Security Admin users can generate and download backup files. If you would prefer these actions to be performed by a more restricted account, for example if you are calling the APIs from a scheduled task, you can create a dedicated backup user. Backup users are users with the BACKUP_USER privilege, who can create, download, and view backups in both the webGUI and the API. Users who only have this role do not have any other admin access, and cannot access any other restricted APIs.
To create a user with the BACKUP_USER privilege, use a curl command similar to the following:
v=$(curl -s -k -d 'username=secroot&password=<password>' https://<IP-address>/v5/kc/login/ | jq .access_token| sed -e 's/"//g'); echo $v
curl -s -k https://<IP-address/v5/users/?access_token=$v -H 'Content-type: application/json' -d '{"email":"<backup@example.com>", "full_name":"<backup>", "login_name":"<backup@example.com>", "privileges":["BACKUP_USER"], "account_enable":"Active"}' | tee qqq | jq .Where:
- <password> is the password for the secroot user.
<IP-address> is the IP address for your Cryptographic Security Platform Vault.
<backup@example.com> is the email address to be used by the backup user.
<backup> is the full name of the backup user.