MCP Tools Reference: backupdr.googleapis.com

Tool: `CreateBackupVault`

Creates a new BackupVault to store backups in a given project and location.

The following sample demonstrate how to use curl to invoke the CreateBackupVault MCP tool.

Curl Request
curl --location 'https://backupdr.googleapis.com/mcp' \ --header 'content-type: application/json' \ --header 'accept: application/json, text/event-stream' \ --data '{ "method": "tools/call", "params": { "name": "CreateBackupVault", "arguments": { // provide these details according to the tool's MCP specification } }, "jsonrpc": "2.0", "id": 1 }'

Curl Request

                  
curl --location 'https://backupdr.googleapis.com/mcp' \
--header 'content-type: application/json' \
--header 'accept: application/json, text/event-stream' \
--data '{
  "method": "tools/call",
  "params": {
    "name": "CreateBackupVault",
    "arguments": {
      // provide these details according to the tool's MCP specification
    }
  },
  "jsonrpc": "2.0",
  "id": 1
}'

Input Schema

Message for creating a BackupVault.

CreateBackupVaultRequest

JSON representation
{ "parent": string, "backupVaultId": string, "backupVault": { object (`BackupVault`) }, "requestId": string, "validateOnly": boolean }

Fields
`parent`	`string` Required. Value for parent.
`backupVaultId`	`string` Required. ID of the requesting object If auto-generating ID server-side, remove this field and backup_vault_id from the method_signature of Create RPC
`backupVault`	`object (BackupVault)` Required. The resource being created
`requestId`	`string` Optional. An optional request ID to identify requests. Specify a unique request ID so that if you must retry your request, the server will know to ignore the request if it has already been completed. The server will guarantee that for at least 60 minutes since the first request. For example, consider a situation where you make an initial request and the request times out. If you make the request again with the same request ID, the server can check if original operation with the same request ID was received, and if so, will ignore the second request. This prevents clients from accidentally creating duplicate commitments. The request ID must be a valid UUID with the exception that zero UUID is not supported (00000000-0000-0000-0000-000000000000).
`validateOnly`	`boolean` Optional. Only validate the request, but do not perform mutations. The default is 'false'.

BackupVault

JSON representation

JSON representation
{ "name": string, "labels": { string: string, ... }, "state": enum (`State`), "backupCount": string, "serviceAccount": string, "totalStoredBytes": string, "uid": string, "annotations": { string: string, ... }, "accessRestriction": enum (`AccessRestriction`), // Union field `_description` can be only one of the following: "description": string // End of list of possible types for union field `_description`. // Union field `_create_time` can be only one of the following: "createTime": string // End of list of possible types for union field `_create_time`. // Union field `_update_time` can be only one of the following: "updateTime": string // End of list of possible types for union field `_update_time`. // Union field `_backup_minimum_enforced_retention_duration` can be only one of // the following: "backupMinimumEnforcedRetentionDuration": string // End of list of possible types for union field // `_backup_minimum_enforced_retention_duration`. // Union field `_backup_retention_inheritance` can be only one of the following: "backupRetentionInheritance": enum (`BackupRetentionInheritance`) // End of list of possible types for union field `_backup_retention_inheritance`. // Union field `_deletable` can be only one of the following: "deletable": boolean // End of list of possible types for union field `_deletable`. // Union field `_etag` can be only one of the following: "etag": string // End of list of possible types for union field `_etag`. // Union field `_effective_time` can be only one of the following: "effectiveTime": string // End of list of possible types for union field `_effective_time`. // Union field `_encryption_config` can be only one of the following: "encryptionConfig": { object (`EncryptionConfig`) } // End of list of possible types for union field `_encryption_config`. }

{
  "name": string,
  "labels": {
    string: string,
    ...
  },
  "state": enum (State),
  "backupCount": string,
  "serviceAccount": string,
  "totalStoredBytes": string,
  "uid": string,
  "annotations": {
    string: string,
    ...
  },
  "accessRestriction": enum (AccessRestriction),

  // Union field _description can be only one of the following:
  "description": string
  // End of list of possible types for union field _description.

  // Union field _create_time can be only one of the following:
  "createTime": string
  // End of list of possible types for union field _create_time.

  // Union field _update_time can be only one of the following:
  "updateTime": string
  // End of list of possible types for union field _update_time.

  // Union field _backup_minimum_enforced_retention_duration can be only one of
  // the following:
  "backupMinimumEnforcedRetentionDuration": string
  // End of list of possible types for union field
  // _backup_minimum_enforced_retention_duration.

  // Union field _backup_retention_inheritance can be only one of the following:
  "backupRetentionInheritance": enum (BackupRetentionInheritance)
  // End of list of possible types for union field _backup_retention_inheritance.

  // Union field _deletable can be only one of the following:
  "deletable": boolean
  // End of list of possible types for union field _deletable.

  // Union field _etag can be only one of the following:
  "etag": string
  // End of list of possible types for union field _etag.

  // Union field _effective_time can be only one of the following:
  "effectiveTime": string
  // End of list of possible types for union field _effective_time.

  // Union field _encryption_config can be only one of the following:
  "encryptionConfig": {
    object (EncryptionConfig)
  }
  // End of list of possible types for union field _encryption_config.
}

Fields

Fields
`name`	`string` Output only. Identifier. Name of the backup vault to create. It must have the format`"projects/{project}/locations/{location}/backupVaults/{backupvault}"`. `{backupvault}` cannot be changed after creation. It must be between 3-63 characters long and must be unique within the project and location.
`labels`	`map (key: string, value: string)` Optional. Resource labels to represent user provided metadata. No labels currently defined: An object containing a list of `"key": value` pairs. Example: `{ "name": "wrench", "mass": "1.3kg", "count": "3" }`.
`state`	`enum (State)` Output only. The BackupVault resource instance state.
`backupCount`	`string (int64 format)` Output only. The number of backups in this backup vault.
`serviceAccount`	`string` Output only. Service account used by the BackupVault Service for this BackupVault. The user should grant this account permissions in their workload project to enable the service to run backups and restores there.
`totalStoredBytes`	`string (int64 format)` Output only. Total size of the storage used by all backup resources.
`uid`	`string` Output only. Immutable after resource creation until resource deletion.
`annotations`	`map (key: string, value: string)` Optional. User annotations. See https://google.aip.dev/128#annotations Stores small amounts of arbitrary data. An object containing a list of `"key": value` pairs. Example: `{ "name": "wrench", "mass": "1.3kg", "count": "3" }`.
`accessRestriction`	`enum (AccessRestriction)` Optional. Note: This field is added for future use case and will not be supported in the current release. Access restriction for the backup vault. Default value is WITHIN_ORGANIZATION if not provided during creation.
Union field `_description`. `_description` can be only one of the following:
`description`	`string` Optional. The description of the BackupVault instance (2048 characters or less).
Union field `_create_time`. `_create_time` can be only one of the following:
`createTime`	`string (Timestamp format)` Output only. The time when the instance was created. Uses RFC 3339, where generated output will always be Z-normalized and use 0, 3, 6 or 9 fractional digits. Offsets other than "Z" are also accepted. Examples: `"2014-10-02T15:01:23Z"`, `"2014-10-02T15:01:23.045123456Z"` or `"2014-10-02T15:01:23+05:30"`.
Union field `_update_time`. `_update_time` can be only one of the following:
`updateTime`	`string (Timestamp format)` Output only. The time when the instance was updated. Uses RFC 3339, where generated output will always be Z-normalized and use 0, 3, 6 or 9 fractional digits. Offsets other than "Z" are also accepted. Examples: `"2014-10-02T15:01:23Z"`, `"2014-10-02T15:01:23.045123456Z"` or `"2014-10-02T15:01:23+05:30"`.
Union field `_backup_minimum_enforced_retention_duration`. `_backup_minimum_enforced_retention_duration` can be only one of the following:
`backupMinimumEnforcedRetentionDuration`	`string (Duration format)` Required. The default and minimum enforced retention for each backup within the backup vault. The enforced retention for each backup can be extended. Note: Longer minimum enforced retention period impacts potential storage costs post introductory trial. We recommend starting with a short duration of 3 days or less. A duration in seconds with up to nine fractional digits, ending with '`s`'. Example: `"3.5s"`.
Union field `_backup_retention_inheritance`. `_backup_retention_inheritance` can be only one of the following:
`backupRetentionInheritance`	`enum (BackupRetentionInheritance)` Optional. Setting for how a backup's enforced retention end time is inherited.
Union field `_deletable`. `_deletable` can be only one of the following:
`deletable`	`boolean` Output only. Set to true when there are no backups nested under this resource.
Union field `_etag`. `_etag` can be only one of the following:
`etag`	`string` Optional. Server specified ETag for the backup vault resource to prevent simultaneous updates from overwiting each other.
Union field `_effective_time`. `_effective_time` can be only one of the following:
`effectiveTime`	`string (Timestamp format)` Optional. Time after which the BackupVault resource is locked. Uses RFC 3339, where generated output will always be Z-normalized and use 0, 3, 6 or 9 fractional digits. Offsets other than "Z" are also accepted. Examples: `"2014-10-02T15:01:23Z"`, `"2014-10-02T15:01:23.045123456Z"` or `"2014-10-02T15:01:23+05:30"`.
Union field `_encryption_config`. `_encryption_config` can be only one of the following:
`encryptionConfig`	`object (EncryptionConfig)` Optional. The encryption config of the backup vault.

name

string

Output only. Identifier. Name of the backup vault to create. It must have the format"projects/{project}/locations/{location}/backupVaults/{backupvault}". {backupvault} cannot be changed after creation. It must be between 3-63 characters long and must be unique within the project and location.

labels

map (key: string, value: string)

Optional. Resource labels to represent user provided metadata. No labels currently defined:

An object containing a list of "key": value pairs. Example: { "name": "wrench", "mass": "1.3kg", "count": "3" }.

state

enum (State)

Output only. The BackupVault resource instance state.

backupCount

string (int64 format)

Output only. The number of backups in this backup vault.

serviceAccount

string

Output only. Service account used by the BackupVault Service for this BackupVault. The user should grant this account permissions in their workload project to enable the service to run backups and restores there.

totalStoredBytes

string (int64 format)

Output only. Total size of the storage used by all backup resources.

uid

string

Output only. Immutable after resource creation until resource deletion.

annotations

map (key: string, value: string)

Optional. User annotations. See https://google.aip.dev/128#annotations Stores small amounts of arbitrary data.

An object containing a list of "key": value pairs. Example: { "name": "wrench", "mass": "1.3kg", "count": "3" }.

accessRestriction

enum (AccessRestriction)

Optional. Note: This field is added for future use case and will not be supported in the current release.

Access restriction for the backup vault. Default value is WITHIN_ORGANIZATION if not provided during creation.

Union field _description.

_description can be only one of the following:

description

string

Optional. The description of the BackupVault instance (2048 characters or less).

Union field _create_time.

_create_time can be only one of the following:

createTime

string (Timestamp format)

Output only. The time when the instance was created.

Uses RFC 3339, where generated output will always be Z-normalized and use 0, 3, 6 or 9 fractional digits. Offsets other than "Z" are also accepted. Examples: "2014-10-02T15:01:23Z", "2014-10-02T15:01:23.045123456Z" or "2014-10-02T15:01:23+05:30".

Union field _update_time.

_update_time can be only one of the following:

updateTime

string (Timestamp format)

Output only. The time when the instance was updated.

Union field _backup_minimum_enforced_retention_duration.

_backup_minimum_enforced_retention_duration can be only one of the following:

backupMinimumEnforcedRetentionDuration

string (Duration format)

Required. The default and minimum enforced retention for each backup within the backup vault. The enforced retention for each backup can be extended. Note: Longer minimum enforced retention period impacts potential storage costs post introductory trial. We recommend starting with a short duration of 3 days or less.

A duration in seconds with up to nine fractional digits, ending with 's'. Example: "3.5s".

Union field _backup_retention_inheritance.

_backup_retention_inheritance can be only one of the following:

backupRetentionInheritance

enum (BackupRetentionInheritance)

Optional. Setting for how a backup's enforced retention end time is inherited.

Union field _deletable.

_deletable can be only one of the following:

deletable

boolean

Output only. Set to true when there are no backups nested under this resource.

Union field _etag.

_etag can be only one of the following:

etag

string

Optional. Server specified ETag for the backup vault resource to prevent simultaneous updates from overwiting each other.

Union field _effective_time.

_effective_time can be only one of the following:

effectiveTime

string (Timestamp format)

Optional. Time after which the BackupVault resource is locked.

Union field _encryption_config.

_encryption_config can be only one of the following:

encryptionConfig

object (EncryptionConfig)

Optional. The encryption config of the backup vault.

LabelsEntry

JSON representation
{ "key": string, "value": string }

Fields
`key`	`string`
`value`	`string`

Timestamp

JSON representation
{ "seconds": string, "nanos": integer }

Fields

Fields
`seconds`	`string (int64 format)` Represents seconds of UTC time since Unix epoch 1970-01-01T00:00:00Z. Must be between -62135596800 and 253402300799 inclusive (which corresponds to 0001-01-01T00:00:00Z to 9999-12-31T23:59:59Z).
`nanos`	`integer` Non-negative fractions of a second at nanosecond resolution. This field is the nanosecond portion of the duration, not an alternative to seconds. Negative second values with fractions must still have non-negative nanos values that count forward in time. Must be between 0 and 999,999,999 inclusive.

seconds

string (int64 format)

Represents seconds of UTC time since Unix epoch 1970-01-01T00:00:00Z. Must be between -62135596800 and 253402300799 inclusive (which corresponds to 0001-01-01T00:00:00Z to 9999-12-31T23:59:59Z).

nanos

integer

Non-negative fractions of a second at nanosecond resolution. This field is the nanosecond portion of the duration, not an alternative to seconds. Negative second values with fractions must still have non-negative nanos values that count forward in time. Must be between 0 and 999,999,999 inclusive.

Duration

JSON representation
{ "seconds": string, "nanos": integer }

Fields

Fields
`seconds`	`string (int64 format)` Signed seconds of the span of time. Must be from -315,576,000,000 to +315,576,000,000 inclusive. Note: these bounds are computed from: 60 sec/min * 60 min/hr * 24 hr/day * 365.25 days/year * 10000 years
`nanos`	`integer` Signed fractions of a second at nanosecond resolution of the span of time. Durations less than one second are represented with a 0 `seconds` field and a positive or negative `nanos` field. For durations of one second or more, a non-zero value for the `nanos` field must be of the same sign as the `seconds` field. Must be from -999,999,999 to +999,999,999 inclusive.

seconds

string (int64 format)

Signed seconds of the span of time. Must be from -315,576,000,000 to +315,576,000,000 inclusive. Note: these bounds are computed from: 60 sec/min * 60 min/hr * 24 hr/day * 365.25 days/year * 10000 years

nanos

integer

Signed fractions of a second at nanosecond resolution of the span of time. Durations less than one second are represented with a 0 seconds field and a positive or negative nanos field. For durations of one second or more, a non-zero value for the nanos field must be of the same sign as the seconds field. Must be from -999,999,999 to +999,999,999 inclusive.

AnnotationsEntry

JSON representation
{ "key": string, "value": string }

Fields
`key`	`string`
`value`	`string`

EncryptionConfig

JSON representation
{ // Union field `_kms_key_name` can be only one of the following: "kmsKeyName": string // End of list of possible types for union field `_kms_key_name`. }

Fields

Fields
Union field `_kms_key_name`. `_kms_key_name` can be only one of the following:
`kmsKeyName`	`string` Optional. The Cloud KMS key name to encrypt backups in this backup vault. Must be in the same region as the vault. Some workload backups like compute disk backups may use their inherited source key instead. Format: projects/{project}/locations/{location}/keyRings/{ring}/cryptoKeys/{key}

Union field _kms_key_name.

_kms_key_name can be only one of the following:

kmsKeyName

string

Optional. The Cloud KMS key name to encrypt backups in this backup vault. Must be in the same region as the vault. Some workload backups like compute disk backups may use their inherited source key instead. Format: projects/{project}/locations/{location}/keyRings/{ring}/cryptoKeys/{key}

BackupRetentionInheritance

How a backup's enforced retention end time is inherited.

Enums

BACKUP_RETENTION_INHERITANCE_UNSPECIFIED Inheritance behavior not set. This will default to INHERIT_VAULT_RETENTION.

Enums
`BACKUP_RETENTION_INHERITANCE_UNSPECIFIED`	Inheritance behavior not set. This will default to `INHERIT_VAULT_RETENTION`.
`INHERIT_VAULT_RETENTION`	The enforced retention end time of a backup will be inherited from the backup vault's `backup_minimum_enforced_retention_duration` field. This is the default behavior.
`MATCH_BACKUP_EXPIRE_TIME`	The enforced retention end time of a backup will always match the expire time of the backup. If this is set, the backup's enforced retention end time will be set to match the expire time during creation of the backup. When updating, the ERET and expire time must be updated together and have the same value. Invalid update requests will be rejected by the server.

INHERIT_VAULT_RETENTION

The enforced retention end time of a backup will be inherited from the backup vault's backup_minimum_enforced_retention_duration field.

This is the default behavior.

MATCH_BACKUP_EXPIRE_TIME

The enforced retention end time of a backup will always match the expire time of the backup.

If this is set, the backup's enforced retention end time will be set to match the expire time during creation of the backup. When updating, the ERET and expire time must be updated together and have the same value. Invalid update requests will be rejected by the server.

State

Holds the state of the backup vault resource.

Enums
`STATE_UNSPECIFIED`	State not set.
`CREATING`	The backup vault is being created.
`ACTIVE`	The backup vault has been created and is fully usable.
`DELETING`	The backup vault is being deleted.
`ERROR`	The backup vault is experiencing an issue and might be unusable.
`UPDATING`	The backup vault is being updated.

AccessRestriction

Holds the access restriction for the backup vault.

Enums
`ACCESS_RESTRICTION_UNSPECIFIED`	Access restriction not set. If user does not provide any value or pass this value, it will be changed to WITHIN_ORGANIZATION.
`WITHIN_PROJECT`	Access to or from resources outside your current project will be denied.
`WITHIN_ORGANIZATION`	Access to or from resources outside your current organization will be denied.
`UNRESTRICTED`	No access restriction.
`WITHIN_ORG_BUT_UNRESTRICTED_FOR_BA`	Access to or from resources outside your current organization will be denied except for backup appliance.

Output Schema

This resource represents a long-running operation that is the result of a network API call.

Operation

JSON representation

JSON representation
{ "name": string, "metadata": { "@type": string, field1: ..., ... }, "done": boolean, // Union field `result` can be only one of the following: "error": { object (`Status`) }, "response": { "@type": string, field1: ..., ... } // End of list of possible types for union field `result`. }

{
  "name": string,
  "metadata": {
    "@type": string,
    field1: ...,
    ...
  },
  "done": boolean,

  // Union field result can be only one of the following:
  "error": {
    object (Status)
  },
  "response": {
    "@type": string,
    field1: ...,
    ...
  }
  // End of list of possible types for union field result.
}

Fields
`name`	`string` The server-assigned name, which is only unique within the same service that originally returns it. If you use the default HTTP mapping, the `name` should be a resource name ending with `operations/{unique_id}`.
`metadata`	`object` Service-specific metadata associated with the operation. It typically contains progress information and common metadata such as create time. Some services might not provide such metadata. Any method that returns a long-running operation should document the metadata type, if any. An object containing fields of an arbitrary type. An additional field `"@type"` contains a URI identifying the type. Example: `{ "id": 1234, "@type": "types.example.com/standard/id" }`.
`done`	`boolean` If the value is `false`, it means the operation is still in progress. If `true`, the operation is completed, and either `error` or `response` is available.
Union field `result`. The operation result, which can be either an `error` or a valid `response`. If `done` == `false`, neither `error` nor `response` is set. If `done` == `true`, exactly one of `error` or `response` can be set. Some services might not provide the result. `result` can be only one of the following:
`error`	`object (Status)` The error result of the operation in case of failure or cancellation.
`response`	`object` The normal, successful response of the operation. If the original method returns no data on success, such as `Delete`, the response is `google.protobuf.Empty`. If the original method is standard `Get`/`Create`/`Update`, the response should be the resource. For other methods, the response should have the type `XxxResponse`, where `Xxx` is the original method name. For example, if the original method name is `TakeSnapshot()`, the inferred response type is `TakeSnapshotResponse`. An object containing fields of an arbitrary type. An additional field `"@type"` contains a URI identifying the type. Example: `{ "id": 1234, "@type": "types.example.com/standard/id" }`.

Any

JSON representation
{ "typeUrl": string, "value": string }

Fields

Fields
`typeUrl`	`string` Identifies the type of the serialized Protobuf message with a URI reference consisting of a prefix ending in a slash and the fully-qualified type name. Example: type.googleapis.com/google.protobuf.StringValue This string must contain at least one `/` character, and the content after the last `/` must be the fully-qualified name of the type in canonical form, without a leading dot. Do not write a scheme on these URI references so that clients do not attempt to contact them. The prefix is arbitrary and Protobuf implementations are expected to simply strip off everything up to and including the last `/` to identify the type. `type.googleapis.com/` is a common default prefix that some legacy implementations require. This prefix does not indicate the origin of the type, and URIs containing it are not expected to respond to any requests. All type URL strings must be legal URI references with the additional restriction (for the text format) that the content of the reference must consist only of alphanumeric characters, percent-encoded escapes, and characters in the following set (not including the outer backticks): `/-.~_!$&()*+,;=`. Despite our allowing percent encodings, implementations should not unescape them to prevent confusion with existing parsers. For example, `type.googleapis.com%2FFoo` should be rejected. In the original design of `Any`, the possibility of launching a type resolution service at these type URLs was considered but Protobuf never implemented one and considers contacting these URLs to be problematic and a potential security issue. Do not attempt to contact type URLs.
`value`	`string (bytes format)` Holds a Protobuf serialization of the type described by type_url. A base64-encoded string.

typeUrl

string

Identifies the type of the serialized Protobuf message with a URI reference consisting of a prefix ending in a slash and the fully-qualified type name.

Example: type.googleapis.com/google.protobuf.StringValue

This string must contain at least one / character, and the content after the last / must be the fully-qualified name of the type in canonical form, without a leading dot. Do not write a scheme on these URI references so that clients do not attempt to contact them.

The prefix is arbitrary and Protobuf implementations are expected to simply strip off everything up to and including the last / to identify the type. type.googleapis.com/ is a common default prefix that some legacy implementations require. This prefix does not indicate the origin of the type, and URIs containing it are not expected to respond to any requests.

All type URL strings must be legal URI references with the additional restriction (for the text format) that the content of the reference must consist only of alphanumeric characters, percent-encoded escapes, and characters in the following set (not including the outer backticks): /-.~_!$&()*+,;=. Despite our allowing percent encodings, implementations should not unescape them to prevent confusion with existing parsers. For example, type.googleapis.com%2FFoo should be rejected.

In the original design of Any, the possibility of launching a type resolution service at these type URLs was considered but Protobuf never implemented one and considers contacting these URLs to be problematic and a potential security issue. Do not attempt to contact type URLs.

value

string (bytes format)

Holds a Protobuf serialization of the type described by type_url.

A base64-encoded string.

Status

JSON representation
{ "code": integer, "message": string, "details": [ { "@type": string, field1: ..., ... } ] }

Fields

Fields
`code`	`integer` The status code, which should be an enum value of `google.rpc.Code`.
`message`	`string` A developer-facing error message, which should be in English. Any user-facing error message should be localized and sent in the `google.rpc.Status.details` field, or localized by the client.
`details[]`	`object` A list of messages that carry the error details. There is a common set of message types for APIs to use. An object containing fields of an arbitrary type. An additional field `"@type"` contains a URI identifying the type. Example: `{ "id": 1234, "@type": "types.example.com/standard/id" }`.

code

integer

The status code, which should be an enum value of google.rpc.Code.

message

string

A developer-facing error message, which should be in English. Any user-facing error message should be localized and sent in the google.rpc.Status.details field, or localized by the client.

details[]

object

A list of messages that carry the error details. There is a common set of message types for APIs to use.

An object containing fields of an arbitrary type. An additional field "@type" contains a URI identifying the type. Example: { "id": 1234, "@type": "types.example.com/standard/id" }.

Tool Annotations

Destructive Hint: ❌ | Idempotent Hint: ❌ | Read Only Hint: ❌ | Open World Hint: ❌

MCP Tools Reference: backupdr.googleapis.com Stay organized with collections Save and categorize content based on your preferences.

Tool: CreateBackupVault

Input Schema

CreateBackupVaultRequest

BackupVault

LabelsEntry

Timestamp

Duration

AnnotationsEntry

EncryptionConfig

BackupRetentionInheritance

State

AccessRestriction

Output Schema

Operation

Any

Status

Tool Annotations

MCP Tools Reference: backupdr.googleapis.com

Tool: `CreateBackupVault`