---
title: "PATCH /v1/projects/{projectsId}/locations/{locationsId}/backupVaults/{backupVaultsId}"
method: PATCH
path: "/v1/projects/{projectsId}/locations/{locationsId}/backupVaults/{backupVaultsId}"
tags: ["projects"]
---

# PATCH /v1/projects/{projectsId}/locations/{locationsId}/backupVaults/{backupVaultsId}

`PATCH /v1/projects/{projectsId}/locations/{locationsId}/backupVaults/{backupVaultsId}`

## Request

- Base URL: `https://backupdr.googleapis.com`
- URL: `https://backupdr.googleapis.com/v1/projects/{projectsId}/locations/{locationsId}/backupVaults/{backupVaultsId}`
- Auth: one of:
  - OAuth 2 and OAuth 2
    - Implicit: `https://accounts.google.com/o/oauth2/auth`
    - Scopes: `https://www.googleapis.com/auth/cloud-backupdr`
    - Authorization code: `https://accounts.google.com/o/oauth2/auth`
    - Token URL: `https://accounts.google.com/o/oauth2/token` scopes: `https://www.googleapis.com/auth/cloud-backupdr`
  - OAuth 2 and OAuth 2
    - Implicit: `https://accounts.google.com/o/oauth2/auth`
    - Scopes: `https://www.googleapis.com/auth/cloud-platform`
    - Authorization code: `https://accounts.google.com/o/oauth2/auth`
    - Token URL: `https://accounts.google.com/o/oauth2/token` scopes: `https://www.googleapis.com/auth/cloud-platform`

Updates the settings of a BackupVault.

## Path parameters

- `projectsId` string, required
- `locationsId` string, required
- `backupVaultsId` string, required

## Query parameters

- `force` boolean
- `forceUpdateAccessRestriction` boolean
- `requestId` string
- `updateMask` string, google-fieldmask
- `validateOnly` boolean

## Request body

- BackupVault: Message describing a BackupVault object.
  - `accessRestriction` 'ACCESS_RESTRICTION_UNSPECIFIED' | 'WITHIN_PROJECT' | 'WITHIN_ORGANIZATION' | 'UNRESTRICTED' | 'WITHIN_ORG_BUT_UNRESTRICTED_FOR_BA': Optional. Restricts access to certain sources and destinations for data being sent into, or restored from, the backup vault. Defaults to WITHIN_ORGANIZATION if not provided during creation.
  - `annotations` object: Optional. User annotations. See https://google.aip.dev/128#annotations Stores small amounts of arbitrary data.
  - `backupCount` string, int64: Output only. The number of backups in this backup vault.
  - `backupMinimumEnforcedRetentionDuration` string, google-duration: Required. The default and minimum enforced retention for each backup within the backup vault. The enforced retention for each backup can be extended. Note: Longer minimum enforced retention period impacts potential storage costs post introductory trial. We recommend starting with a short duration of 3 days or less.
  - `backupRetentionInheritance` 'BACKUP_RETENTION_INHERITANCE_UNSPECIFIED' | 'INHERIT_VAULT_RETENTION' | 'MATCH_BACKUP_EXPIRE_TIME': Optional. Setting for how a backup's enforced retention end time is inherited.
  - `createTime` string, google-datetime: Output only. The time when the instance was created.
  - `deletable` boolean: Output only. Set to true when there are no backups nested under this resource.
  - `description` string: Optional. The description of the BackupVault instance (2048 characters or less).
  - `effectiveTime` string, google-datetime: Optional. Time after which the BackupVault resource is locked.
  - `encryptionConfig` EncryptionConfig: Message describing the EncryptionConfig of backup vault. This determines how data within the vault is encrypted at rest.
    - `kmsKeyName` string: Optional. The Cloud KMS key name to encrypt backups in this backup vault. Must be in the same region as the vault. Some workload backups like compute disk backups may use their inherited source key instead. Format: projects/{project}/locations/{location}/keyRings/{ring}/cryptoKeys/{key}
  - `etag` string: Optional. Server specified ETag for the backup vault resource to prevent simultaneous updates from overwiting each other.
  - `labels` object: Optional. Resource labels to represent user provided metadata. No labels currently defined:
  - `name` string: Output only. Identifier. Name of the backup vault to create. It must have the format`"projects/{project}/locations/{location}/backupVaults/{backupvault}"`. `{backupvault}` cannot be changed after creation. It must be between 3-63 characters long and must be unique within the project and location.
  - `serviceAccount` string: Output only. Service account used by the BackupVault Service for this BackupVault. The user should grant this account permissions in their workload project to enable the service to run backups and restores there.
  - `state` 'STATE_UNSPECIFIED' | 'CREATING' | 'ACTIVE' | 'DELETING' | 'ERROR' | 'UPDATING': Output only. The BackupVault resource instance state.
  - `totalStoredBytes` string, int64: Output only. Total size of the storage used by all backup resources.
  - `uid` string: Output only. Immutable after resource creation until resource deletion.
  - `updateTime` string, google-datetime: Output only. The time when the instance was updated.

## Response `200`

Successful response

- Operation: This resource represents a long-running operation that is the result of a network API call.
  - `done` boolean: If the value is `false`, it means the operation is still in progress. If `true`, the operation is completed, and either `error` or `response` is available.
  - `error` Status: The `Status` type defines a logical error model that is suitable for different programming environments, including REST APIs and RPC APIs. It is used by [gRPC](https://github.com/grpc). Each `Status` message contains three pieces of data: error code, error message, and error details. You can find out more about this error model and how to work with it in the [API Design Guide](https://cloud.google.com/apis/design/errors).
    - `code` integer: The status code, which should be an enum value of google.rpc.Code.
    - `details` object[]: A list of messages that carry the error details. There is a common set of message types for APIs to use.
    - `message` string: A developer-facing error message, which should be in English. Any user-facing error message should be localized and sent in the google.rpc.Status.details field, or localized by the client.
  - `metadata` object: Service-specific metadata associated with the operation. It typically contains progress information and common metadata such as create time. Some services might not provide such metadata. Any method that returns a long-running operation should document the metadata type, if any.
  - `name` string: The server-assigned name, which is only unique within the same service that originally returns it. If you use the default HTTP mapping, the `name` should be a resource name ending with `operations/{unique_id}`.
  - `response` object: The normal, successful response of the operation. If the original method returns no data on success, such as `Delete`, the response is `google.protobuf.Empty`. If the original method is standard `Get`/`Create`/`Update`, the response should be the resource. For other methods, the response should have the type `XxxResponse`, where `Xxx` is the original method name. For example, if the original method name is `TakeSnapshot()`, the inferred response type is `TakeSnapshotResponse`.

## Changes

- **2026-11-05** `da857420b4f6`: 4 info
  - the security scope `https://www.googleapis.com/auth/cloud-backupdr` was added to the endpoint's security scheme `Oauth2`
  - the security scope `https://www.googleapis.com/auth/cloud-backupdr` was added to the endpoint's security scheme `Oauth2c`
  - the security scope `https://www.googleapis.com/auth/cloud-platform` was removed from the endpoint's security scheme `Oauth2`
  - the security scope `https://www.googleapis.com/auth/cloud-platform` was removed from the endpoint's security scheme `Oauth2c`
- **2026-10-29** `3244196e66b0`: 4 info
  - the security scope `https://www.googleapis.com/auth/cloud-backupdr` was added to the endpoint's security scheme `Oauth2`
  - the security scope `https://www.googleapis.com/auth/cloud-backupdr` was added to the endpoint's security scheme `Oauth2c`
  - the security scope `https://www.googleapis.com/auth/cloud-platform` was removed from the endpoint's security scheme `Oauth2`
  - the security scope `https://www.googleapis.com/auth/cloud-platform` was removed from the endpoint's security scheme `Oauth2c`

[Operation history](https://skmtc.dev/google/apis/backupdr/changes/v1/projects/:projectsId/locations/:locationsId/backupVaults/:backupVaultsId/patch.md)

---

[API](https://skmtc.dev/google/apis/backupdr.md) - [All operations](https://skmtc.dev/google/apis/backupdr/llms.txt) - [OpenAPI document](https://skmtc.dev/google/apis/backupdr/revisions/da857420b4f6?raw)