Security Admin users can generate and download backup files. If you would prefer these actions to be performed by a more restricted account, for example if you are calling the APIs from a scheduled task, you can create a dedicated backup user. Backup users are users with the BACKUP_USER privilege. They can create, download, and view backups through the API. Users assigned only this privilege do not have administrative access and cannot access other restricted APIs.

In Compliance Manager, backup users can be created only through the API.

To create a user with the BACKUP_USER privilege, complete the following steps:

1. Create a backup user with a temporary password using:
   
   v=$(curl -s -k -d 'username=secroot&password=<password>' https://<IP-address>/v5/kc/login/ | jq .access_token| sed -e 's/"//g'); echo $v

   curl -s -k https://<IP-address>/v5/users/?access_token=$v -H 'Content-type: application/json' -d '{"email":"backup@example.com", "full_name":"<backup>", "login_name":"backup@example.com", "privileges":["BACKUP_USER"], "account_enable":"Active"}' | tee qqq | jq .
   
   

   Where: 

   • <password> is the password for the secroot user.

   • <IP-address> is the IP address for your Cryptographic Security Platform Compliance Manager.

   • <backup@example.com> is the email address to be used by the backup user.

   • <backup> is the full name of the backup user.

2. Rotate the password by using the following API with the authentication token that was created using the temporary password.

   curl --location 'https://<IP-address>/v5/login_edit/' \

   --header 'Auth-Token: <auth token>' \

   --header 'Content-Type: application/json' \

   --header 'Cookie: <cookie>' \

   --data-raw '{

   "username": "backup@example.com",

   "password": "<password>"

   }'

   The backup user can now use the updated password to list, download, and create backups through the API. Backup users cannot log in to the Compliance Manager WebUI.