Connect cloud accounts

Automate AWS onboarding end to end: deploy the account-level CloudFormation stack, install the Elastio Cloud Connector in the regions you want, link the AWS accounts whose assets it should protect, and watch each step until it is live. You can also list the Azure subscriptions, GCP projects, IBM scopes and OVA accounts already connected to your tenant.

Before you begin

A personal access token with access to deployments and inventory. The install, link, upgrade and vault calls change your deployment, so the token needs write access. See Authentication.
The 12-digit AWS account ID of your connector account: the account where the Cloud Connector runs.
The 12-digit IDs of any asset accounts: AWS accounts whose resources the connector should inventory and hunt. The connector account can also be an asset account.

How AWS onboarding fits together

The deployment endpoints imply this order:

Pick regions. GET /gateway/shared-services/v1/deployments/supported-aws-regions returns the region names you can deploy to.
Deploy the account-level stack. GET /gateway/shared-services/v1/deployments/cloudformation-link returns a link to the CloudFormation template. You deploy it in AWS yourself, then call POST /gateway/shared-services/v1/deployments/discover-installed-cfn to have Elastio check for the stack.
Optionally set the install flow. PATCH …/aws-accounts/{aws_account_id}/connector-account-install-flow adds regions to autoinstall and can turn on VPC permissions in the generated templates.
Install the Cloud Connector. POST /gateway/shared-services/v1/deployments/red-stacks installs a Cloud Connector in one or more regions, in an Elastio-defined network or in a VPC you pick from GET …/deployments/aws-vpcs.
Link asset accounts. POST /gateway/shared-services/v1/deployments/asset-accounts/link registers an AWS account as an asset account of the connector account and schedules a regional deployment job for each region.
Watch status. GET …/deployments/red-stacks and GET …/deployments/asset-accounts report the state of each connector and region stack.

Removal runs in reverse: delete each asset region stack, unlink the asset account, then deactivate and delete the Cloud Connector.

Deploy and verify the CloudFormation stack

Get the template link for your connector account. Pass account_id to get a link tailored to that account; omit it for a generic, account-agnostic template.

GET

/gateway/shared-services/v1/deployments/cloudformation-linkGet link to CloudFormation template (S3)

Try it

curl "https://acme.app.elastio.com/gateway/shared-services/v1/deployments/cloudformation-link?account_id=123456789012" \
  -H "Authorization: Bearer $ELASTIO_TOKEN"

import os, requests

BASE = "https://acme.app.elastio.com"
HEADERS = {"Authorization": f"Bearer {os.environ['ELASTIO_TOKEN']}"}

resp = requests.get(
    f"{BASE}/gateway/shared-services/v1/deployments/cloudformation-link",
    headers=HEADERS, params={"account_id": "123456789012"}, timeout=30,
)
resp.raise_for_status()
print(resp.json()["link"])

$Base = "https://acme.app.elastio.com"
$Headers = @{ Authorization = "Bearer $env:ELASTIO_TOKEN" }
(Invoke-RestMethod -Uri "$Base/gateway/shared-services/v1/deployments/cloudformation-link?account_id=123456789012" -Headers $Headers).link

{ "link": "https://….s3.amazonaws.com/…/template.yaml" }

Deploy the template in the connector account with your usual AWS tooling. Then ask Elastio to look for the stack:

POST

/gateway/shared-services/v1/deployments/discover-installed-cfnDiscover installed CloudFormation stack for an AWS account

Try it

curl -X POST "https://acme.app.elastio.com/gateway/shared-services/v1/deployments/discover-installed-cfn" \
  -H "Authorization: Bearer $ELASTIO_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{ "aws_account_id": "123456789012" }'

resp = requests.post(
    f"{BASE}/gateway/shared-services/v1/deployments/discover-installed-cfn",
    headers=HEADERS, json={"aws_account_id": "123456789012"}, timeout=30,
)
resp.raise_for_status()
result = resp.json()
print(result["status"], result["is_installed"])

$Body = @{ aws_account_id = "123456789012" } | ConvertTo-Json
Invoke-RestMethod -Method Post -Uri "$Base/gateway/shared-services/v1/deployments/discover-installed-cfn" `
  -Headers $Headers -ContentType "application/json" -Body $Body

{
  "is_installed": true,
  "status": "installed",
  "description": {
    "arn": "arn:aws:cloudformation:us-east-1:123456789012:stack/…",
    "region": "us-east-1"
  }
}

status is one of not_installed, installed, installing, update_required, updating or unknown. Continue when it reads installed.

Install the Cloud Connector

Install a Cloud Connector in each region you want to protect. For each region set safety_lock and, optionally, a VPC and subnets. If you omit vpc_id, Elastio uses its own VPC and subnets and subnet_ids must be empty. If you set vpc_id, list at least one subnet in that VPC. To see the VPCs and subnets in a region, call GET /gateway/shared-services/v1/deployments/aws-vpcs?account_id=…&region_name=….

POST

/gateway/shared-services/v1/deployments/red-stacksInstall the Cloud Connector

Try it

curl -X POST "https://acme.app.elastio.com/gateway/shared-services/v1/deployments/red-stacks" \
  -H "Authorization: Bearer $ELASTIO_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{
    "account_id": "123456789012",
    "regions": [
      { "region": "us-east-1", "safety_lock": true },
      { "region": "eu-west-1", "safety_lock": true, "vpc_id": "vpc-0a1b2c3d", "subnet_ids": ["subnet-0aa11bb22cc33dd44"] }
    ]
  }'

body = {
    "account_id": "123456789012",
    "regions": [
        {"region": "us-east-1", "safety_lock": True},
        {"region": "eu-west-1", "safety_lock": True, "vpc_id": "vpc-0a1b2c3d", "subnet_ids": ["subnet-0aa11bb22cc33dd44"]},
    ],
}
resp = requests.post(f"{BASE}/gateway/shared-services/v1/deployments/red-stacks", headers=HEADERS, json=body, timeout=30)
resp.raise_for_status()
print(resp.json()["jobs_ids"])

$Body = @{
    account_id = "123456789012"
    regions = @(
        @{ region = "us-east-1"; safety_lock = $true },
        @{ region = "eu-west-1"; safety_lock = $true; vpc_id = "vpc-0a1b2c3d"; subnet_ids = @("subnet-0aa11bb22cc33dd44") }
    )
} | ConvertTo-Json -Depth 5
Invoke-RestMethod -Method Post -Uri "$Base/gateway/shared-services/v1/deployments/red-stacks" `
  -Headers $Headers -ContentType "application/json" -Body $Body

{ "jobs_ids": ["3f2e1d0c-9b8a-4c7d-8e6f-5a4b3c2d1e0f", "7a6b5c4d-3e2f-4a1b-9c0d-8e7f6a5b4c3d"] }

Check connector status

List Cloud Connectors to see each connector’s status (active, inactive, deleted, upgrade_required or unknown), its version, and its support.state (current, update_available, support_ending, unsupported or unknown). Results use page_size (1–500, default 50) and a zero-based page_index.

GET

/gateway/shared-services/v1/deployments/red-stacksList Cloud Connectors

Try it

curl "https://acme.app.elastio.com/gateway/shared-services/v1/deployments/red-stacks?page_size=100&page_index=0" \
  -H "Authorization: Bearer $ELASTIO_TOKEN"

resp = requests.get(
    f"{BASE}/gateway/shared-services/v1/deployments/red-stacks",
    headers=HEADERS, params={"page_size": 100, "page_index": 0}, timeout=30,
)
resp.raise_for_status()
for rs in resp.json()["red_stacks"]:
    print(rs["aws_account"], rs["aws_region"], rs["status"], rs.get("version"))

$Stacks = Invoke-RestMethod -Uri "$Base/gateway/shared-services/v1/deployments/red-stacks?page_size=100&page_index=0" -Headers $Headers
$Stacks.red_stacks | Select-Object aws_account, aws_region, status, version

{
  "red_stacks": [
    {
      "red_stack_id": "rs-…",
      "account_alias": "security-tooling",
      "aws_account": "123456789012",
      "aws_region": "us-east-1",
      "status": "active",
      "version": "0.41.68",
      "details": { "deployment_type": "elastio_managed" },
      "cfn_upgrade_required": false,
      "support": { "state": "current", "minors_behind": 0, "latest_available_version": "0.41.68" }
    }
  ],
  "total": 1
}

To move an Elastio-managed connector to a newer version, read GET …/aws-accounts/{aws_account_id}/upgrade-plan and send its target_version with the regions to POST …/aws-accounts/{aws_account_id}/upgrade. If the plan has moved on since you read it, the upgrade call returns 409 and you must read the plan again. Self-managed connectors don’t upgrade this way: after you apply a new version with Terraform, call POST …/red-stacks/{red_stack_id}/rescan to refresh the connector so Elastio picks up the version.

Link an asset account

Link each AWS account whose resources the connector should protect. Elastio schedules one regional deployment job per region and returns them in linking_jobs.

POST

/gateway/shared-services/v1/deployments/asset-accounts/linkLink an asset account to a connector account

Try it

curl -X POST "https://acme.app.elastio.com/gateway/shared-services/v1/deployments/asset-accounts/link" \
  -H "Authorization: Bearer $ELASTIO_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{ "asset_account_id": "210987654321", "connector_account_id": "123456789012" }'

body = {"asset_account_id": "210987654321", "connector_account_id": "123456789012"}
resp = requests.post(f"{BASE}/gateway/shared-services/v1/deployments/asset-accounts/link", headers=HEADERS, json=body, timeout=30)
resp.raise_for_status()
for job in resp.json()["linking_jobs"]:
    print(job["region"], job.get("asset_region_stack_deployment_job", {}).get("human_readable_cc_job_id"))

$Body = @{ asset_account_id = "210987654321"; connector_account_id = "123456789012" } | ConvertTo-Json
$Link = Invoke-RestMethod -Method Post -Uri "$Base/gateway/shared-services/v1/deployments/asset-accounts/link" `
  -Headers $Headers -ContentType "application/json" -Body $Body
$Link.linking_jobs

{
  "linking_jobs": [
    {
      "region": "us-east-1",
      "asset_region_stack_deployment_job": {
        "job_id": "c1d2e3f4-a5b6-4c7d-8e9f-0a1b2c3d4e5f",
        "cc_job_id": "…",
        "human_readable_cc_job_id": "j-01m09zvyyfcgx4ynp40x4e4rej"
      }
    }
  ]
}

Then check the asset account’s region stacks. Each one reports status.type: install_pending, install_failed, linked, deletion_pending, deletion_failed or unknown, with error_message when something failed.

GET

/gateway/shared-services/v1/deployments/asset-accountsList deployment asset accounts

Try it

curl "https://acme.app.elastio.com/gateway/shared-services/v1/deployments/asset-accounts?account_id=210987654321" \
  -H "Authorization: Bearer $ELASTIO_TOKEN"

resp = requests.get(
    f"{BASE}/gateway/shared-services/v1/deployments/asset-accounts",
    headers=HEADERS, params={"account_id": "210987654321"}, timeout=30,
)
resp.raise_for_status()
for acct in resp.json()["asset_accounts"]:
    for rs in acct["region_stacks"]:
        print(acct["aws_account_id"], rs["aws_region"], rs["status"]["type"], rs["status"].get("error_message", ""))

$Accounts = Invoke-RestMethod -Uri "$Base/gateway/shared-services/v1/deployments/asset-accounts?account_id=210987654321" -Headers $Headers
$Accounts.asset_accounts | ForEach-Object {
    $acct = $_
    $acct.region_stacks | ForEach-Object { "{0} {1} {2}" -f $acct.aws_account_id, $_.aws_region, $_.status.type }
}

{
  "asset_accounts": [
    {
      "id": "…",
      "aws_account_id": "210987654321",
      "connector_aws_account_id": "123456789012",
      "alias": "payments-prod",
      "description": "",
      "stack_region": "us-east-1",
      "version": "0.41.68",
      "created_at": "2026-10-12T08:01:00Z",
      "updated_at": "2026-10-12T08:09:40Z",
      "region_stacks": [
        {
          "id": "…",
          "aws_region": "us-east-1",
          "cloud_connector_id": "…",
          "version": "0.41.68",
          "status": { "type": "linked" },
          "created_at": "2026-10-12T08:01:00Z",
          "updated_at": "2026-10-12T08:09:40Z"
        }
      ]
    }
  ]
}

To give the account a friendly name, PATCH /gateway/shared-services/v1/deployments/aws-accounts/{aws_account_id} with account_alias and description.

To remove an asset account, first delete each region stack with DELETE …/asset-accounts/{asset_account_id}/region-stacks/{region}, then call POST …/asset-accounts/{asset_account_id}/unlink. Unlinking fails with a precondition error while any region stack still exists, and you can’t delete a stack while it is install_pending or deletion_pending.

After an account is linked, GET /gateway/api/v1/asset-accounts lists the asset accounts attached to a given connector account and region, and POST /gateway/api/v1/aws/inventory-scans asks the connector to refresh its inventory right away. The inventory refresh is admin-only and limited to one successful call per hour for each tenant, connector and asset account.

Manage vaults

Vaults live in a Cloud Connector (red_stack_id) and store Elastio recovery points. List them, optionally filtered by aws_account_id and aws_region (repeat a parameter to match several values):

GET

/gateway/shared-services/v1/vaultsList vaults

Try it

curl "https://acme.app.elastio.com/gateway/shared-services/v1/vaults?aws_account_id=123456789012&aws_region=us-east-1" \
  -H "Authorization: Bearer $ELASTIO_TOKEN"

resp = requests.get(
    f"{BASE}/gateway/shared-services/v1/vaults", headers=HEADERS,
    params={"aws_account_id": "123456789012", "aws_region": "us-east-1"}, timeout=30,
)
resp.raise_for_status()
for v in resp.json()["vaults"]:
    print(v["name"], v["region"], v["is_default"], v["recovery_points_count"])

(Invoke-RestMethod -Uri "$Base/gateway/shared-services/v1/vaults?aws_account_id=123456789012&aws_region=us-east-1" -Headers $Headers).vaults |
  Select-Object name, region, is_default, safety_lock, recovery_points_count

{
  "total_count": 1,
  "vaults": [
    {
      "id": "…",
      "name": "default",
      "account_id": "123456789012",
      "region": "us-east-1",
      "red_stack_id": "rs-…",
      "is_default": true,
      "safety_lock": true,
      "assets_count": 42,
      "recovery_points_count": 1280,
      "clean_recovery_points_count": 1274,
      "contaminated_recovery_points_count": 6,
      "soft_deleted": false,
      "version": "0.41.68"
    }
  ]
}

To create a vault, POST /gateway/shared-services/v1/vaults with an aws_vault_create object (red_stack_id, vault_name, vault_kms_key, safety_lock, set_default, subnet_ids, optional vpc_id). The response returns a job_id. PATCH /gateway/shared-services/v1/vaults/{vault_id} changes the description, safety lock or network placement. POST /gateway/shared-services/v1/vaults/destroy with aws_vault_destroy (red_stack_id, vault_name) removes a vault.

List Azure, GCP, IBM and OVA accounts

The published API has read-only lists for accounts on other platforms. It doesn’t document how to connect them. GET /gateway/shared-services/v1/deployments/scan-clusters lists the standalone clusters (Azure, IBM, GCP and on-prem) registered to your tenant.

Platform	Endpoint	Returns
Azure	`GET /gateway/api/v1/azure-subscriptions`	Subscriptions with `state` (`enabled`, `warned`, `past_due`, `disabled`, `deleted`) and tags
Azure	`GET /gateway/api/v1/azure-subscriptions/{subscriptionId}`	One subscription plus its `resource_groups`
GCP	`GET /gateway/api/v1/gcp-projects`	Live projects; `project_id` is the asset account ID
IBM	`GET /gateway/api/v1/ibm-scopes`	Distinct IBM COS bucket scopes, as strings
OVA	`GET /gateway/api/v1/ova-accounts`	OVA accounts with `id` and `name`

GET

/gateway/api/v1/azure-subscriptionsList all Azure subscriptions

Try it

curl "https://acme.app.elastio.com/gateway/api/v1/azure-subscriptions" \
  -H "Authorization: Bearer $ELASTIO_TOKEN"

resp = requests.get(f"{BASE}/gateway/api/v1/azure-subscriptions", headers=HEADERS, timeout=30)
resp.raise_for_status()
for sub in resp.json()["data"]:
    print(sub["id"], sub["name"], sub["state"])

(Invoke-RestMethod -Uri "$Base/gateway/api/v1/azure-subscriptions" -Headers $Headers).data |
  Select-Object id, name, state

{
  "status": 200,
  "message": "OK",
  "data": [
    {
      "id": "00000000-1111-2222-3333-444444444444",
      "name": "Production",
      "state": "enabled",
      "azure_tenant_id": "aaaaaaaa-bbbb-cccc-dddd-eeeeeeeeeeee",
      "tags": [{ "key": "cost-center", "value": "1001" }],
      "created_at": "2026-01-15T12:00:00Z",
      "updated_at": "2026-10-10T09:30:00Z"
    }
  ]
}

All endpoints