---
title: "Search resources for VMware resource type"
method: POST
path: "/threathunting/v1/search/backupset"
tags: ["Threat Hunting"]
---

# Search resources for VMware resource type

`POST /threathunting/v1/search/backupset`

## Request

- Base URL: `https://apis.druva.com/realize`
- URL: `https://apis.druva.com/realize/threathunting/v1/search/backupset`
- Auth: API key in header `Authorization`

Find all resources available for the provided search filters.

## Request body

- ThreatHuntSearchBackupsetParams
  - `resourceName` string: Specify the complete name or a prefix for the device name, hostname, or server name to search and list the devices, hostname, or servers. Example - “My” is the prefix in the device name “MyDevice123”.
  - `orgIDs` integer[]: Specify the unique Phoenix(Enterprise Workload) organization ID for the resource.
  - `resourceParentIDs` integer[]: Specify the ResourceParentID. In the case of VMware, the resource parent ID is ESXI host or Vcenter.
  - `resourceTypes` string[]: Specify the resource type. Currently, VMware resource type is supported.
  - `pageToken` string: The token to access the next page of results. Use the token value received in the previous response's parameter 'nextPageToken'.

## Response `200`

Success

- ThreatHuntSearchBackupsetResponse
  - `resources` object[]
    - `resourceName` string: Name of the resource. In case of VMware, resource name will be VM name. Example - Ernie Carter's VM.
    - `resourceType` string: Name of the resource type. Example - VMware, Endpoint, File Server. Currently, only the VMware resource type is supported.
    - `resourceID` integer: Unique identifier for a resource.
    - `resourceParentName` string: The ESXi name (for VMware) or Server Name (for other server types) is used to identify a backup set. For instance, the name might be an IP address like 172.16.14.43.
    - `resourceParentID` integer: Unique identifier of the parent resource. Unique identifier for ESXI FQDN in case of VMware.
    - `orgID` integer: The unique identifier of the Phoenix (Enterprise Workloads) organization for the resource.
    - `lastIndexedSnapshot` string: Last indexed snapshot for this resource. The threat hunt scan will run until this snapshot.
    - `lastSnapshot` string: The last snapshot whose backup has successfully been completed in Druva Cloud.
  - `nextPageToken` string: The token to access the next page of results. This parameter will be empty for the last page of results.

## Other responses

- `400`: Bad Request
- `401`: The request either did not include an authentication token, or you have provided an expired authentication token.
- `404`: The requested resource was not found.
- `500`: Internal Server Error

---

[API](https://skmtc.dev/druva/apis/cyber-resilience.md) - [All operations](https://skmtc.dev/druva/apis/cyber-resilience/llms.txt) - [OpenAPI document](https://skmtc.dev/druva/apis/cyber-resilience/revisions/b149d46c996a?raw)