AWS Backup

AWS Backup Backup Scan API

The Backup Scan API from AWS Backup — 4 operation(s) for backup scan.

GitHub OpenAPI

Operations 4

GET /scan/jobs/{ScanJobId} Describe Scan Job #
GET /scan/pitr-malware-scan-results Get PITRMalware Scan Results #
GET /scan/jobs List Scan Jobs #
PUT /scan/job Start Scan Job #

Specifications

⚙
OpenAPI
https://artifacts.apis.io/aws-backup/openapi/aws-backup-scan-api-openapi.yml

Work with this as data

Every API here is available over the APIs.io API and to AI agents over MCP.

MCP server

One button, every client — Claude, Cursor, VS Code and the rest.

https://apis.io/mcp

Tools for apis

7 MCP tools reach this
  • find_apisBrowse and filter every API in the catalog.
  • get_api_artifactsOne API's artifacts, grouped by type.
  • get_openapiThe primary OpenAPI for this API.
  • find_similar_apisAPIs that look like this one.
  • apis_io_searchSTART HERE — APIs, providers and tags for one query, each with its total.
  • resolveTurn a domain, URL or GitHub org into the provider it belongs to.
  • find_cohortsEvery scored population of providers in the catalog.
All 92 tools →

Call it yourself

curl for this page
This API 
curl "https://apis.io/api/v1/apis/aws-backup:aws-backup-scan-api"
All apis 
curl "https://apis.io/api/v1/apis?limit=25"

Calls without X-API-Key need no key. Calls with it need a paid plan — get a key.

Get an API key

Free tier, no form to fill in. Signing in shares your email address with us — we store it to create your key and to recognise you if you sign in with another provider. See our Privacy Policy and Terms.

GitHub Google LinkedIn

A second provider on the same verified email joins the account you already have.

OpenAPI Specification

aws-backup-scan-api-openapi.yml Raw ↑ 
openapi: 3.2.0
info:
  title: AWS Backup Scan API
  version: '2018-11-15'
  description: Generated from AWS's published Smithy model for AWS Backup. 4 operation(s).
  contact:
    name: Amazon Web Services
    url: https://aws.amazon.com/contact-us/
  license:
    name: Apache 2.0
    identifier: Apache-2.0
    url: https://github.com/aws/api-models-aws/blob/main/LICENSE
servers:
- url: https://backup.{region}.amazonaws.com
  variables:
    region:
      default: us-east-1
security:
- sigv4: []
tags:
- name: Scan
paths:
  /scan/jobs/{ScanJobId}:
    get:
      operationId: DescribeScanJob
      summary: Describe Scan Job
      description: Returns scan job details for the specified ScanJobID.
      responses:
        '200':
          description: Success
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/DescribeScanJobOutput'
        '400':
          description: InvalidParameterValueException; MissingParameterValueException; ResourceNotFoundException
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/InvalidParameterValueException'
        '500':
          description: ServiceUnavailableException
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ServiceUnavailableException'
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/DescribeScanJobInput'
      tags:
      - Scan
  /scan/pitr-malware-scan-results:
    get:
      operationId: GetPITRMalwareScanResults
      summary: Get PITRMalware Scan Results
      description: Returns the malware scan results for a specified point in time within a continuous (point-in-time recovery) backup.
      responses:
        '200':
          description: Success
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/GetPITRMalwareScanResultsOutput'
        '400':
          description: InvalidParameterValueException; MissingParameterValueException; ResourceNotFoundException
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/InvalidParameterValueException'
        '500':
          description: ServiceUnavailableException
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ServiceUnavailableException'
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/GetPITRMalwareScanResultsInput'
      tags:
      - Scan
  /scan/jobs:
    get:
      operationId: ListScanJobs
      summary: List Scan Jobs
      description: Returns a list of existing scan jobs for an authenticated account for the last 30 days.
      responses:
        '200':
          description: Success
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ListScanJobsOutput'
        '400':
          description: InvalidParameterValueException
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/InvalidParameterValueException'
        '500':
          description: ServiceUnavailableException
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ServiceUnavailableException'
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/ListScanJobsInput'
      tags:
      - Scan
  /scan/job:
    put:
      operationId: StartScanJob
      summary: Start Scan Job
      description: Starts scanning jobs for specific resources.
      responses:
        '200':
          description: Success
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/StartScanJobOutput'
        '400':
          description: InvalidParameterValueException; InvalidRequestException; LimitExceededException; MissingParameterValueException; ResourceNotFoundException
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/InvalidParameterValueException'
        '500':
          description: ServiceUnavailableException
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ServiceUnavailableException'
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/StartScanJobInput'
      tags:
      - Scan
components:
  schemas:
    ServiceUnavailableException:
      type: object
      properties:
        Code:
          type: string
        Message:
          type: string
        Type:
          type: string
        Context:
          type: string
    ScanJobCreator:
      type: object
      properties:
        BackupPlanArn:
          type: string
          description: An Amazon Resource Name (ARN) that uniquely identifies a backup plan; for example, arn:aws:backup:us-east-1:123456789012:plan:8F81F553-3A74-4A3F-B93D-B3360DC80C50.
        BackupPlanId:
          type: string
          description: The ID of the backup plan.
        BackupPlanVersion:
          type: string
          description: Unique, randomly generated, Unicode, UTF-8 encoded strings that are at most 1,024 bytes long. Version IDs cannot be edited.
        BackupRuleId:
          type: string
          description: Uniquely identifies the backup rule that initiated the scan job.
      required:
      - BackupPlanArn
      - BackupPlanId
      - BackupPlanVersion
      - BackupRuleId
    ScanResultInfo:
      type: object
      properties:
        ScanResultStatus:
          type: string
          enum:
          - NO_THREATS_FOUND
          - THREATS_FOUND
          - UNKNOWN
          description: 'The status of the scan results. Valid values: THREATS_FOUND | NO_THREATS_FOUND | UNKNOWN.'
      required:
      - ScanResultStatus
    StartScanJobOutput:
      type: object
      properties:
        CreationDate:
          type: string
          description: The date and time that a backup job is created, in Unix format and Coordinated Universal Time (UTC). The value of CreationDate is accurate to milliseconds. For example, the value 1516925490.087 represents Friday, January 26, 2018 12:11:30.087 AM.
        ScanJobId:
          type: string
          description: Uniquely identifies a request to Backup to back up a resource.
      required:
      - CreationDate
      - ScanJobId
    InvalidParameterValueException:
      type: object
      properties:
        Code:
          type: string
        Message:
          type: string
        Type:
          type: string
        Context:
          type: string
    DescribeScanJobOutput:
      type: object
      properties:
        AccountId:
          type: string
          description: 'Returns the account ID that owns the scan job. Pattern: ^[0-9]{12}$'
        BackupVaultArn:
          type: string
          description: An Amazon Resource Name (ARN) that uniquely identifies a backup vault; for example, arn:aws:backup:us-east-1:123456789012:backup-vault:aBackupVault
        BackupVaultName:
          type: string
          description: 'The name of a logical container where backups are stored. Backup vaults are identified by names that are unique to the account used to create them and the Amazon Web Services Region where they are created. Pattern: ^[a-zA-Z0-9\-\_\.]{2,50}$'
        CompletionDate:
          type: string
          description: The date and time that a backup index finished creation, in Unix format and Coordinated Universal Time (UTC). The value of CompletionDate is accurate to milliseconds. For example, the value 1516925490.087 represents Friday, January 26, 2018 12:11:30.087 AM.
        ContinuousScanEndTime:
          type: string
          description: The point in time the scan job scanned up to for a continuous backup.
        ContinuousScanStartTime:
          type: string
          description: The point in time the scan job started scan from for a continuous backup.
        CreatedBy:
          $ref: '#/components/schemas/ScanJobCreator'
        CreationDate:
          type: string
          description: The date and time that a backup index finished creation, in Unix format and Coordinated Universal Time (UTC). The value of CreationDate is accurate to milliseconds. For example, the value 1516925490.087 represents Friday, January 26, 2018 12:11:30.087 AM.
        IamRoleArn:
          type: string
          description: An Amazon Resource Name (ARN) that uniquely identifies a backup vault; for example, arn:aws:iam::123456789012:role/S3Access.
        MalwareScanner:
          type: string
          enum:
          - GUARDDUTY
          description: The scanning engine used for the corresponding scan job. Currently only GUARDUTY is supported.
        RecoveryPointArn:
          type: string
          description: An ARN that uniquely identifies the target recovery point for scanning.; for example, arn:aws:backup:us-east-1:123456789012:recovery-point:1EB3B5E7-9EB0-435A-A80B-108B488B0D45.
        ResourceArn:
          type: string
          description: An ARN that uniquely identifies the source resource of the corresponding recovery point ARN.
        ResourceName:
          type: string
          description: The non-unique name of the resource that belongs to the specified backup.
        ResourceType:
          type: string
          enum:
          - EBS
          - EC2
          - S3
          description: 'The type of Amazon Web Services Resource to be backed up; for example, an Amazon Elastic Block Store (Amazon EBS) volume. Pattern: ^[a-zA-Z0-9\-\_\.]{1,50}$'
        ScanBaseRecoveryPointArn:
          type: string
          description: An ARN that uniquely identifies the base recovery point for scanning. This field will only be populated when an incremental scan job has taken place.
        ScanId:
          type: string
          description: The scan ID generated by Amazon GuardDuty for the corresponding Scan Job ID request from Backup.
        ScanJobId:
          type: string
          description: The scan job ID that uniquely identified the request to Backup.
        ScanMode:
          type: string
          enum:
          - FULL_SCAN
          - INCREMENTAL_SCAN
          description: Specifies the scan type used for the scan job.
        ScanResult:
          $ref: '#/components/schemas/ScanResultInfo'
        ScannerRoleArn:
          type: string
          description: Specifies the scanner IAM role ARN used to for the scan job.
        State:
          type: string
          enum:
          - CANCELED
          - COMPLETED
          - COMPLETED_WITH_ISSUES
          - CREATED
          - FAILED
          - RUNNING
          description: The current state of a scan job.
        StatusMessage:
          type: string
          description: A detailed message explaining the status of the job to back up a resource.
      required:
      - AccountId
      - BackupVaultArn
      - BackupVaultName
      - CreatedBy
      - CreationDate
      - IamRoleArn
      - MalwareScanner
      - RecoveryPointArn
      - ResourceArn
      - ResourceName
      - ResourceType
      - ScanJobId
      - ScanMode
      - ScannerRoleArn
      - State
    GetPITRMalwareScanResultsOutput:
      type: object
      properties:
        ScanEndTime:
          type: string
          description: The point in time that was queried. This echoes back the time specified in the request.
        ScanResult:
          $ref: '#/components/schemas/ScanResultInfo'
        LastScanJobTime:
          type: string
          description: The completion time of the most recent scan job that covered the specified point in time.
        ScanId:
          type: string
          description: The scan ID generated by Amazon GuardDuty for the corresponding Scan Job ID request from Backup.
        ScanMode:
          type: string
          enum:
          - FULL_SCAN
          - INCREMENTAL_SCAN
          description: Specifies the scan type used for the scan job.
      required:
      - ScanEndTime
      - ScanResult
    StartScanJobInput:
      type: object
      properties:
        BackupVaultName:
          type: string
          description: 'The name of a logical container where backups are stored. Backup vaults are identified by names that are unique to the account used to create them and the Amazon Web Services Region where they are created. Pattern: ^[a-zA-Z0-9\-\_]{2,50}$'
        ContinuousScanEndTime:
          type: string
          description: The point in time the scan job will scan up to for a continuous backup.
        IamRoleArn:
          type: string
          description: Specifies the IAM role ARN used to create the target recovery point; for example, arn:aws:iam::123456789012:role/S3Access.
        IdempotencyToken:
          type: string
          description: A customer-chosen string that you can use to distinguish between otherwise identical calls to StartScanJob. Retrying a successful request with the same idempotency token results in a success message with no action taken.
        MalwareScanner:
          type: string
          enum:
          - GUARDDUTY
          description: Specifies the malware scanner used during the scan job. Currently only supports GUARDDUTY.
        RecoveryPointArn:
          type: string
          description: An Amazon Resource Name (ARN) that uniquely identifies a recovery point. This is your target recovery point for a full scan. If you are running an incremental scan, this will be your a recovery point which has been created after your base recovery point selection.
        ScanBaseRecoveryPointArn:
          type: string
          description: An ARN that uniquely identifies the base recovery point to be used for incremental scanning.
        ScanMode:
          type: string
          enum:
          - FULL_SCAN
          - INCREMENTAL_SCAN
          description: 'Specifies the scan type use for the scan job. Includes: FULL_SCAN will scan the entire data lineage within the backup. INCREMENTAL_SCAN will scan the data difference between the target recovery point and base recovery point ARN.'
        ScannerRoleArn:
          type: string
          description: Specified the IAM scanner role ARN.
      required:
      - BackupVaultName
      - IamRoleArn
      - MalwareScanner
      - RecoveryPointArn
      - ScanMode
      - ScannerRoleArn
    ListScanJobsInput:
      type: object
      properties:
        ByAccountId:
          type: string
          description: 'The account ID to list the jobs from. Returns only backup jobs associated with the specified account ID. If used from an Amazon Web Services Organizations management account, passing * returns all jobs across the organization. Pattern: ^[0-9]{12}$'
        ByBackupVaultName:
          type: string
          description: 'Returns only scan jobs that will be stored in the specified backup vault. Backup vaults are identified by names that are unique to the account used to create them and the Amazon Web Services Region where they are created. Pattern: ^[a-zA-Z0-9\-\_\.]{2,50}$'
        ByCompleteAfter:
          type: string
          description: Returns only scan jobs completed after a date expressed in Unix format and Coordinated Universal Time (UTC).
        ByCompleteBefore:
          type: string
          description: Returns only backup jobs completed before a date expressed in Unix format and Coordinated Universal Time (UTC).
        ByMalwareScanner:
          type: string
          enum:
          - GUARDDUTY
          description: Returns only the scan jobs for the specified malware scanner. Currently only supports GUARDDUTY.
        ByRecoveryPointArn:
          type: string
          description: Returns only the scan jobs that are ran against the specified recovery point.
        ByResourceArn:
          type: string
          description: Returns only scan jobs that match the specified resource Amazon Resource Name (ARN).
        ByResourceType:
          type: string
          enum:
          - EBS
          - EC2
          - S3
          description: 'Returns restore testing selections by the specified restore testing plan name. EBSfor Amazon Elastic Block Store EC2for Amazon Elastic Compute Cloud S3for Amazon Simple Storage Service (Amazon S3) Pattern: ^[a-zA-Z0-9\-\_\.]{1,50}$'
        ByScanResultStatus:
          type: string
          enum:
          - NO_THREATS_FOUND
          - THREATS_FOUND
          - UNKNOWN
          description: 'Returns only the scan jobs for the specified scan results: THREATS_FOUND NO_THREATS_FOUND'
        ByState:
          type: string
          enum:
          - CANCELED
          - COMPLETED
          - COMPLETED_WITH_ISSUES
          - CREATED
          - FAILED
          - RUNNING
          description: Returns only the scan jobs for the specified scanning job state.
        MaxResults:
          type: integer
          description: 'The maximum number of items to be returned. Valid Range: Minimum value of 1. Maximum value of 1000.'
        NextToken:
          type: string
          description: The next item following a partial list of returned items. For example, if a request is made to return MaxResults number of items, NextToken allows you to return more items in your list starting at the location pointed to by the next token.
    DescribeScanJobInput:
      type: object
      properties:
        ScanJobId:
          type: string
          description: Uniquely identifies a request to Backup to scan a resource.
      required:
      - ScanJobId
    GetPITRMalwareScanResultsInput:
      type: object
      properties:
        RecoveryPointArn:
          type: string
          description: An ARN that uniquely identifies the target recovery point for scanning; for example, arn:aws:backup:us-east-1:123456789012:recovery-point:1EB3B5E7-9EB0-435A-A80B-108B488B0D45.
        BackupVaultName:
          type: string
          description: The name of a logical container where backups are stored. Backup vaults are identified by names that are unique to the account used to create them and the Amazon Web Services Region where they are created.
        ScanEndTime:
          type: string
          description: The point in time within the continuous backup to examine for malware scan results.
        MalwareScanner:
          type: string
          enum:
          - GUARDDUTY
          description: The scanning engine used for the corresponding scan job. Currently only GUARDDUTY is supported.
      required:
      - RecoveryPointArn
      - BackupVaultName
      - ScanEndTime
      - MalwareScanner
    ScanJob:
      type: object
      properties:
        AccountId:
          type: string
          description: The account ID that owns the scan job.
        BackupVaultArn:
          type: string
          description: An Amazon Resource Name (ARN) that uniquely identifies a backup vault; for example, arn:aws:backup:us-east-1:123456789012:backup-vault:aBackupVault.
        BackupVaultName:
          type: string
          description: The name of a logical container where backups are stored. Backup vaults are identified by names that are unique to the account used to create them and the Amazon Web Services Region where they are created.
        CompletionDate:
          type: string
          description: The date and time that a scan job is completed, in Unix format and Coordinated Universal Time (UTC). The value of CompletionDate is accurate to milliseconds. For example, the value 1516925490.087 represents Friday, January 26, 2018 12:11:30.087 AM.
        ContinuousScanEndTime:
          type: string
          description: The point in time the scan job scanned up to for a continuous backup.
        ContinuousScanStartTime:
          type: string
          description: The point in time the scan job started scan from for a continuous backup.
        CreatedBy:
          $ref: '#/components/schemas/ScanJobCreator'
        CreationDate:
          type: string
          description: The date and time that a scan job is created, in Unix format and Coordinated Universal Time (UTC). The value of CreationDate is accurate to milliseconds. For example, the value 1516925490.087 represents Friday, January 26, 2018 12:11:30.087 AM.
        IamRoleArn:
          type: string
          description: Specifies the IAM role ARN used to create the scan job; for example, arn:aws:iam::123456789012:role/S3Access.
        MalwareScanner:
          type: string
          enum:
          - GUARDDUTY
          description: The scanning engine used for the scan job. Currently only GUARDDUTY is supported.
        RecoveryPointArn:
          type: string
          description: An ARN that uniquely identifies the recovery point being scanned; for example, arn:aws:backup:us-east-1:123456789012:recovery-point:1EB3B5E7-9EB0-435A-A80B-108B488B0D45.
        ResourceArn:
          type: string
          description: An ARN that uniquely identifies the source resource of the recovery point being scanned.
        ResourceName:
          type: string
          description: The non-unique name of the resource that belongs to the specified backup.
        ResourceType:
          type: string
          enum:
          - EBS
          - EC2
          - S3
          description: The type of Amazon Web Services resource being scanned; for example, an Amazon Elastic Block Store (Amazon EBS) volume or an Amazon Relational Database Service (Amazon RDS) database.
        ScanBaseRecoveryPointArn:
          type: string
          description: An ARN that uniquely identifies the base recovery point for scanning. This field is populated when an incremental scan job has taken place.
        ScanId:
          type: string
          description: The scan ID generated by the malware scanner for the corresponding scan job.
        ScanJobId:
          type: string
          description: The unique identifier that identifies the scan job request to Backup.
        ScanMode:
          type: string
          enum:
          - FULL_SCAN
          - INCREMENTAL_SCAN
          description: 'Specifies the scan type use for the scan job. Includes: FULL_SCAN will scan the entire data lineage within the backup. INCREMENTAL_SCAN will scan the data difference between the target recovery point and base recovery point ARN.'
        ScanResult:
          $ref: '#/components/schemas/ScanResultInfo'
        ScannerRoleArn:
          type: string
          description: Specifies the scanner IAM role ARN used for the scan job.
        State:
          type: string
          enum:
          - CANCELED
          - COMPLETED
          - COMPLETED_WITH_ISSUES
          - CREATED
          - FAILED
          - RUNNING
          description: 'The current state of the scan job. Valid values: CREATED | RUNNING | COMPLETED | COMPLETED_WITH_ISSUES | FAILED | CANCELED.'
        StatusMessage:
          type: string
          description: A detailed message explaining the status of the scan job.
      required:
      - AccountId
      - BackupVaultArn
      - BackupVaultName
      - CreatedBy
      - CreationDate
      - IamRoleArn
      - MalwareScanner
      - RecoveryPointArn
      - ResourceArn
      - ResourceName
      - ResourceType
      - ScanJobId
      - ScanMode
      - ScannerRoleArn
    ListScanJobsOutput:
      type: object
      properties:
        NextToken:
          type: string
          description: The next item following a partial list of returned items. For example, if a request is made to return MaxResults number of items, NextToken allows you to return more items in your list starting at the location pointed to by the next token.
        ScanJobs:
          type: array
          items:
            $ref: '#/components/schemas/ScanJob'
          description: An array of structures containing metadata about your scan jobs returned in JSON format.
      required:
      - ScanJobs
  securitySchemes:
    sigv4:
      type: apiKey
      in: header
      name: Authorization
      description: AWS Signature Version 4. The Authorization header carries an AWS4-HMAC-SHA256 signature over the canonical request, with X-Amz-Date (and X-Amz-Security-Token for temporary credentials). Not a bearer token.
      x-aws-sigv4:
        signingName: backup
x-provenance:
  method: harvested
  publisher: Amazon Web Services
  source: https://raw.githubusercontent.com/aws/api-models-aws/582e55931c45b944739742a2c1620b6026dd2d13/models/backup/service/2018-11-15/backup-2018-11-15.json
  note: converted by smithy-to-openapi.py from AWS's Smithy model (roadmap#1001)