Developers

API Reference.

A small, predictable REST API over your backups, restores, schedules, jobs and storage. JSON in, JSON out. Everything you can do in the dashboard, you can automate here.

authentication sources backups storage schedules jobs cli

Authentication

Every request is authenticated with an API key issued from your dashboard under API keys. Pass it as a Bearer token. Keys are scoped to a single organization and carry that org's full access — treat them like passwords.

Base URL: https://xbackupman.com
Header: Authorization: Bearer xbm_…

# Every endpoint expects the same header
curl https://xbackupman.com/api/v1/sources \
  -H "Authorization: Bearer xbm_xxxxxxxxxxxxxxxxxxxxxxxx"

# Missing or invalid key →
{ "error": "Unauthorized" }   // 401

Sources

GET/api/v1/sources

List every backup source in your organization.

Example response

{
  "connections": [{ "id": "…", "name": "production-pg", "type": "postgres" }],
  "files":       [{ "id": "…", "name": "app-server" }],
  "wordpress":   [{ "id": "…", "name": "marketing-site" }]
}

curl

curl https://xbackupman.com/api/v1/sources \
  -H "Authorization: Bearer $XBM_API_KEY"

Backups

GET/api/v1/backups

List completed backups, most recent first (max 100).

Example response

{
  "backups": [
    { "id": "…", "objectKey": "org/…/db.sql.gz",
      "sizeBytes": 44892160, "createdAt": "2026-07-15T02:00:00.000Z" }
  ]
}

curl

curl https://xbackupman.com/api/v1/backups \
  -H "Authorization: Bearer $XBM_API_KEY"

POST/api/v1/backups

Trigger a backup of a source. Returns the queued job.

Request body

{ "type": "connection" | "file" | "wordpress", "id": "<source-uuid>" }

Example response

{ "jobId": "…", "status": "pending" }   // 202

curl

curl -X POST https://xbackupman.com/api/v1/backups \
  -H "Authorization: Bearer $XBM_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{ "type": "connection", "id": "<source-uuid>" }'

POST/api/v1/backups/{id}/restore

Restore a backup onto a target. Overwrites the target — requires confirm:true.

Request body

{ "target": "db:<id>" | "file:<id>" | "wp:<id>", "confirm": true }

Example response

{ "jobId": "…" }   // 202

curl

curl -X POST https://xbackupman.com/api/v1/backups/<backup-id>/restore \
  -H "Authorization: Bearer $XBM_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{ "target": "db:<connection-id>", "confirm": true }'

POST/api/v1/backups/{id}/verify

Re-download a backup and re-check its SHA-256 checksum.

Example response

{ "jobId": "…" }   // 202

curl

curl -X POST https://xbackupman.com/api/v1/backups/<backup-id>/verify \
  -H "Authorization: Bearer $XBM_API_KEY"

Storage

GET/api/v1/storage

List your storage targets (no secrets are returned).

Example response

{
  "targets": [
    { "id": "…", "name": "prod-r2", "bucket": "backups",
      "endpoint": "https://…r2.cloudflarestorage.com", "region": "auto" }
  ]
}

curl

curl https://xbackupman.com/api/v1/storage \
  -H "Authorization: Bearer $XBM_API_KEY"

Schedules

GET/api/v1/schedules

List your backup schedules.

Example response

{
  "schedules": [
    { "id": "…", "cron": "0 2 * * *", "retentionDays": 30, "enabled": true }
  ]
}

curl

curl https://xbackupman.com/api/v1/schedules \
  -H "Authorization: Bearer $XBM_API_KEY"

POST/api/v1/schedules

Create a schedule. Cron cadence and retention are bounded by your plan.

Request body

{ "source": "db:<id>" | "file:<id>" | "wp:<id>",
  "storageTargetId": "<uuid>", "cron": "0 2 * * *", "retentionDays": 30 }

Example response

{ "id": "…" }   // 201

curl

curl -X POST https://xbackupman.com/api/v1/schedules \
  -H "Authorization: Bearer $XBM_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{ "source": "db:<connection-id>", "storageTargetId": "<target-id>",
       "cron": "0 2 * * *", "retentionDays": 30 }'

DELETE/api/v1/schedules/{id}

Delete a schedule you own.

Example response

{ "ok": true }

curl

curl -X DELETE https://xbackupman.com/api/v1/schedules/<schedule-id> \
  -H "Authorization: Bearer $XBM_API_KEY"

Jobs

GET/api/v1/jobs

List recent jobs, newest first. limit defaults to 20, capped at 100.

Request body

Query: ?limit=20

Example response

{
  "jobs": [
    { "id": "…", "kind": "backup", "status": "done",
      "createdAt": "2026-07-15T02:00:00.000Z" }
  ]
}

curl

curl "https://xbackupman.com/api/v1/jobs?limit=20" \
  -H "Authorization: Bearer $XBM_API_KEY"

GET/api/v1/jobs/{id}

Fetch a single job's full detail.

Example response

{
  "id": "…", "kind": "backup", "status": "done", "error": null,
  "createdAt":  "2026-07-15T02:00:00.000Z",
  "startedAt":  "2026-07-15T02:00:01.000Z",
  "finishedAt": "2026-07-15T02:00:12.000Z"
}

curl

curl https://xbackupman.com/api/v1/jobs/<job-id> \
  -H "Authorization: Bearer $XBM_API_KEY"

CLI

Command line (xbm)

The xbm CLI is a thin wrapper over this API. Configure it with two environment variables and it talks to the same endpoints.

XBM_API_KEY: Required. Your xbm_ key from the dashboard.
XBM_API_URL: Optional. Defaults to https://xbackupman.com.

export XBM_API_KEY=xbm_xxxxxxxxxxxxxxxxxxxxxxxx
export XBM_API_URL=https://xbackupman.com   # optional

xbm sources	List your backup sources
xbm backups	List completed backups
xbm backup <type> <id>	Trigger a backup (type: connection \| file \| wordpress)
xbm jobs	List recent jobs
xbm restore <backup-id> <target>	Restore a backup onto a target
xbm verify <backup-id>	Verify a backup's checksum
xbm schedules	List backup schedules
xbm storage	List storage targets
xbm download <backup-id>	Download a decrypted backup artifact
xbm local backup <path...> --to <dest>	Standalone: encrypt & back up local files (no account)
xbm local restore <archive> --into <dir>	Standalone: decrypt & restore an archive
xbm local schedule <path...> --to <dest>	Print a cron / Task Scheduler entry
xbm agent enroll --name <name>	Enroll a server with your account (needs XBM_API_KEY)
xbm agent backup <path...> --name <label>	Agent: encrypt local data with your org key → your storage
xbm agent restore <objectKey> --into <dir>	Agent: download & decrypt an agent backup

← Back to xbackupman