Skip to main content

Release a protection group

POST 
/v1/protection-groups/:id/release

Stops the group's workload here and hands it over to the region that recovers it, for a planned move with nothing lost. Runs where the group's custody is active: at its home before a failover, or at the recovery region before a failback.

The run pauses the backup plans that protect the members, locks each member's server so nobody starts it, shuts it down and waits until it is off. It then takes a final backup of every member with the server off and waits until that backup has reached every repository the other region reads, the copy repository included. Last, it records the release, with when each member stopped and its final backup, in those repositories, and the group's custody here becomes released. That record is the run's point of no return: before it, a failure or a cancel starts the servers again, unlocks them and resumes the plans; after it, nothing is undone. The other region then recovers the group with a planned recover, which acts on that record and nothing else. At the group's home, each member's final backup is kept as the point its original server holds, for the failback that returns to it.

A release needs a recent report from the other region that it can recover every member, or it is refused with recovery_region_not_ready: releasing a workload nothing can bring up is an outage. An operator may release without one with override_recovery_readiness, which is audited.

With dry_run=true the request answers 200 with the plan the run would follow and starts nothing. Otherwise it answers 202 with the admitted run; follow it at GET /v1/protection-groups/{id}/runs/{run_id}. The hot rung is refused in this release.

Any member of the project the token is scoped to.

Request​

Responses​

OK.

With dry_run=true, the plan the run would follow. Nothing was started.