The Rewind API gives you programmatic access to your Rewind data. This article explains what the API does, how to create an API key, how to make your first request, and how to manage your keys. Full endpoint reference, request and response shapes, and interactive testing live in the Rewind developer docs.
Covered in this article:
Overview
The Rewind API is a REST API for your organization's Rewind data. You can use it to automate compliance reporting, feed monitoring and SIEM pipelines, and build your own integrations against your backups.
The API is organized into resource groups:
- Accounts — list the services Rewind is backing up, and get details and status for any one of them
- Backups — retrieve an account's backup history, and trigger an on-demand backup
- Restores — start an account-level restore to a point in time
- Content — search an account's backed-up Jira issues and Confluence pages, and read any backed-up version
- Audit logs — retrieve your organization's audit log
- Tokens — look up details about an API key, including its expiry
- Status — check that the API is reachable
For request and response details, error handling, pagination, and interactive testing, see the Rewind developer docs. This article covers getting set up; the developer docs are the reference.
The API is included on all paid plans. The Rewind MCP, which lets an AI assistant work with your backups in plain language, runs on the same API and is available on the same plans. Free and legacy plans aren't eligible for either.
Creating and using an API key
Before you begin
Before starting, confirm the following:
- You're an Organization Owner or Organization Admin in Rewind
- Your organization is on a paid plan
- You have a way to store the key securely, such as a password manager or a secrets store
Create an API key
Keys are organization-level, so one key works across all of your organization's accounts. You don't need a separate key for each integration, though separate keys with clear names make revocation easier if one is ever exposed.
- Go to Account settings › Security, then select Manage API keys.
- Select + Create API Key.
- Enter a Name. Audit log entries show a hashed ID rather than a person's name, so the key name is how you'll identify it later.
- Choose an Expiration, then select Create. Keys expire after 90 days by default, and you can choose a longer period up to one year.
- Select Copy, store the key somewhere secure, then select Done. Treat the key like a password. Rewind won't show it again once you leave the page, so if you lose it you'll need to create a new key.
Make your first request
The API is served from https://developer.rewind.com, with every endpoint under /api/v1/. This is a different host from the developer docs, so calling docs.developer.rewind.com won't return data.
You can check that the API is reachable without a key:
curl "https://developer.rewind.com/api/v1/status"
Every other endpoint needs your key in the X-API-Key header. If the status check succeeds but authenticated calls return 401, the problem is the key or the header rather than connectivity. See Authentication in the developer docs for details, and Error handling for what each response code means.
Manage your API keys
The API Keys page lists each key's name, creation date, expiry date, and when it was last used.
Rewind doesn't send a reminder before a key expires, so note the date in the Expires on column when you create a key and plan to replace it ahead of time. You can also look up a key's expiry programmatically through the Tokens endpoint. When a key expires, create a new one and update wherever the old key was stored.
A key is tied to the role of the person who created it. If that person drops below Organization Admin, the key stops working and an Organization Owner or Admin needs to create a new one.
To revoke a key, find it on the API Keys page and select Revoke. Revocation takes effect immediately, so revoke first and issue a replacement afterward if you think a key has been exposed. Key creation, use, and revocation are all recorded in your organization's audit log.
Retrieving backed-up content
Alongside backup status and history, the API can return the backed-up content itself for Jira issues and Confluence pages. You can search an account's backed-up items by title or Jira key, list every backup version of an item, and read the content of any past version, including versions that were later changed or deleted.
This is useful whenever you need to see what an issue or page said at a particular point in time, whether for a recovery, an investigation, or a compliance review. Because Rewind keeps its own copy of every backup, you can read a past version even after the item has been changed or deleted in the live system.
See Content in the developer docs for the request and response details.
What you can search and read
- Content retrieval covers Jira issues and Confluence pages. Comments and attachments aren't included, and other integrations aren't supported.
- Search matches an item's title or Jira key. To find a phrase that appears inside a page, search in Jira or Confluence first, then read that item from Rewind.
How version history works
- Rewind captures one version each time a backup runs, so the version list follows your backup schedule rather than every edit.
- A change made and undone between two backups has no version of its own.
- Versions stay readable after an item is deleted in the live system, though the API doesn't detect or list what was deleted.
Reading a past version
- These endpoints return content to you and don't write anything back to Jira or Confluence, so reading a version isn't a restore. To put a past version back, use the Rewind app or the account-level restore endpoint.
- A single version over roughly 5 MB returns an error instead of the content. The version is still stored in your backup, so you can restore it from the Rewind app instead.
Limitations
-
Restores through the API are account-level
The restore endpoint restores a whole account to a point in time. To restore a single item, use the Rewind app. -
Backup history isn't a per-item-type report
The backups endpoint returns recent backup jobs with their result, timestamp, job ID, and item count. It doesn't break items down by type across a date range. -
On-demand backup triggers are rate limited
There's a limit on how often you can trigger a backup for the same account. Triggers sent in quick succession are rejected rather than queued, so space them out instead of scripting them back to back. Scheduled backups aren't affected.
Related articles
- Connecting Claude to your Rewind account (Rewind MCP) — Explains how to connect Claude to Rewind using an API key.
- Rewind developer docs — Full endpoint reference, request and response shapes, and interactive testing.
- Guide to User Roles and Permissions in Rewind (Role-Based Access Control) — Explains which roles can create and revoke API keys.
- Audit Log FAQ — Covers the events Rewind records, including API key activity.
Need help?
If you have questions or need assistance, contact help@rewind.com or submit a request.