projects

PATCH /v1/projects/{projectsId}/locations/{locationsId}/backupVaults/{backupVaultsId}

Changed on Nov 5, 2026

Updates the settings of a BackupVault.

Request

Base URL
https://backupdr.googleapis.com
Auth
- OAuth 2 and OAuth 2
  Implicit: https://accounts.google.com/o/oauth2/auth
  Scopes: https://www.googleapis.com/auth/cloud-backupdr
  Authorization code: https://accounts.google.com/o/oauth2/auth
  Token URL: https://accounts.google.com/o/oauth2/token scopes: https://www.googleapis.com/auth/cloud-backupdr
- or OAuth 2 and OAuth 2
  Implicit: https://accounts.google.com/o/oauth2/auth
  Scopes: https://www.googleapis.com/auth/cloud-platform
  Authorization code: https://accounts.google.com/o/oauth2/auth
  Token URL: https://accounts.google.com/o/oauth2/token scopes: https://www.googleapis.com/auth/cloud-platform

Path parameters

projectsIdstring required

locationsIdstring required

backupVaultsIdstring required

Query parameters

forceboolean

Optional. If set to true, will not check plan duration against backup vault enforcement duration.

forceUpdateAccessRestrictionboolean

Optional. If set to true, we will force update access restriction even if some non compliant data sources are present. The default is 'false'.

requestIdstring

Optional. An optional request ID to identify requests. Specify a unique request ID so that if you must retry your request, the server will know to ignore the request if it has already been completed. The server will guarantee that for at least 60 minutes since the first request. For example, consider a situation where you make an initial request and the request times out. If you make the request again with the same request ID, the server can check if original operation with the same request ID was received, and if so, will ignore the second request. This prevents clients from accidentally creating duplicate commitments. The request ID must be a valid UUID with the exception that zero UUID is not supported (00000000-0000-0000-0000-000000000000).

updateMaskstring google-fieldmask

Required. Field mask is used to specify the fields to be overwritten in the BackupVault resource by the update. The fields specified in the update_mask are relative to the resource, not the full request. A field will be overwritten if it is in the mask. If the user does not provide a mask then the request will fail.

validateOnlyboolean

Optional. Only validate the request, but do not perform mutations. The default is 'false'.

Request body

accessRestriction'ACCESS_RESTRICTION_UNSPECIFIED' | 'WITHIN_PROJECT' | 'WITHIN_ORGANIZATION' | 'UNRESTRICTED' | 'WITHIN_ORG_BUT_UNRESTRICTED_FOR_BA'

Optional. Restricts access to certain sources and destinations for data being sent into, or restored from, the backup vault. Defaults to WITHIN_ORGANIZATION if not provided during creation.

annotationsobject

Optional. User annotations. See https://google.aip.dev/128#annotations Stores small amounts of arbitrary data.

backupCountstring int64

Output only. The number of backups in this backup vault.

backupMinimumEnforcedRetentionDurationstring google-duration

Required. The default and minimum enforced retention for each backup within the backup vault. The enforced retention for each backup can be extended. Note: Longer minimum enforced retention period impacts potential storage costs post introductory trial. We recommend starting with a short duration of 3 days or less.

backupRetentionInheritance'BACKUP_RETENTION_INHERITANCE_UNSPECIFIED' | 'INHERIT_VAULT_RETENTION' | 'MATCH_BACKUP_EXPIRE_TIME'

Optional. Setting for how a backup's enforced retention end time is inherited.

createTimestring google-datetime

Output only. The time when the instance was created.

deletableboolean

Output only. Set to true when there are no backups nested under this resource.

descriptionstring

Optional. The description of the BackupVault instance (2048 characters or less).

effectiveTimestring google-datetime

Optional. Time after which the BackupVault resource is locked.

etagstring

Optional. Server specified ETag for the backup vault resource to prevent simultaneous updates from overwiting each other.

labelsobject

Optional. Resource labels to represent user provided metadata. No labels currently defined:

namestring

Output only. Identifier. Name of the backup vault to create. It must have the format"projects/{project}/locations/{location}/backupVaults/{backupvault}". {backupvault} cannot be changed after creation. It must be between 3-63 characters long and must be unique within the project and location.

serviceAccountstring

Output only. Service account used by the BackupVault Service for this BackupVault. The user should grant this account permissions in their workload project to enable the service to run backups and restores there.

Output only. The BackupVault resource instance state.

totalStoredBytesstring int64

Output only. Total size of the storage used by all backup resources.

uidstring

Output only. Immutable after resource creation until resource deletion.

updateTimestring google-datetime

Output only. The time when the instance was updated.

Response

Successful response

doneboolean

If the value is false, it means the operation is still in progress. If true, the operation is completed, and either error or response is available.

metadataobject

Service-specific metadata associated with the operation. It typically contains progress information and common metadata such as create time. Some services might not provide such metadata. Any method that returns a long-running operation should document the metadata type, if any.

namestring

The server-assigned name, which is only unique within the same service that originally returns it. If you use the default HTTP mapping, the name should be a resource name ending with operations/{unique_id}.

responseobject

The normal, successful response of the operation. If the original method returns no data on success, such as Delete, the response is google.protobuf.Empty. If the original method is standard Get/Create/Update, the response should be the resource. For other methods, the response should have the type XxxResponse, where Xxx is the original method name. For example, if the original method name is TakeSnapshot(), the inferred response type is TakeSnapshotResponse.

Changes

Nov 5, 2026da857420b4f6 Revision changes
- info
  the security scope https://www.googleapis.com/auth/cloud-backupdr was added to the endpoint's security scheme Oauth2
- info
  the security scope https://www.googleapis.com/auth/cloud-backupdr was added to the endpoint's security scheme Oauth2c
- info
  the security scope https://www.googleapis.com/auth/cloud-platform was removed from the endpoint's security scheme Oauth2
- info
  the security scope https://www.googleapis.com/auth/cloud-platform was removed from the endpoint's security scheme Oauth2c
Oct 29, 20263244196e66b0 Revision changes
- info
  the security scope https://www.googleapis.com/auth/cloud-backupdr was added to the endpoint's security scheme Oauth2
- info
  the security scope https://www.googleapis.com/auth/cloud-backupdr was added to the endpoint's security scheme Oauth2c
- info
  the security scope https://www.googleapis.com/auth/cloud-platform was removed from the endpoint's security scheme Oauth2
- info
  the security scope https://www.googleapis.com/auth/cloud-platform was removed from the endpoint's security scheme Oauth2c

Operation history