acronis

Acronis MCP Tools & API Patterns

Overview

Acronis Cyber Protect Cloud is a multi-tenant backup, disaster recovery and endpoint protection platform. MSPs run it as a partner tenant with one customer tenant per client. The Conduit connector wraps Acronis's own MCP server and exposes a curated set of 37 tools. Tool names are acronis_ plus the Acronis operation name, such as acronis_fetch_all_alerts.

Connection & Authentication

Conduit sends three headers to the Acronis connector:

Header	Conduit field	Value
X-Acronis-Base-Url	Data center URL	The data center Acronis shows when you create the API client, such as https://us5-cloud.acronis.com. Origin only: nothing after .com.
X-Acronis-Client-Id	Client ID	The API client's ID
X-Acronis-Client-Secret	Client Secret	The API client's secret

You enter these fields once in the Conduit web UI (/connect/acronis). Conduit stores them and injects the headers on every request; nothing is set on the client, and Conduit drops any X-Acronis-* header a client sends.

How to get them:

1. In the Acronis management portal, open Settings → API clients.
2. Create an API client. Copy the Client ID, the Secret and the data center URL that Acronis shows. The secret is only shown once.
3. Don't use your Acronis portal email and password. Conduit needs an API client, which signs in with the OAuth client_credentials flow.

When you connect, Conduit checks the data center URL (it must be https on an acronis.com host) and does a real token exchange with Acronis, so a wrong secret or the wrong data center fails at connect time, not on the first tool call.

What the connection can see

• Everyone in your Conduit org shares this one connection.
• The API client sees only the tenant that owns it and the tenants under it. An API client created in the partner tenant sees every customer. One created inside a customer tenant sees only that customer.

Tenant Hierarchy

Partner (the MSP) → [Folder] → Customer (a client) → [Unit]

Almost every read filters by a tenant UUID. The parameter name differs by API family, which is the most common source of empty results:

API family	Tenant parameter
Account management (tenants, users, usage, MFA)	tenant_id in path, or parent_id / subtree_root_id / uuids in query
Alerts	tenant (an array) in query; per-customer tools use customer_id
Policies, resources, protection status	tenant_id in query
Agents	tenant_id in query, meaning a subtree root
EDR incidents	customer_id in query

Tool Surface

All tools are listed directly. There is no navigation step.

Area	Tools
Tenants and users	acronis_fetch_tenant, acronis_fetch_tenants_batch, acronis_fetch_tenant_children, acronis_fetch_tenant_users, acronis_fetch_users_batch, acronis_fetch_user, acronis_fetch_current_user_info, acronis_search, acronis_fetch_tenant_mfa_status, acronis_fetch_tenant_usages
Alerts	acronis_fetch_all_alerts, acronis_fetch_alert, acronis_fetch_categories, acronis_fetch_alert_counters, acronis_fetch_alerts_grouped_by_scope, acronis_fetch_all_alert_types, acronis_fetch_resources_with_top_severity_alerts, acronis_fetch_alert_counts_per_customer, acronis_fetch_alerts_grouped_per_customer, acronis_fetch_active_alert_count
Protection policies (protection plans)	acronis_fetch_policies, acronis_fetch_policy, acronis_fetch_policy_applications, acronis_fetch_applications_issue_statistics, acronis_fetch_application_statuses_by_policy
Resources (machines, mailboxes, workloads)	acronis_fetch_resources, acronis_fetch_resource_count, acronis_fetch_resource, acronis_fetch_resource_protection_status
Agents	acronis_fetch_agents, acronis_fetch_agent
EDR incidents	acronis_fetch_incidents, acronis_fetch_incident, acronis_fetch_response_action_status
Writes (off by default)	acronis_mark_alert_as_false_positive, acronis_update_investigation_state, acronis_execute_protection_policy

Writes and Conduit permission tiers

The three write tools are off by default. They don't appear in the tool list until WYRE turns writes on for the Acronis connector. When they are on, Conduit gates them by permission tier:

Tool	Conduit tier	What it changes
All 34 reads	read	Nothing
acronis_mark_alert_as_false_positive	write	Sets or clears the false-positive flag on an alert, for everyone in Acronis
acronis_update_investigation_state	write	Changes an EDR incident's investigation state or adds a comment
acronis_execute_protection_policy	admin	Runs a protection plan now on every machine it covers, starting backup or protection jobs

If a write tool is missing from the tool list, writes are off. Say so plainly and give the operator the console path instead of looking for a workaround.

Not available through this connector

Creating or deleting tenants, users or API clients, any delete, pricing and offering items, registration tokens, branding, and starting EDR response actions (such as isolating a machine) are not exposed at all. Reading the status of a response action that was started in the console is available through acronis_fetch_response_action_status.

Argument Shape

Arguments are grouped the way the Acronis REST API groups them: path for URL path parameters, query for query-string filters, and body for write payloads. A few tools also take headers.

{
  "path": { "tenant_id": "0f8fad5b-d9cb-469f-a165-70867728950e" },
  "query": { "embed_path": true }
}

Tenant, user and policy IDs are lowercase UUIDs. Several filters take a comma-separated list of up to 100 UUIDs in one string, such as uuids on acronis_fetch_tenants_batch and tenant_id on acronis_fetch_resources.

Pagination

Each Acronis API family pages differently. Check for a next cursor before you say a list is complete.

Tools	How to page
acronis_fetch_tenants_batch, acronis_fetch_users_batch, acronis_fetch_tenant_children	limit plus after. Read the next cursor from paging.cursors.after. The cursor carries the filters, so pass only after on later pages.
acronis_fetch_policies, acronis_fetch_policy_applications, acronis_fetch_application_statuses_by_policy, acronis_fetch_resources, acronis_fetch_resource_protection_status	limit plus after / before cursors
acronis_fetch_agents	limit plus after / before. Leaving limit out or setting it to 0 returns every agent, which can hit the response size cap.
acronis_fetch_incidents	limit plus cursor. Every other filter and the sort order must stay exactly the same between pages.
acronis_fetch_all_alerts	No cursor. limit caps the result. Narrow with filters (tenant, category, severity, created_at) and use skip to leave out alert IDs you've already seen.

For counts, use the count tools instead of paging: acronis_fetch_resource_count, acronis_fetch_alert_counters, acronis_fetch_alert_counts_per_customer and acronis_fetch_active_alert_count.

Filter Syntax

• Alerts use operator functions: severity: "or(warning,critical)", severity: "gt(warning)", planName: ["eq(Daily backup)"]. A bare planName or resourceName value matches a substring. IDs passed with or(...) match exactly.
• Alert timestamps (created_at, updated_at, deleted_at) are Unix time in nanoseconds, with an operator: created_at: "gt(1793491200000000000)" means after 2026-11-01 00:00 UTC. Seconds or milliseconds silently match nothing useful.
• EDR incidents use range(date_from, date_to) and ge(date_from) for created_at / updated_at, and or(a,b) for state, severity and mitigation_state.
• Policies and resources take a search string with an SQL-like syntax over name, type and tags.

Errors

The connector returns errors as JSON:

{ "error": { "code": "upstream_unavailable", "message": "..." } }

Messages are capped at 500 characters and never contain the client secret.

Symptom	Cause	What to do
upstream_unavailable	The connector could not start a session with Acronis: the API client was disabled or its secret rotated, or the data center can't be reached	Re-check the API client under Settings → API clients and reconnect Acronis in Conduit
HTTP 401 from Conduit before any Acronis call	A header is missing, or the data center URL is not https on acronis.com	Reconnect with the data center URL Acronis showed for the API client
403 from Acronis	The tenant is outside the API client's tenant	Use a tenant under the API client's tenant, or create the API client higher up
404 from Acronis	Wrong ID, or the wrong ID type (a resource ID where an agent ID belongs)	Re-list from the parent and retry
429 from Acronis	Acronis is throttling the API client	Wait and retry. Use count tools for fleet-wide sweeps.

Conduit doesn't document a fixed Acronis rate limit for this connector. The first call after a quiet period is slower because the connector signs in to Acronis again.

Response Size

Each tool result is capped at about 100 KB. A larger result is cut off with a truncation marker. When you see one, the data is incomplete: lower limit, add filters, or page. Don't summarize a truncated result as if it were the whole set.

Related Skills

• backup-health - Alert-driven backup triage across customers
• protection-coverage - Unprotected machines, plan issues and agent hygiene
• edr-incidents - EDR incident review and investigation state
• tenants-and-usage - Customer mapping, usage, users and MFA posture

Acronis Backup Health Triage

Overview

Acronis raises an alert when a backup fails, finishes with warnings, doesn't run on schedule, or a machine stops reporting. For an MSP the daily question is "which customers have backup problems right now, and which machines?" This skill answers it from the alert data first, because alerts are the cheapest fleet-wide signal, and then drills into machines and plans.

Anti-triggers

• Machines with no protection plan at all, or plans that never deployed — those raise no backup alert. Use acronis-protection-coverage.
• Malware, suspicious processes or EDR incidents — use acronis-edr-incidents.

Key Concepts

Concept	Meaning
Alert	One problem on one resource, with a type, category, severity, the plan (planId, planName) and the resource (resourceId, resourceName)
Category	A group of alert types, such as Backup or Monitoring. List the ones turned on with acronis_fetch_categories.
Alert type	The specific condition. List all of them with acronis_fetch_all_alert_types, filtered by category if needed.
Severity	An ordered scale, so gt(warning) means "worse than warning"
Dismissed	An alert someone cleared. Dismissed alerts carry deleted_at and are hidden unless you pass show_deleted.
Active	Not dismissed. acronis_fetch_active_alert_count returns how many there are and when that last changed.

Workflow: Daily Backup Health Sweep

1. Is anything new? Call acronis_fetch_active_alert_count. If the count and last-modified time match the last sweep, stop there.
2. Rank customers. Call acronis_fetch_alert_counts_per_customer with category: ["Backup"] (confirm the exact category name with acronis_fetch_categories the first time) and severity: "gt(warning)". Sort customers by count.
3. Shape of the problem. Call acronis_fetch_alert_counters with embed_tenants: true and embed_severities: true to see whether a customer's count is many warnings or a few critical alerts. embed_categories can't be combined with embed_types or embed_severities.
4. Worst machines. Call acronis_fetch_resources_with_top_severity_alerts with embed_alert: true. It returns each resource's single worst alert, which is the right list for "what do I fix first".
5. Per-customer detail. For each customer worth a look, call acronis_fetch_alerts_grouped_per_customer with that customer_id, or acronis_fetch_all_alerts with tenant: ["<customer uuid>"] and the same category and severity filters.
6. One alert. acronis_fetch_alert with path.id returns the full alert with its details and context.
7. Group by plan. If many machines fail under one plan, the plan or its storage target is the problem, not the machines. Group the alerts by planName before writing tickets. acronis_fetch_alerts_grouped_by_scope can group by any context key that the alert types define.

Workflow: Working One Alert

1. acronis_fetch_alert for the alert.
2. acronis_fetch_resource with the alert's resource ID, plus links_and_issues: "embed_detailed", to see the machine and any policy issues on it.
3. If the machine might be offline, find its agent with acronis_fetch_agents (hostname filter) and check whether it is online. online: false returns only agents that aren't responding.
4. Check the plan with acronis_fetch_policy (include_settings: true) when the alert points at the schedule, retention or backup destination.
5. Record the finding on the PSA ticket. Acronis has no ticket link for backup alerts.

Reading the Signal

Pattern	Likely cause	Action
One machine, repeated failures, agent offline	Machine powered off, decommissioned, or agent stopped	Confirm with the client before chasing the backup
Many machines under one plan fail at once	Destination storage full or unreachable, credentials for the destination changed	Fix the plan or destination once
Missed schedule, no failure	Machine asleep or off at backup time	Check power settings or move the schedule
Warnings only, completes each day	Usually skipped files, such as locked or in-use files	Review weekly, not daily
Alert for a machine the client retired	Stale resource still has a plan applied	Revoke the plan in the console; this connector can't delete resources

False Positives (write, off by default)

acronis_mark_alert_as_false_positive sets or clears an alert's false-positive flag with path.id and body.falsePositive (true or false). It changes the alert for everyone in Acronis.

• It's off by default. If it isn't in the tool list, writes are turned off for the Acronis connector; tell the operator to mark it in the console.
• When writes are on, Conduit puts it at the write tier (not admin).
• Only mark an alert after you've confirmed the cause is benign. A backup that really failed is never a false positive, even if the machine is unimportant. Ask before marking more than one alert at a time.

Gotchas

• Alert timestamps are Unix nanoseconds. For "last 24 hours", take the current Unix time in seconds, subtract 86400, multiply by 1,000,000,000 and pass the result as one integer: created_at: "gt(1793491200000000000)".
• acronis_fetch_all_alerts has no page cursor. For a big partner, filter by tenant and category instead of pulling everything, or the result hits the 100 KB cap and is cut off.
• planName and resourceName match substrings unless you wrap the value in eq(...).
• An empty alert list doesn't mean every machine is backed up. A machine with no plan never alerts. Run the coverage check in acronis-protection-coverage for that.

Related Skills

• api-patterns - Headers, filters, pagination and errors
• protection-coverage - Machines with no plan, plan deployment issues, agent hygiene
• tenants-and-usage - Map Acronis customer tenants to your clients

Acronis EDR Incidents

Overview

Acronis EDR groups related detections on an endpoint into an incident. Each incident has a severity, a verdict, a mitigation state (was the threat stopped) and an investigation state (has a person looked at it). An MSP's job is to make sure every incident that isn't auto-mitigated gets looked at, and that the investigation state reflects reality.

Anti-triggers

• Backup failures and missed backups — those are alerts, not incidents. Use acronis-backup-health.

Key Concepts

Field	Values
severity	LOW, MEDIUM, HIGH, CRITICAL
verdict	SUSPICIOUS, MALICIOUS
mitigation_state	NOT_MITIGATED, MITIGATED, AUTO_MITIGATED
state (investigation)	NOT_STARTED, INVESTIGATING, TRIAGED, FALSE_POSITIVE, CLOSED
incident_category	Such as MALWARE_DETECTED, PROCESS_DETECTED, URL_BLOCKED, MS_DEFENDER

is_mitigated is a simple true/false filter on whether the threat was stopped. positivity is a confidence score from 0 to 10 that you can filter with range(min, max).

Workflow: Daily Incident Review

1. Open incidents for a customer. Call acronis_fetch_incidents with customer_id, state: "or(NOT_STARTED,INVESTIGATING)" and created_at: "ge(<start date>)". With a partner-level API client, always pass customer_id; without it the call uses the API client's own tenant.
2. Unmitigated first. Re-run with mitigation_state: "NOT_MITIGATED". Those are threats Acronis didn't stop, and they come before everything else regardless of severity.
3. Then by severity. severity: "or(HIGH,CRITICAL)" next, then the rest.
4. Page. Use limit and cursor. Keep every other parameter exactly the same between pages or the cursor is rejected.
5. Read one incident. acronis_fetch_incident with path.incident_id, customer_id, and with_detections, with_activities and with_incident_actions set to true. Detections say what was seen, activities say what happened on the machine, and incident actions say what was done about it.
6. Check a response action. If someone isolated the machine or killed a process from the console, call acronis_fetch_response_action_status with the incident ID and the action's activity_id from step 5.

Deciding the Outcome

Situation	Typical investigation state
Auto-mitigated known malware, nothing else on the machine	TRIAGED, then CLOSED after a quick check
Not mitigated, or malicious verdict with unexpected activity	INVESTIGATING; open a PSA ticket and escalate
Legitimate admin tool or line-of-business software flagged	FALSE_POSITIVE, with a comment naming the software and who confirmed it
Same detection across many machines at once	Treat as one event; investigate the common source before closing any

Updating the Investigation (write, off by default)

acronis_update_investigation_state changes an incident's investigation state, adds a comment, or links an external ticket. Body fields: state, comment, ticket_id, ticket_subject, assignee, assignee_id, and priority (LOW, MEDIUM, HIGH, CRITICAL). Pass customer_id in query with a partner-level API client.

• It's off by default. If it isn't in the tool list, writes are turned off for the Acronis connector; tell the operator to update the incident in the console.
• When writes are on, Conduit puts it at the write tier (not admin).
• Put the PSA ticket number in ticket_id so the incident and the ticket point at each other.
• Never set FALSE_POSITIVE or CLOSED on an unmitigated incident without the operator's explicit confirmation.
• Send an Idempotency-Key header when retrying after a network error, so a retry doesn't add the same comment twice.

What This Connector Can't Do

Starting a response action (isolating a machine, killing a process, quarantining a file, rolling back) is not available through this connector. Say so, and point the operator to the incident in the Acronis console. Reading the status of an action started there is available.

Gotchas

• incident_id filtering on acronis_fetch_incidents only works for a single customer, so pass customer_id with it.
• Multi-workload incidents span several machines. Pass with_multi_workload: true to get the workloads list; without it you see one machine.
• Incidents that were merged into another are hidden unless you pass with_transferred: true.
• Incident dates use range(from, to) and ge(from), not the nanosecond operators that alerts use.

Related Skills

• api-patterns - Headers, pagination and errors
• tenants-and-usage - Find the customer tenant UUID

Acronis Protection Coverage

Overview

A machine only alerts in Acronis if a protection plan covers it. Coverage gaps are silent: a new laptop with an agent but no plan, a plan that never deployed to a server, or an agent that stopped updating months ago. This skill finds those gaps. Run it monthly per client, after onboarding a new client, and whenever the client's machine count changes.

Anti-triggers

• Backups that ran and failed — those raise alerts. Use acronis-backup-health.

Key Concepts

Term	Meaning
Resource	Anything Acronis can protect: a machine, a mailbox, a virtual machine and so on. Each has a type.
Policy	A protection plan in the Acronis console. Policies are composite: a root policy holds sub-policies such as backup, antimalware and patching.
Policy application	One policy applied to one resource (its "context"). Each application has a deployment state, a running state and an execution status.
Agent	The Acronis software on a machine. One agent can serve several resources (a hypervisor agent serves its VMs).
Issue	A problem on an application: a validation issue, a deployment error, or a running blocker.

Workflow: Client Coverage Audit

1. Find the customer tenant. See acronis-tenants-and-usage. You need the customer's tenant UUID for every step below.
2. Protected vs. unprotected. Call acronis_fetch_resource_protection_status with tenant_id. It lists resources and whether each is protected. Page with after until there is no next cursor.
3. Count check. acronis_fetch_resource_count with the same tenant_id gives a total to check your paging against.
4. Machines with no plan. acronis_fetch_resources with tenant_id, not_applied_only: true and is_group: false lists resources that have no policy applied, without resource groups. These are the coverage gaps. Some resource types are never meant to carry a plan, so read the type of each before calling it a gap.
5. Plans that didn't land. acronis_fetch_applications_issue_statistics counts issues per policy. For each policy with issues, call acronis_fetch_policy_applications with policy_id, include_deployment_errors: true, include_running_blockers: true and include_validation_issues: true to see which machines are affected and why.
6. Per-plan status. acronis_fetch_application_statuses_by_policy with policy_id returns the status of every resource the plan covers. Add join_not_applied: true to include plans with no applications at all.
7. Agent hygiene. acronis_fetch_agents with tenant_id (a subtree root) and, in separate calls, online: false, up_to_date: false and unsupported: true. up_to_date and unsupported can't be combined in one call. Set limit; without it every agent comes back at once.
8. Reconcile with the client's machine list. Compare Acronis resource names against the RMM or PSA device list. Machines in the RMM but not in Acronis have no agent. Machines in Acronis but not in the RMM may be retired.

Reading the Results

Finding	Meaning	Usual fix
Resource with no plan	Agent installed, never assigned a plan	Apply the client's standard plan in the console
Application with a deployment error	The plan couldn't be pushed to the agent	Check the agent is online and supported, then redeploy
Running blocker	The plan is deployed but can't run (for example, a missing backup destination)	Fix the blocker named in the issue
Agent offline for days	Machine retired, powered off, or agent service stopped	Confirm with the client, then remove or repair
Agent unsupported	Version is older than Acronis still supports	Update the agent before it causes plan or backup failures
Policy with zero applications	A plan nobody uses	Leave it, but don't count it as coverage

Running a Plan Now (admin only, off by default)

acronis_execute_protection_policy runs a protection plan right away on every resource it's applied to, or only on the resources named in context_ids. It starts real backup or protection jobs on client machines.

• It's off by default. If it isn't in the tool list, writes are turned off for the Acronis connector.
• When writes are on, Conduit puts it at the admin tier. Technicians without admin access can't run it.
• Before calling it, say which plan, which machines and why, and get the operator's confirmation. Leaving context_ids empty runs the plan on every machine it covers, which for a large client can mean dozens of jobs at once during business hours.
• The body needs state: "running" plus policy_id. Don't use settings (a temporary ad-hoc plan) unless the operator asks for one.

Gotchas

• Policies are called protection plans in the console. Use the console word when you talk to the operator.
• Composite policies: acronis_fetch_policies returns root policies and their sub-policies. Pass parent_ids empty (parent_ids: "") to get root plans only.
• acronis_fetch_policies with include_applied_context: true can't be combined with applicable_to_context_id.
• Resource IDs, agent IDs and policy IDs are different things. A 404 usually means one was passed where another belongs.
• The type filter on resource tools takes Acronis resource type strings. Read the type values from an unfiltered acronis_fetch_resources call first instead of guessing them.

Related Skills

• api-patterns - Headers, pagination and errors
• backup-health - Alert-driven backup triage
• tenants-and-usage - Find the customer tenant and its usage counts

Acronis Tenants and Usage

Overview

Everything in Acronis lives in a tenant. Most workflows in this plugin start with "which tenant UUID is this client?", so this skill covers how to find it, plus the account-level jobs an MSP does monthly: usage reconciliation, user access reviews and MFA posture.

Key Concepts

Tenant kind	What it is
Partner	The MSP's own tenant. A partner-level API client sees everything under it.
Folder	An optional grouping of customers under a partner
Customer	One client organization. Backups, alerts and incidents live here.
Unit	An optional sub-division inside a customer

Workflow: Find the Partner Tenant

1. Call acronis_fetch_current_user_info. Its result names the tenant the API client signs in as.
2. If that doesn't give a tenant ID, ask the operator for the partner tenant ID. Don't guess one.
3. Confirm it with acronis_fetch_tenant (path.tenant_id). Check that its kind is partner, not customer. A customer-level API client sees only that one customer.

Workflow: List and Map Customers

1. acronis_fetch_tenants_batch with parent_id set to the partner tenant and lod: "basic" returns the direct children with names. Use subtree_root_id instead when customers sit inside folders, which returns the whole hierarchy.
2. Page with limit and after (from paging.cursors.after) until there is no next cursor.
3. To find one client by name, use acronis_search with tenant set to the partner tenant and text set to the name. It searches tenants and users.
4. Map each customer to its PSA company by name and save the mapping. Acronis tenant names are free text, so expect near-misses ("Acme Inc" vs. "Acme, Inc.") and confirm the ambiguous ones with the operator.

acronis_fetch_tenant_children returns only child IDs. Follow it with acronis_fetch_tenants_batch (uuids, up to 100 per call) for names.

Workflow: Monthly Usage Reconciliation

1. For each customer, call acronis_fetch_tenant_usages with path.tenant_id. It returns the tenant's usage metrics, one per usage name (for example workstations). Narrow with usage_names or editions (both comma-separated) once you know which ones you bill for.
2. Compare each metric against the quantity on the client's PSA agreement or last invoice.
3. Report three lists: under-billed (Acronis usage higher than billed), over-billed (billed for more than is used), and matches.
4. Run reconciliation on the same day each month so the numbers compare like for like.

Pricing, editions and offering items can't be changed through this connector. Report differences; changes happen in the console or PSA.

Workflow: User Access Review

1. acronis_fetch_users_batch with subtree_root_tenant_id set to the customer tenant, lod: "full" and with_access_policies: true returns the customer's users (including those in its units) with their details and access policies, which carry their roles. Page with limit and after.
2. Alternatively, acronis_fetch_tenant_users returns user UUIDs only (pass include_grand_children: true for users in units). Follow it with acronis_fetch_users_batch using uuids, up to 100 per call.
3. Flag: users who left the client, shared or generic logins, and anyone with an administrator role who doesn't need it.
4. Check the MSP side too: run the same steps on the partner tenant to see which technicians have partner-level access.

Disabling or deleting users can't be done through this connector. Give the operator the list to act on in the console.

Workflow: MFA Posture

acronis_fetch_tenant_mfa_status with path.tenant_id reports whether MFA is on for the tenant and how many users have set up TOTP. Run it on the partner tenant first: an MSP's own Acronis logins reach every client's backups, so partner-level MFA matters most. Then run it per customer for clients whose staff log in to Acronis.

Gotchas

• uuids, parent_id and subtree_root_id on acronis_fetch_tenants_batch can't be combined. Pick one.
• Deleted tenants and users are hidden unless you pass allow_deleted: true. Leave it off for reconciliation, or retired clients show up as live.
• acronis_fetch_user takes one user. For more than a handful, use acronis_fetch_users_batch. Its uuids, tenant_id and subtree_root_tenant_id filters can't be combined.
• Tenant and user IDs must be 36-character UUIDs. The tools reject anything else, such as a tenant name.

Related Skills

• api-patterns - Headers, pagination and errors
• backup-health - Alert triage per customer
• protection-coverage - Coverage audit per customer

You are an expert BCDR reviewer for MSP environments using Acronis Cyber Protect Cloud. Your role is to turn Acronis's alert, protection and agent data into a short, ranked list of what to fix today, per client. A daily backup check done by hand means opening every customer in the console; you do it from the API, and you also catch the silent failures the console's alert view never shows: machines with no protection plan, plans that never deployed, and agents that quietly stopped reporting.

You start by grounding the scope. You find the partner tenant with acronis_fetch_current_user_info and confirm it with acronis_fetch_tenant, then list customers with acronis_fetch_tenants_batch (parent_id or subtree_root_id, paging with after). If the operator named one client, you find it with acronis_search and stop the fan-out there. If the API client turns out to be customer-level, you say so: the review covers only that one customer.

You work from cheapest to most expensive signal. acronis_fetch_active_alert_count tells you whether anything changed. acronis_fetch_alert_counts_per_customer (backup category, severity: "gt(warning)") ranks customers. acronis_fetch_resources_with_top_severity_alerts with embed_alert: true gives each affected machine's worst alert. Only for customers with problems do you pull detail with acronis_fetch_alerts_grouped_per_customer or acronis_fetch_all_alerts (filtered by tenant, with nanosecond created_at bounds), and you group alerts by plan before calling anything a machine problem: ten machines failing under one plan is one destination problem. Then, for each customer in scope, you run the silent-failure checks: acronis_fetch_resources with not_applied_only: true and is_group: false for machines with no plan, acronis_fetch_applications_issue_statistics and acronis_fetch_policy_applications (with deployment errors and running blockers included) for plans that didn't land, and acronis_fetch_agents with online: false, then unsupported: true, for agent hygiene.

You report a ranked table and nothing you can't back with data. When a result is cut off at the response size cap, you say the data is incomplete for that customer and narrow the call rather than summarizing a partial list. An empty alert list for a customer is never reported as "healthy" until the coverage check has also come back clean.

Capabilities

• Rank every Acronis customer by active backup alert load and severity
• Identify the worst-affected machines and the plan behind each failure
• Separate plan-wide failures (destination, credentials) from single-machine failures
• Find machines with an agent but no protection plan, and plans that failed to deploy or are blocked
• Flag offline, outdated and unsupported Acronis agents per customer
• Produce a per-client fix-first list suitable for a PSA ticket or a morning stand-up
• Mark a confirmed-benign alert as a false positive when writes are on and the operator approves

Approach

Default window: alerts created in the last 24 hours for a daily check, 7 days for a weekly review; agents offline for more than 3 days are worth a line, more than 14 days are worth a client conversation. Critical backup alerts on servers come first, then other failed or missed backups, then coverage gaps, then agent hygiene, then warnings. Treat a domain controller, file server or line-of-business server with a failed or missing backup as same-day work; a single workstation with warnings is a weekly item.

This agent is read-first. acronis_mark_alert_as_false_positive and acronis_execute_protection_policy are off by default; if they aren't in the tool list, say writes are off and give the console step instead. When they are on, marking a false positive is a write-tier action that still needs the operator's yes for each alert, and running a protection plan is admin-only in Conduit and starts real jobs on client machines. Never run a plan as part of a review; recommend it, naming the plan and machines, and let an admin decide.

Stop and ask when the API client is customer-level but the request was "all clients", when a customer name matches more than one tenant, or when a result was truncated and narrowing it would take many more calls.

Output Format

One table per review: customer, active backup alerts by severity, machines with failed or missed backups, machines with no plan, plans with deployment issues, offline or unsupported agents, and a one-line "fix first" note. Follow with a short section per customer that has critical findings, listing machine, plan, alert type and the suggested next step. End with anything you couldn't check (writes off, truncated data, customer-level API client) so the reader knows the limits of the review.

When working through this review, bias toward fewer, better-grouped findings over a long list of alerts: the reader should be able to open three tickets, not thirty.