Windows Backup Results to Backup Radar

Overview

This workflow connects Windows-hosted backup platforms to Backup Radar using a dependency-free PowerShell adapter.

It converts verified backup, replication, verification, boot-verification, and backup-agent health signals into rich Backup Radar results containing the client, device, job, status, completion time, notes, byte counts, provider information, and optional metadata.

Use this workflow when a backup platform can run a command or expose a trustworthy completion status but does not have a native Backup Radar integration.

This is a community-built reference implementation. Test it against the exact backup-agent version and execution identity used in your environment.

Prerequisites

Windows PowerShell 5.1 or PowerShell 7+
A Backup Radar API key
A US or EU Backup Radar tenant
Client, device, and job names that Backup Radar can match
A backup platform hook or command that exposes a reliable result status
Permission to deploy and run PowerShell scripts on the protected Windows machine

How to use

1. Download the adapter

Download the repository from GitHub and copy it to a stable local path, such as:

C:\ProgramData\BackupRadar\
  Send-BackupRadarResult.ps1
  examples\

Provider hooks may run under SYSTEM or another service account and may start in C:\Windows\System32. Always configure the provider with an absolute script path.

Download Link: https://github.com/chrisdaysie/br-ps

2. Secure the Backup Radar API key

Create the encrypted API-key file while logged in as the same Windows identity that will run the backup hook:

$keyFile = Join-Path $env:ProgramData 'BackupRadar\api-key.dpapi'

New-Item -ItemType Directory -Path (Split-Path $keyFile) -Force | Out-Null

Read-Host 'Backup Radar API key' -AsSecureString |
  ConvertFrom-SecureString |
  Set-Content -Path $keyFile

$account = [System.Security.Principal.WindowsIdentity]::GetCurrent().Name

icacls.exe $keyFile /inheritance:r /grant:r "${account}:(R)" 'SYSTEM:(F)'

The encrypted key can only be decrypted by the Windows account that created it on that machine. Provision it again if the execution identity changes.

For development or testing, the adapter can also read the BACKUP_RADAR_API_KEY environment variable.

3. Preview the request

Use -WhatIf -Verbose to validate the inputs and preview the endpoint and JSON payload without loading the API key or sending a request:

.\Send-BackupRadarResult.ps1 `
  -DeviceName 'SERVER01' `
  -JobName 'Nightly image backup' `
  -ClientName 'Example Co' `
  -Provider 'Example Backup Agent' `
  -WhatIf -Verbose

4. Configure the backup-platform hook

Configure the backup product to call the adapter only after the result has been verified.

Recommended provider patterns:

MSP360: Use a success-only post-backup action.
Veeam Agent: Use the included wrapper and map provider exit codes to Backup Radar statuses.
Acronis Cyber Protect Cloud and Cove Data Protection: Use explicit status-gating logic. Do not send a success result from a generic “after backup” action unless the provider confirms that the job succeeded.

A command running after a backup does not automatically prove that the backup completed successfully.

5. Send a rich backup result

.\Send-BackupRadarResult.ps1 `
  -DeviceName $env:COMPUTERNAME `
  -JobName 'Nightly image backup' `
  -ClientName 'Example Co' `
  -Status success `
  -ResultType backups `
  -Time ([DateTime]::UtcNow) `
  -Notes 'Synthetic full completed', 'Repository health check passed' `
  -DataSelected 29230000 `
  -DataTransferred 19304000 `
  -Provider 'Example Backup Agent' `
  -Metadata @{
    agent_version = '7.4.1'
    policy = 'nightly'
    repository = 'immutable-01'
  }

For an EU Backup Radar tenant, add:

-Region eu

6. Map other result types

| Backup event | Result type | |---|---| | Backup job | backups | | Replication or copy job | replications | | Verification job | verifications | | Boot or recovery test | boot_verifications | | Backup-agent health or alert | alerts |

Use one of the following statuses:

success
warning
failure

7. Test and verify

Run the repository’s dependency-free test from the repository root:

.\tests\Test-Send-BackupRadarResult.ps1

Then test a controlled successful, warning, and failed result from the actual provider execution context. Confirm that the results appear under the correct Backup Radar client, device, and job.

Operational guidance

Capture the script’s exit code and standard error output in the provider or RMM job.
HTTP 202 Accepted means Backup Radar accepted the result for asynchronous processing.
Avoid blindly retrying timeouts or server errors because an ambiguous request could create duplicate results.
Do not place the API key directly in the script or provider command line.
At MSP scale, consider using an RMM secret workflow or MSP-controlled relay instead of distributing a tenant-wide API key to every endpoint.

Resources

Support note

This adapter is a community-built reference implementation and is not an officially supported ScalePad integration. Validate it in a test environment before deploying it across production clients.