Tenant backups API with dry-run restores
Opt-in scheduled backups and restores of your Takelan tenant data, with dry-run previews and an audit trail.
What it does
- The Tenant Backups API lets a tenant administrator back up the data that Takelan services hold for that tenant, and restore it later. You can start a backup on demand, set a schedule, download the result and run a restore. Every step is recorded.
- It solves a quiet worry: "if someone deletes the wrong thing in our account, can we get it back?" Instead of exporting each service by hand, you ask for one backup that covers the services that support it, then see per service whether it worked.
- It is opt-in. Scheduling is off until an administrator turns it on, so nothing runs behind your back. You choose the frequency, the time of day, the weekday or day of month, how long to keep backups (up to 180 days) and how many to keep. You can limit a backup to chosen services, and switch on a notification if a backup fails.
- A backup record shows its status, size, a SHA-256 checksum, who or what triggered it and a result for each service. A coverage report explains what is included and what is left out on purpose, per service, so you know the limits before you rely on it.
- Restores are careful. A dry run previews what a restore would do before it changes anything. You can restore from a stored backup or from a zip you upload. A download link is created on request, and each download is audited when it is used.
- This API is for tenant administrators. Service tokens are refused, and the tenant comes from the token. Over the limit you get a 429 with a Retry-After header. We do not publish backup sizes, durations or recovery-time numbers.
- It is not the same as ShadowCradle. ShadowCradle backs up your servers and workstations. Tenant Backups protects the data your account holds in Takelan services.
- Affordable by design. Start free* inside platform limits. *Free within platform limits; usage beyond limits may be charged to maintain the platform. Connected ShadowCradle organizations can switch on Takelan SSO and these free* services with one switch. Airgap licences work without any Takelan connection.
Example use cases
A weekly safety net
A small business admin turns on a weekly backup at 02:00, keeps 8 backups and asks for an alert if one fails. Nobody has to remember.
Back up before a big change
Before a bulk import or a clean-up script, an IT admin starts a backup on demand and waits for it to finish. If something goes wrong, there is a known good point.
Practise the restore
An MSP runs a dry-run restore each quarter to see what would come back, without changing the live tenant.
Keep a copy outside the platform
An admin creates a download link for the latest backup and stores the zip with the company's own archive. The checksum lets them confirm it later.
Show who did what
An auditor asks who downloaded or restored a backup. The audit trail lists created, downloaded, restored, deleted, pruned and failed events.
Know what is not covered
Before relying on backups for a policy, a team reads the coverage report to see which tables each service includes and which it leaves out, with reasons.
Try it
Turn on a weekly schedule
curl -X PUT https://app.takelan.com/api/v1/backups/config \
-H "X-API-Key: $TAKELAN_API_KEY" \
-H "Content-Type: application/json" \
-d '{
"enabled": true,
"frequency": "weekly",
"weekday": 0,
"time_of_day": "02:00",
"retention_days": 60,
"retention_count": 8,
"notify_on_failure": true
}'Administrator credentials required. retention_days can be set up to 180.
Start a backup now, then preview a restore
curl -X POST https://app.takelan.com/api/v1/backups \
-H "X-API-Key: $TAKELAN_API_KEY"
# Response (abridged, fictional), HTTP 202
# { "id": "b7e4...19", "status": "pending", "trigger": "manual", "services": [ ... ] }
curl -X POST "https://app.takelan.com/api/v1/backups/b7e4...19/restore?dry_run=true" \
-H "X-API-Key: $TAKELAN_API_KEY" \
-H "Content-Type: application/json" \
-d '{}'Poll GET /api/v1/backups until the status changes. You get 409 if a backup is already running.
Endpoints
GET /api/v1/backupsList backups (limit and offset).POST /api/v1/backupsStart a backup now. Returns 202; poll the list.GET /api/v1/backups/{backup_id}One backup with a result per service.DELETE /api/v1/backups/{backup_id}Delete a backup.GET /api/v1/backups/configRead the schedule and retention settings.PUT /api/v1/backups/configSet the schedule, retention, services and failure notice.GET /api/v1/backups/servicesServices that take part, with their last result.GET /api/v1/backups/services/coverageWhat each service includes and excludes.GET /api/v1/backups/services/coverage-policyStatements that apply to every service.GET /api/v1/backups/auditAudit trail of backup events.POST /api/v1/backups/{backup_id}/download-linkCreate a time-limited download link.POST /api/v1/backups/{backup_id}/restoreRestore a stored backup. Add ?dry_run=true to preview.POST /api/v1/backups/restoreRestore from an uploaded zip (or a staged dry run). Add ?dry_run=true to preview.GET /api/v1/backups/restores/{restore_id}Status of one restore or preview.
MCP
Available as tools through /mcp/utils; writes off by default. Reading backups, config, coverage and the audit trail works with a read-only key. Starting a backup, changing the schedule or deleting is a write and needs the tenant's writes switch plus a key that is not read-only. Restore and download routes are not exposed as tools, and the download-link route is marked sensitive. About MCP
Common questions
how to back up my cloud account data automatically
An administrator turns on the schedule with PUT /api/v1/backups/config, picks frequency and time, and sets how long to keep backups. Scheduling is opt-in and is off until you enable it.
how long are tenant backups kept
You set retention in days (up to 180) and by count. Older backups are pruned, and pruning is recorded in the audit trail.
can I test a restore without changing my data
Yes. Add dry_run=true to a restore call. It previews what would happen. You can reuse the preview id when you run the real restore.
who is allowed to run backups and restores
Tenant administrators only. Service tokens are refused, and every query is limited to the tenant in the token.
can I download a backup and keep it myself
Yes. Request a download link for a backup. The link is time-limited, the download is audited when used, and the record includes a SHA-256 checksum.
what is not included in a backup
It differs by service. The coverage endpoints list included and excluded tables with reasons, so read them before you rely on a backup for a specific policy.
is this the same as ShadowCradle backup
No. ShadowCradle protects your servers, workstations and virtual machines. Tenant Backups covers the data your account holds in Takelan platform services.
does tenant backup cost extra
It is affordable by design: start free* within platform limits. *Free within platform limits; usage beyond limits may be charged to maintain the platform.