitrends/unitrends-api-doc/wiki>
Base URL is per-appliance:
https://<appliance>/apiFor multi-appliance MSPs, an MSP Console aggregates across appliances at:
https://<msp-console>/apiThe MCP server takes the base URL as a credential field.
Session-token flow:
POST /api/login with body { "username": "...", "password": "..." }{ "token": "...", "expires": <epochSeconds> }Authorization: Bearer <token>Re-auth on 401; wrap in single-flight mutex to avoid concurrent re-auth races.
Appliance (the Unitrends host)
└── Asset (a protected machine — VM, physical, NAS, M365 tenant)
└── Asset Source (specific data type — VMware VM, file system, SQL DB)
└── Backup Job
└── Recovery Point (restore point)When designing queries, always think appliance-first; assets are scoped to one appliance unless on the MSP Console.
| Domain | Endpoint | Notes |
|---|---|---|
| Appliances (MSP Console) | GET /api/appliances | |
| Assets | GET /api/assets | Filter by applianceId |
| Backup jobs | GET /api/jobs/backups | Currently running + queued |
| Job history | GET /api/jobs/history | Date-ranged |
| Recovery points | GET /api/recovery_points | Per asset |
| Restore | POST /api/restores | Queue a restore |
| Replication | GET /api/replication/queue | Hot copy targets |
| Alerts | GET /api/alerts | Open alarms |
| Reports | GET /api/reports/successrate | RPO compliance |
Page-based:
| Param | Default | Max |
|---|---|---|
limit | 50 | 500 |
offset | 0 | — |
Responses include total for the full result count.
Per-appliance limits depend on hardware tier; Unitrends doesn't publish them. Defensive defaults: cap concurrency at 2 per appliance, sustained 60 req/min. HTTP 503 typically signals an appliance under load — back off for 30 seconds.
| HTTP | Meaning | Action |
|---|---|---|
| 200 | OK | |
| 400 | Bad parameter | Validate |
| 401 | Token expired | Re-auth, retry once |
| 403 | User lacks role on this appliance | Surface |
| 404 | Asset / job / recovery point unknown | |
| 503 | Appliance overloaded or in maintenance | Back off 30s |
verifyTls credential field; default true, allow false for trusted internal networks.123 on appliance A is not the same asset on appliance B. Always carry applianceId alongside.success ≠ "data is recoverable". A job can complete successfully with a degraded recovery point. Inspect both status and verifyState for full health.When the build-out lands, expect domain skills for: appliances, assets, jobs, recovery-points, replication.
~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.