Minimum platform API permissions to use pro backup command

[cameron-kay]

What are the minimum platform API permissions to use pro backup command

[neilmartin83]

The resources that are backed up by default are here:

jamf-cli/internal/commands/pro_resources.go

Lines 36 to 84 in f2e07db

	var BackupResources = []BackupResource{
	// Policies
	{Key: "classic-policies", FilterName: "policies", SubDir: "policies"},
	// Configuration profiles (no modern equivalent for CRUD)
	{Key: "classic-macos-config-profiles", FilterName: "profiles", SubDir: "profiles/macos"},
	{Key: "classic-mobile-config-profiles", FilterName: "profiles", SubDir: "profiles/ios"},
	// Scripts
	{Key: "scripts", FilterName: "scripts", SubDir: "scripts"},
	// Extension attributes — modern for computer + mobile, classic only for user
	{Key: "computer-extension-attributes", FilterName: "extension-attributes", SubDir: "extension-attributes/computer"},
	{Key: "mobile-device-extension-attributes", FilterName: "extension-attributes", SubDir: "extension-attributes/mobile"},
	{Key: "classic-user-ext-attrs", FilterName: "extension-attributes", SubDir: "extension-attributes/user"},
	// Computer groups — modern v2 endpoints (separate smart/static avoids the
	// deprecated /v1/computer-groups combined endpoint that triggers 403s on
	// role configurations without the legacy umbrella privilege).
	{Key: "smart-computer-groups", FilterName: "smart-groups", SubDir: "smart-groups/computers"},
	{Key: "static-computer-groups", FilterName: "static-groups", SubDir: "static-groups/computers"},
	// Mobile device groups
	{Key: "mobile-device-groups-smart-groups", FilterName: "smart-groups", SubDir: "smart-groups/mobile"},
	{Key: "mobile-device-groups-static-groups", FilterName: "static-groups", SubDir: "static-groups/mobile"},
	// Supporting objects (modern preferred)
	{Key: "categories", FilterName: "categories", SubDir: "categories"},
	{Key: "buildings", FilterName: "buildings", SubDir: "buildings"},
	{Key: "departments", FilterName: "departments", SubDir: "departments"},
	// Sites have no per-ID detail endpoint — the list response is the full
	// record, so each site is written directly without a fan-out fetch.
	{Key: "sites", FilterName: "sites", SubDir: "sites", ListOnly: true},
	// Packages, printers, dock items — classic only
	{Key: "classic-packages", FilterName: "packages", SubDir: "packages"},
	{Key: "classic-printers", FilterName: "printers", SubDir: "printers"},
	{Key: "classic-dock-items", FilterName: "dock-items", SubDir: "dock-items"},
	// Network + security config — classic only
	{Key: "classic-network-segments", FilterName: "network-segments", SubDir: "network-segments"},
	{Key: "classic-restricted-software", FilterName: "restricted-software", SubDir: "restricted-software"},
	{Key: "classic-disk-encryption-configs", FilterName: "disk-encryption", SubDir: "disk-encryption"},
	{Key: "classic-patch-titles", FilterName: "patch-titles", SubDir: "patch-titles"},
	// Administration — accounts (users + groups, split by classic list_subset)
	{Key: "classic-account-users", FilterName: "accounts", SubDir: "accounts/users"},
	{Key: "classic-account-groups", FilterName: "accounts", SubDir: "accounts/groups"},
	}

Roughly translated, that's:

Read on:

• Policies
• macOS Configuration Profiles
• Mobile Device Configuration Profiles
• Scripts
• Computer Extension Attributes
• Mobile Device Extension Attributes
• User Extension Attributes
• Smart Computer Groups
• Static Computer Groups
• Smart Mobile Device Groups
• Static Mobile Device Groups
• Categories
• Buildings
• Departments
• Sites
• Packages
• Printers
• Dock Items
• Network Segments
• Restricted Software
• Disk Encryption Configurations
• Patch Management Software Titles
• Jamf Pro User Accounts & Groups