How AI is applied across API Evangelist and APIs.io. Read my AI disclosure →
API Evangelist API Evangelist
Discovery
Learnings
Guidance
Toolbox
Alignment
API Evangelist LLC
Discovery
Learnings
Guidance
Toolbox
Alignment
API Evangelist LLC

Need help?

Contact us
Druva

Druva Cyber Resilience API

The Realize API for Druva Cyber Resilience. Accelerated Ransomware Recovery quarantine ranges and snapshots, curated snapshot jobs, threat hunting, threat intel IOC sets and lookup, threat watch, unusual data activity anomaly detection, restore scans and the Realize event stream.

Documentation Provider Profile APIs.io OpenAPI GitHub

Druva Cyber Resilience API is one of 21 APIs that Druva publishes on the APIs.io network, described by a machine-readable OpenAPI specification.

Tagged areas include Cyber Resilience, Ransomware Recovery, Threat Hunting, Threat Intel, and Curated Snapshots. The published artifact set on APIs.io includes an OpenAPI specification and API documentation.

This API exposes 62 operations across 49 paths, organized into 8 resource areas, and defines 106 schemas. It is described by OpenAPI 3.0.0, at version 3.0.0.

Requests are made against a single base URL, https://apis.druva.com/realize.

62 operations 49 paths 106 schemas 6 DELETE42 GET1 PATCH7 POST6 PUT

Metadata

The identity and technical contract details declared by the specification.

Specification
OpenAPI 3.0.0
API Version
3.0.0
Base URL
https://apis.druva.com/realize
Authentication
OAuth 2.0, API Key
Resource Areas
8

Authentication & Security 2

Druva Cyber Resilience API declares 2 security schemes for authenticating requests. It supports OAuth 2.0 (OAuth2) using the clientCredentials flow, exposing 1 scope. An API key is passed in the header as Authorization (Bearer).

Paths & Operations 62

Across 49 paths, the API surfaces 62 operations — 6 DELETE, 42 GET, 1 PATCH, 7 POST, 6 PUT. They span 8 resource areas: Ransomware Recovery, Data Anomalies, Restore scans, Realize Events, Curated Snapshots, Threat Hunting, Threat Watch, Threat Intel. Each is listed below with its method, path, parameters, and response codes.

Ransomware Recovery 13

List of APIs to get information and perform operations on ransomware affected resources managed in Druva Cloud.

GET
/ransomwarerecovery/v1/search/resource
Search for infected resources
4 params → 200400401404500
POST
/ransomwarerecovery/v1/quarantineranges/resource/{resourceID}
Quarantine snapshots on a resource - v1
1 param body → 200400401404500
GET
/ransomwarerecovery/v1/quarantineranges
Lists all quarantine ranges - v1
9 params → 200400401404500
GET
/ransomwarerecovery/v1/quarantineranges/resource/{resourceID}/range/{rangeID}
Get details of a quarantine range - v1
2 params → 200400401404500
PUT
/ransomwarerecovery/v1/quarantineranges/resource/{resourceID}/range/{rangeID}
Update the quarantine range - v1
2 params body → 200400401404500
DELETE
/ransomwarerecovery/v1/quarantineranges/resource/{resourceID}/range/{rangeID}
Delete a quarantine range - v1
2 params → 200400401404500
GET
/ransomwarerecovery/v1/snapshots/resource/{resourceID}/range/{rangeID}
List all snapshots - v1
3 params → 200400401404500
DELETE
/ransomwarerecovery/v1/snapshots/resource/{resourceID}/range/{rangeID}/snapshot/{snapshotID}
Delete a snapshot - v1
3 params body → 200400401404500
GET
/ransomwarerecovery/v2/quarantineranges
Lists all resources with at least one quarantined snapshot, filtered by query parameters - v2
5 params → 200400401404500
POST
/ransomwarerecovery/v2/quarantineranges/resource/{resourceID}
Creates provided quarantine ranges - v2
1 param body → 200400401404500
PUT
/ransomwarerecovery/v2/quarantineranges/resource/{resourceID}
Creates / Updates / Deletes provided quarantine ranges - v2
1 param body → 200400401404500
GET
/ransomwarerecovery/v2/quarantineranges/resource/{resourceID}
Lists details of specific resource ID which is present in quarantine bay - v2
3 params → 200400401404500
GET
/ransomwarerecovery/v2/snapshots/resource/{resourceID}
Lists all snapshots quarantined for a given resource - v2
8 params → 200400401404500
Data Anomalies 1

View a list of the resources managed in Druva Cloud detected with Data Anomalies.

GET
/uda/v1/stats/{workload}/resources/{resourceID}
List snapshot statistics
3 params → 200400401404500
Restore scans 6

List of APIs to get information and perform operations of Restore scans on the resources managed in Druva Cloud.

GET
/rwc/v1/settings
Lists all the current settings.
→ 200400401500
PUT
/rwc/v1/settings
Save the current settings.
body → 200400401500
GET
/rwcscanmaster/v1/jobs
Lists all the Restore scans jobs.
7 params → 200400401500
GET
/rwcscanmaster/v1/jobs/{JobID}
Lists the details of Restore scans job.
1 param → 200400401500
GET
/rwcscanmaster/v1/jobs/{JobID}/report
Lists the details of the affected or skipped files in the Restore scans job.
4 params → 200400401500
GET
/rwcscanmaster/v1/jobs/count
List count of restore scan jobs
1 param → 200400401500
Realize Events 2

List of APIs to get information of Events of Realize product in Druva Cloud.

GET
/eventmanagement/v1/events
Lists all Realize Events.
ListEvents 1 param → 200400401404500
GET
/eventmanagement/v1/events/tracker
Lists specific events according to the tracker ID.
ListEventsByTracker 3 params → 200400401404500
Curated Snapshots 7

List of APIs to get information of and manage the Curated Snapshots for the resources managed in Druva Cloud.

POST
/curatedsnapshot/v1/jobs
Create a new Curated Snapshot.
body → 200400401404500
GET
/curatedsnapshot/v1/jobs
List all the Curated Snapshot Jobs.
7 params → 200400401404500
GET
/curatedsnapshot/v1/jobs/{jobID}
List the details of the Curated Snapshot job.
1 param → 200400401404500
PUT
/curatedsnapshot/v1/jobs/cancel
Cancel the ongoing Curated Snapshot job.
body → 200400401404500
GET
/curatedsnapshot/v1/jobs/{JobID}/report
Download Report of Curated Snapshot job.
3 params → 200400401404500
GET
/curatedsnapshot/v1/snapshots
List all the Curated Snapshots.
7 params → 200400401404500
DELETE
/curatedsnapshot/v1/snapshots
Delete the Curated Snapshot.
body → 200400401404500
Threat Hunting 16

List of APIs to get information and perform operations on the resources managed in Druva Cloud for threat hunt.

POST
/threathunting/v1/search/backupset
Search resources for VMware resource type
body → 200400401404500
POST
/threathunting/v1/threathunts
Create a threat hunt
body → 200400401404500
GET
/threathunting/v1/threathunts
List all threat hunts
5 params → 200400401404500
PUT
/threathunting/v1/threathunts/{threatHuntID}/cancel
Cancel a threat hunt
1 param → 200400401404500
DELETE
/threathunting/v1/threathunts/{threatHuntID}
Delete a threat hunt
1 param body → 200400401404500
GET
/threathunting/v1/threathunts/{threatHuntID}
List threat hunt configuration details
1 param → 200400401404500
GET
/threathunting/v1/threathunts/{threatHuntID}/summary
Get threat hunt summary for a specific threat hunt
1 param → 200400401404500
GET
/threathunting/v1/threathunts/{threatHuntID}/devices
Lists the devices that are a part of a Threat Hunt job.
2 params → 200400401404500
GET
/threathunting/v1/threathunts/{threatHuntID}/devices/stats
List statistics of devices configured for threat hunt
3 params → 200400401404500
GET
/threathunting/v1/threathunts/{threatHuntID}/devices/{deviceID}
Get resource details for a specific threat hunt
3 params → 200400401404500
GET
/threathunting/v1/threathunts/{threatHuntID}/devices/{deviceID}/stats
Get device statistics for a specific threat hunt
3 params → 200400401404500
GET
/threathunting/v1/threathunts/{threatHuntID}/devices/{deviceID}/snapshots
List impacted snapshots for a specific threat hunt
4 params → 200400401404500
GET
/threathunting/v1/threathunts/{threatHuntID}/report
Download a report
3 params → 200400401404500
GET
/common/v1/search/aws/awsaccounts
Search AWS Accounts
1 param → 200400401404500
GET
/common/v1/search/aws/resourceids
List AWS Resources
3 params → 200400401404500
POST
/common/v1/search/aws/resources
Search AWS Resources
body → 200400401404500
Threat Watch 9

List of APIs that helps to retrieve information and perform operations on Threat Watch. Threat Watch is an automated continuous monitoring feature that scans resources for threats…

GET
/threathunting/v1/threatwatch/config
Get Threat Watch configuration details
→ 200400401404500
PUT
/threathunting/v1/threatwatch/config
Update Threat Watch configuration
body → 200400401404500
GET
/threathunting/v1/threatwatch/devices
Lists Threat Watch impacted devices
3 params → 200400401404500
GET
/threathunting/v1/threatwatch/devices/{deviceID}
Get Threat Watch device details
2 params → 200400401404500
GET
/threathunting/v1/threatwatch/devices/{deviceID}/stats
Get Threat Watch device statistics
2 params → 200400401404500
GET
/threathunting/v1/threatwatch/impacteddevices/stats
Get Impacted Devices Statistics
2 params → 200400401404500
GET
/threathunting/v1/threatwatch/iocs
Lists IOC Sets and impacted details for each IOC Set
3 params → 200400401404500
GET
/threathunting/v1/threatwatch/reports/{snapshotID}
Downloads Threat Watch snapshot report
3 params → 200400401404500
GET
/threathunting/v1/threatwatch/scans
List Threat Watch Scans
2 params → 200400401404500
Threat Intel 8

List of APIs to view details and manage IOC Sets in the IOC library.

GET
/threatintel/v1/ioc-sets
Listing of IOC Sets
ListIocSetRequest 6 params → 200400401404500
POST
/threatintel/v1/ioc-sets
Creates a new IOC Set
CreateIOCSetRequest body → 200400401404500
GET
/threatintel/v1/ioc-sets/iocs
Lists all the IOCs that matches the specified parameters
GetIOCsRequest 7 params → 200400401404500
GET
/threatintel/v1/ioc-sets/{iocsetid}
Details of IOC Set
IocSetDetailsRequest 1 param → 200400401404500
DELETE
/threatintel/v1/ioc-sets/{iocsetid}
Delete an existing IOC Set
DeleteIocSetRequest 1 param body → 200400401404500
PATCH
/threatintel/v1/ioc-sets/{iocsetid}
Updates existing IOC Set
UpdateIocSetRequest 1 param body → 200400401404500
DELETE
/threatintel/v1/ioc-sets/{iocsetid}/iocs
Deletes IOCs from IOC Set
DeleteIocsRequest 1 param body → 200400401404500
GET
/threatintel/v1/ioc/lookup
Check if the specified IOC exists in any of the existing IOC Sets
IocLookupRequest 1 param → 200400401404500

Schemas 106

The contract defines 106 schemas that model the data the API accepts and returns. The most detailed are jobDetailsModel (43 properties), ThreatHunt (17 properties), listResourceCverStats (16 properties), ThreatHuntScanSummaryResponse (14 properties). Each schema is shown below with its type and property counts.

searchResponse
object
3 properties
quarantineRangeCreateRequest
object
4 properties 1 required
quarantineRangeUpdateRequest
object
2 properties
quarantineRangeCreateResponse
object
1 property
quarantineRangeListResponse
object
4 properties
quarantineRangeGetResponse
object
12 properties
snapshotListResponse
object
3 properties
deleteSnapshotSchema
object
1 property
listResourceCverStats
object
16 properties
SettingsResponse
object
11 properties
SettingsRequest
object
11 properties
jobListModel
object
3 properties
jobDetailsModel
object
43 properties
jobFilesDetailsResponse
object
3 properties
getJobCount
object
2 properties
ListEventsResponse
object
2 properties 2 required
ListEventsByTrackerResponse
object
2 properties 2 required
EventFilters
object
1 property
CSJobCreationParams
object
10 properties 3 required
CSJobCreationResponse
object
2 properties
JobCreationError
object
2 properties
Resource
object
6 properties
JobModelError
object
3 properties
CSJobCancelResponse
object
1 property
CSGetJobResponse
object
2 properties
CSListJobResponse
object
3 properties
CSListSnapshotsResponse
object
3 properties
CSExpireSnapshotsResponse
object
1 property
CSJobCancelParams
object
1 property
CSDeleteParams
object
2 properties 1 required
CSReportResponse
object
3 properties
HTTP_400
object
4 properties
HTTP_404
object
4 properties
HTTP_422
object
4 properties
HTTP_500
object
The request was not processed due to an internal error in Druva Cloud. Kindly try again after some time.
4 properties
ErrorResponse
object
4 properties
RWC_HTTP_400
object
4 properties
RWC_HTTP_404
object
4 properties
RWC_HTTP_500
object
The request was not processed due to an internal error in Druva Cloud. Kindly try again after some time.
4 properties
CS_HTTP_400
object
4 properties
CS_HTTP_404
object
4 properties
CS_HTTP_500
object
The request was not processed due to an internal error in Druva Cloud. Kindly try again after some time.
4 properties
RR_HTTP_400
object
4 properties
RR_HTTP_404
object
4 properties
RR_HTTP_500
object
The request was not processed due to an internal error in Druva Cloud. Kindly try again after some time.
4 properties
ThreatHuntSearchBackupsetResponse
object
2 properties
ThreatHuntSearchBackupsetParams
object
5 properties
ThreatHuntDownloadReportResponse
object
1 property
ThreatHuntListImpactedSnapshotsResponse
object
6 properties
ThreatHuntGetDeviceStatsResponse
object
13 properties
ThreatHuntGetDeviceDetailsResponse
object
10 properties
ThreatHuntListDevicesStatsResponse
object
3 properties
ThreatHuntListDevicesResponse
object
4 properties
ThreatHuntCreateResponse
object
3 properties
ThreatHuntCreateParams
object
9 properties
ThreatHuntScanSummaryResponse
object
14 properties
ThreatHuntJobDeleteParams
object
1 property
ThreatHuntListResponse
object
3 properties
ThreatHunt
object
17 properties
ThreatHuntJobCancelResponse
object
2 properties
ThreatHuntGetResponse
object
13 properties
ThreatHunt_HTTP_400
object
4 properties
ThreatHunt_HTTP_404
object
4 properties
ThreatHunt_HTTP_500
object
The request was not processed due to an internal error in Druva Cloud. Kindly try again after some time.
4 properties
ThreatWatchConfigResponse
object
2 properties
ThreatWatchConfigUpdateParams
object
1 property 1 required
ThreatWatchConfigUpdateResponse
object
2 properties
ThreatWatchDevicesResponse
object
3 properties
ThreatWatchDeviceDetailsResponse
object
10 properties
ThreatWatchDeviceStatsResponse
object
8 properties
ThreatWatchImpactedDevicesStatsResponse
object
4 properties
ThreatWatchIOCsResponse
object
3 properties
ThreatWatchReportResponse
object
1 property
ThreatWatchScansResponse
object
2 properties
ThreatWatch_HTTP_400
object
4 properties
ThreatWatch_HTTP_404
object
4 properties
ThreatWatch_HTTP_500
object
The request was not processed due to an internal error in Druva Cloud. Kindly try again after some time.
4 properties
SearchAWSAccountsResponse
array
ListResourceIDsResponse
array
SearchAWSResourcesParams
object
6 properties
SearchAWSResourcesResponse
object
2 properties
RealizeCommon_HTTP_400
object
4 properties
RealizeCommon_HTTP_404
object
4 properties
RealizeCommon_HTTP_500
object
The request was not processed due to an internal error in Druva Cloud. Kindly try again after some time.
4 properties
CreateIOCSetRequestBody
object
5 properties 3 required
DeleteIocSetBody
object
1 property
DeleteIocSetResponse
object
DeleteIocsRequestBody
object
2 properties
DeleteIocsResponse
object
GetIOCsResponse
object
3 properties
IOCDetails
object
7 properties
IOCSetResponse
object
IOCSetResponse is the response structure of successful ioc create request
5 properties
IocLookupResponse
object
1 property
IocSetDetailsResponse
object
9 properties
IocSetForLookup
object
6 properties
ListIocSetDetails
object
11 properties
ListIocSetResponse
object
4 properties
UpdateIocSetRequestBody
object
UpdateIocSetRequestBody is the request structure to handle IOC set create request
4 properties
TI_HTTP_400
object
4 properties
TI_HTTP_404
object
4 properties
TI_HTTP_500
object
The request was not processed due to an internal error in Druva Cloud. Kindly try again after some time.
4 properties
listQuarantinedResourcesResponseSchema
object
2 properties
listDetailsOfQuarantinedResourceResponseSchema
object
10 properties
createQuarantineRangeV2ResponseSchema
object
1 property
createQuarantineRangeV2RequestSchema
object
3 properties
listAllQuarantinedSnapshotsForResourceResponseSchema
object
1 property

Specification

The full machine-readable OpenAPI contract behind this narrative.

Source

druva-cyber-resilience-openapi.json Raw ↑

Other APIs Druva publishes across the network.

Druva Authentication API
AE Profile APIs.io
Druva MSP Authentication API
AE Profile APIs.io
Druva GovCloud Authentication API
AE Profile APIs.io
Druva Hybrid Workloads GovCloud Authentication API
AE Profile APIs.io
Druva Endpoints and Data Governance API
AE Profile APIs.io
Druva Endpoints and Data Governance GovCloud API
AE Profile APIs.io
Druva Enterprise Workloads API
AE Profile APIs.io
Druva Enterprise Workloads GovCloud API
AE Profile APIs.io
Druva Cyber Resilience GovCloud API
AE Profile APIs.io
Druva GovCloud Cyber Resilience Authorization API
AE Profile APIs.io
Druva CloudRanger Native Workloads API
AE Profile APIs.io
Druva AWS Native Workloads API
AE Profile APIs.io
#Cyber Resilience#Ransomware Recovery#Threat Hunting#Threat Intel#Curated Snapshots#Event
← Back to D APIs
API Details
ID
druva:cyber-resilience
Base URL
https://apis.druva.com/realize
Docs
https://developer.druva.com
Provider
Druva
APIs.io →  GitHub →
Explore more
All APIs Providers APIs.io Network
Work with this as data

Every API here is available over the API and to AI agents over MCP. APIs is not yet its own endpoint on the v1 API. Reach this content through network search and the tag graph, or the MCP server below.

Installs https://mcp.apievangelist.com/mcp in Claude, Cursor, VS Code and the rest — one button, every client.

MCP tools for apis
4 tools reach this content
  • search_api_evangelistSearch every content type across the network at once.
  • find_relatedThe shared-tag relevance graph — what else covers this.
  • get_tagEverything one tag labels, across all content types.
  • guide_topicPRO — a curated bundle for a topic: area, guidance, rules, papers, stories, services.
All tools & prompts
Call it yourself
curl for this page
Search the network for this 
curl "https://api.apievangelist.com/v1/search?q=cyber-resilience&limit=10"
Everything under a tag 
curl "https://api.apievangelist.com/v1/tags/cyber-resilience"

Discovery needs no key. Full bodies and the synthesis endpoints are Pro.

Get an API key

Free tier, no email required. Sign in with whichever identity you already have.

GitHub Google LinkedIn

A second provider on the same verified email joins the account you already have. Your account

Where this information came from

This is an independent, third-party profile of Druva Cyber Resilience API, published by API Evangelist. We do not operate, host, resell, or support these APIs, and we are not affiliated with or endorsed by the company unless stated above. Everything here is built from publicly available information — the company's own site, developer portal, documentation, public repositories, and the specifications it publishes for public use. Nothing is obtained by breaching a system, defeating an access control, or using credentials.

The Kin Score and Agent Readiness rating are independently calculated assessments of a company's public API artifacts, scored against a published rubric. They are not certifications, endorsements, security assessments, or audits.

Corrections, re-scores, and removal are free — no partnership or purchase required, and you do not need to justify the request. A removed company is recorded as unrated, never scored zero for having asked. Acknowledgement within one business day; removal within two.

info@apievangelist.com · Read the full data-sourcing policy →
On a security or compliance team? Put security in the subject line and you will get a person, not a form — we will tell you exactly which public URLs this profile was built from.