Overview

This article outlines the minimum permissions needed for custom role to use Druva inSync REST APIs, along with the default API permissions for the Cloud Admin Read Only role. It maps specific access rights across various API categories, such as User Management, Endpoints, Legal Hold, and Microsoft 365.

Custom Role

Permission-to-API Mapping

If you use the Druva inSync REST APIs, each API requires specific permissions. The following tables list the minimum permissions required for each API category.

User Management APIs

Base URL: https://apis.druva.com/insync/usermanagement

API	Endpoint	Method	Minimum Permission Required
List all users	/v1/users	GET	View Users
Create a new user	/v1/users	POST	Create and Import Users
Get user information using userID	/v1/users/{userID}	GET	View Users
Update user information using userID	/v1/users/{userID}	PATCH	Manage Users
Delete a user	/v1/users/{userID}	DELETE	Delete Users
Reset password for a user	/v1/users/{userID}/resetPassword	POST	Manage Users
Preserve a user	/v1/users/{userID}/preserve	POST	Manage Users
Activate a user	/v1/users/{userID}/activate	POST	Manage Users
Download AuthKey	/v1/users/{userID}/download_user_auth_key	GET	Download Auth Keys

Profile Management APIs

Base URL: https://apis.druva.com/insync/profilemanagement

API	Endpoint	Method	Minimum Permission Required
List all profiles	/v1/profiles	GET	View Profiles
Get profile information	/v1/profiles/{profileID}	GET	View Profiles

Endpoint APIs

Base URL: https://apis.druva.com/insync/endpoints

API	Endpoint	Method	Minimum Permission Required
List all devices - v1	/v1/devices	GET	View Users
List all devices - v2	/v2/devices	GET	View Users
Get device information - v1	/v1/devices/{deviceID}	GET	View Users
Get device information - v2	/v2/devices/{deviceID}	GET	View Users
Delete a device	/v1/devices/{deviceID}	DELETE	Delete Workload
Disable a device	/v1/devices/{deviceID}/disable	POST	Manage Workload
Enable a device	/v1/devices/{deviceID}/enable	POST	Manage Workload
Decommission a device	/v1/devices/{deviceID}/decommission	POST	Decommission Devices
Upgrade inSync Client on a device	/v1/devices/{deviceID}/upgradeClient	POST	Upgrade inSync Device

Endpoint Mapping APIs

Base URL: https://apis.druva.com/insync/endpoints

API	Endpoint	Method	Minimum Permission Required
Create device mapping	/v1/devicemappings	POST	Manage Device Mappings
List device mapping	/v1/devicemappings	GET	Manage Device Mappings
Delete device mapping	/v1/devicemappings/{mappingID}	DELETE	Manage Device Mappings

Endpoint Backup and Restore APIs

Base URL: https://apis.druva.com/insync/endpoints

API	Endpoint	Method	Minimum Permission Required
List endpoint backups	/v1/backups	GET	View Users
List all restore activities	/v1/restores	GET	View Restores
Get restore by restoreID	/v1/restores/{restoreID}	GET	View Restores
Initiate a restore activity	/v1/restores	POST	Manage Restores

Legal Hold APIs

Base URL: https://apis.druva.com/insync/legalholds

API	Endpoint	Method	Minimum Permission Required
List legal hold policies - v3	/v3/policies	GET	View legal holds, Create and manage legal holds
List Legal Hold policies - v4	/v4/policies	GET	View legal holds, Create and manage legal holds
Get details of a legal hold policy - v3	/v3/policies/{policyId}	GET	View legal holds, Create and manage legal holds
Legal Hold policy details - v4	/v4/policies/{policyId}	GET	View legal holds, Create and manage legal holds
List the users on legal hold - v3	/v3/policies/{policyId}/users	GET	View legal holds, Create and manage legal holds
Lists the users of a Legal Hold policy - v4	/v4/policies/{policyId}/users	GET	View legal holds, Create and manage legal holds
Lists all the devices of a Legal Hold policy - v4	/v4/policies/{policyId}/collection-stream	GET	View legal hold clients, Create and manage legal holds
List eDiscovery Download Clients - v4	/v4/clients	GET	View legal hold clients, Create and manage legal holds
Get eDiscovery Download Client details - v4	/v4/clients/{clientId}	GET	View legal hold clients, Create and manage legal holds
Get details of a download job - v4	/v4/job/{jobId}	GET	View legal hold clients, Create and manage legal holds
Manage eDiscovery Download Client jobs - v4	/v4/job	PUT	Manage legal hold clients
List all download jobs - v4	/v4/jobs	GET	View legal hold clients, Create and manage legal holds
Create a legal hold policy - v3	/v3/policies	POST	Create and manage legal holds
Create a Legal Hold policy - v4	/v4/policies	POST	Create and manage legal holds
Delete a legal hold policy - v3	/v4/policies/{policyId}	DELETE	Delete legal holds
Delete a Legal Hold policy - v4	/v4/policies/{policyId}	DELETE	Delete legal holds
Add or delete users (custodians) from a legal hold policy - v3	/v3/policies/{policyId}/users	POST	Manage legal hold settings
List legal hold policies associated with a user - v3	/v3/users/policies	POST	View legal holds
Manage Legal Hold policy details - v4	/v4/policies/{policyId}	PUT	Manage legal hold settings
Initiate custodian data download - v4	/v4/job	POST	Manage legal hold clients

Event Management APIs

Base URL: https://apis.druva.com/insync/eventmanagement

API	Endpoint	Method	Minimum Permission Required
List all events	/v2/events	GET	View and download reports and view alerts

Storage Management APIs

Base URL: https://apis.druva.com/insync/storagemanagement

API	Endpoint	Method	Minimum Permission Required
List all storages	/v1/storages	GET	View Storages
Get storage information	/v1/storages/{storageID}	GET	View Storages

AD/LDAP Management APIs

Base URL: https://apis.druva.com/insync/admanagement

API	Endpoint	Method	Minimum Permission Required
List all AD/LDAP Connectors	/v1/adConnectors	GET	View Users

Audit Trail Management APIs

Base URL: https://apis.druva.com/insync/audittrailmanagement

API	Endpoint	Method	Minimum Permission Required
Get admin audit trail retention settings	/v1/auditTrailSettings	GET	View inSync Settings

Federated Search APIs

Base URL: https://apis.druva.com/insync/search/mds

API	Endpoint	Method	Minimum Permission Required
Search for files	/v1/user/files	GET	Access Federated Search
Search for emails	/v1/user/emails	GET	Access Federated Search

Sensitive Data Governance APIs

Base URL: https://apis.druva.com/insync/sdg

API	Endpoint	Method	Minimum Permission Required
List all data types	/v1/datatypes	GET	View Sensitive Data Governance Violations and Settings
List all policy templates	/v1/policyTemplates	GET	View Sensitive Data Governance Violations and Settings
List all configured policies	/v1/policies	GET	View Sensitive Data Governance Violations and Settings
List all whitelisted keywords	/v1/whitelistKeywords	GET	View Sensitive Data Governance Violations and Settings
List Sensitive Data Governance settings	/v1/settings	GET	View Sensitive Data Governance Violations and Settings
List file violations	/v1/fileViolations	GET	View Sensitive Data Governance Violations and Settings
List email violations	/v1/emailViolations	GET	View Sensitive Data Governance Violations and Settings

Authentication API

API	Endpoint	Method	Minimum Permission Required
Authentication	https://apis.druva.com/token	GET

Microsoft 365 APIs

API	Endpoint	Method	Minimum Permission Required
List All SharePoint Site Collections	/v3/sites	GET	View Users
List All SharePoint Site Restore Points	/v2/siteCollections/{site_collection_id}/restorePoints	GET	View Restores
Restore a SharePoint Site	/v2/restores	POST	Manage Restores
List All Protected Cloud Apps	/v1/devices	GET	View Users
List All OneDrive/Exchange Online Restore Points	/v1/restorePoints	GET	View Restores
Restore a OneDrive Account or Exchange Online Mailbox	/v1/restores	POST	Manage Restores
Get Microsoft 365 Apps Status	/v1/apps/status	GET	View Users

Cloud Admin (Read only)

The Cloud Admin (Read Only) role is specifically configured to provide secure, view-only access to inSync Cloud APIs, enabling effective data monitoring and third-party integrations while preventing accidental or unauthorized updates.

Below are the APIs that cloud Admin (Read Only) can access:

Category	API Endpoint
User Management	List all users
	Get user information using userID
	Download AuthKey
Profile Management	List all profiles
	Get profile information
Event Management	List all events
Storage Management	Get storage information
AD/LDAP Management	List all AD/LDAP Connectors
Audit Trail Management	Get admin audit trail retention settings
Federated Search	Search for files
Endpoints	List all devices - v1
	Get device information - v1
	List endpoint backups
	List all restore activities
	Get restore by restoreID
	List all devices - v2
	Get device information - v2
Legal Hold	List legal hold policies - v3
	Get details of a legal hold policy - v3
	List legal hold policies associated with a user - v3
	List the users on legal hold - v3
	List Legal Hold policies - v4
	Legal Hold policy details - v4
	Lists the users of a Legal Hold policy - v4
	Lists all the devices of a Legal Hold policy - v4
	List eDiscovery Download Clients - v4
	Get eDiscovery Download Client details - v4
	Get details of a download job - v4
	List all download jobs - v4
Event Management	List all events
Storage Management	Get storage information
AD/LDAP Management	List all AD/LDAP Connectors
Audit Trail Management	Get admin audit trail retention settings
Federated Search	Search for files
Federated Search	Search for emails
Sensitive Data Governance	List all data types
	List all policy templates
	List all configured policies
	List all whitelisted keywords
	List Sensitive Data Governance settings
	List file violations
	List email violations
Microsoft 365	Get Microsoft 365 Apps Status
	List All SharePoint Site Collections
	List All SharePoint Site Restore Points
	List users based on query filters
	List All Protected Cloud Apps
	List All OneDrive/Exchange Online Restore points
Google Workspace	Get Google Workspace App Status