Connect Datto BCDR

Datto BCDR (Business Continuity and Disaster Recovery) is Datto's backup and continuity line — the SIRIS, ALTO and NAS appliances that sit on a client's network taking image-based backups, plus…

Written By Christopher Scaminaci

Last updated 6 days ago

Datto BCDR (Business Continuity and Disaster Recovery) is Datto's backup and continuity line — the SIRIS, ALTO and NAS appliances that sit on a client's network taking image-based backups, plus Datto's Direct-to-Cloud agents that back up straight to Datto's cloud with no appliance at all. StackJack talks to it through the Datto REST API.

Connecting Datto BCDR to StackJack gives your AI assistant a family of dattobcdr_ MCP tools — MCP (Model Context Protocol) tools are the standardized commands an AI assistant can call through StackJack. With them, your AI can:

Check backup health across every client — appliances and their service plans and storage use, the protected machines and file shares on each one, and when each last backed up successfully
Investigate failures — open alerts per appliance, and the screenshot-verification image Datto captures when it boots a backup to prove it is restorable
Audit activity — who changed what and when, filtered by client, by person, or by the object they touched
Track Direct-to-Cloud — cloud-backed assets per client, their agent versions and check-in times, and cloud storage consumption by pool
Adjust a Direct-to-Cloud bandwidth limit (on Pro plans) — the connector's only setting change

What this connector cannot do

Worth knowing up front, because it shapes what you should ask your AI for. The Datto REST API is a monitoring and reporting interface, not a control panel. It can tell you everything about the state of your backups; it cannot start a backup, run a restore, or virtualize a machine. Those remain actions you take in the Datto portal or on the appliance itself. The tool that lists "VM restores" reports virtualizations that already exist — it cannot create one.

This is a limit of what Datto offers through the API, not a StackJack restriction.

Datto serves both products from the same API behind the same pair of keys. StackJack lists them as two separate connectors because they are separately sold and many partners own only one — so if you use both, create one key pair and enter the same two values in each connector. Connecting one does not connect the other.

The other consequence of sharing an API: Datto's request allowance is counted per account, across both products. Heavy use of one connector can slow the other down. StackJack paces its own requests to stay well within the allowance and backs off automatically if Datto ever pushes back.

How StackJack authenticates to Datto

Datto uses a pair of static keys — a public key and a secret key — created together in the Datto Partner Portal. StackJack sends both on every request. There is no sign-in redirect, no expiry, and nothing to refresh: the pair stays valid until someone regenerates it.

Two things are worth understanding before you create one:

The secret key is shown exactly once. Datto displays it at the moment you create the pair and never again. If you navigate away without copying it, you cannot recover it — you have to generate a replacement pair, which immediately invalidates the old one. Because both Datto connectors use the same pair, regenerating breaks both until you re-enter the new values in each.

The keys carry no individual permissions. There are no per-key permission checkboxes: a key reaches whatever your partner account is entitled to. If a Direct-to-Cloud tool is refused while appliance tools work, the usual cause is that the product is not entitled on your account, or the device belongs to a child reseller whose data your account cannot see.

Datto serves this API from one global address (https://api.datto.com/v1), so there is no region to choose and no URL to enter.

Before you begin

In StackJack: you need a role that can manage connectors (tenant Owner, a co-owner, or an Administrator).
In Datto: you need Partner Portal access with administrator rights, so you can create API keys.

Step 1 — Create a key pair in the Datto Partner Portal

Sign in to the Datto Partner Portal as an administrator.
Open Admin, then Integrations, then API Keys.
Create a new API key. Datto generates a public key and a secret key together — they are one pair and only work together.
Copy the secret key immediately and store it securely, treating it like a password. This is the only time it is shown.

Step 2 — Add the credential in StackJack

In the StackJack portal, open Connectors.
Find the Datto BCDR card. Click How To Connect for the same steps inline, or Configure to enter the keys.
Paste your public key and your secret key. There is no URL to enter — the address is fixed.
Click Save.

What happens when you save

Both keys are stored encrypted in Azure Key Vault — never in the StackJack database, and never shown back to you.
If this is the first time you configure Datto BCDR, a Free-tier subscription for the connector is created automatically so its Free tools work right away.
StackJack immediately live-validates the pair by making a cheap authenticated read against your Datto account. Validation never blocks the save: you will either see a success confirmation or a "saved but validation failed" warning with the reason.
StackJack re-checks the credential periodically afterwards, so an expired or regenerated key shows up as a connector health warning rather than as a mysterious tool failure.

What your AI can do at each plan

Free — all seventeen read tools. Everything described at the top of this page except the bandwidth change: appliances, protected machines and shares, alerts, screenshot-verification images, existing restore records, the activity log, and the whole Direct-to-Cloud read surface.

Pro — adds the one write. Updating a Direct-to-Cloud agent's bandwidth limit. StackJack marks it as a change; whether your AI application asks you to confirm first depends on that application's own settings — see Destructive tools and confirmation.

Business — the same tools as Pro, with a higher monthly call allowance.

Datto issues keys at the partner level rather than per person, so all activity authenticates as your partner account and there is no per-user attribution.

Working with identifiers

Datto uses two different kinds of identifier that are not interchangeable, and mixing them is the most common cause of a "not found" result:

Appliances are identified by serial number. Start with the device list to get them.
Direct-to-Cloud assets and agents are identified by UUID. Start with the Direct-to-Cloud asset list to get them.

Ask your AI to list first and then drill in, rather than supplying an identifier copied from another system.

Troubleshooting

Every Datto tool suddenly fails with an authorization error. The key pair was almost certainly regenerated in the Partner Portal — remember Datto shows a secret key only once, so anyone who lost it and made a replacement has invalidated the old pair. Check the public key shown in the Partner Portal against the one saved in StackJack, and if it has changed, paste the current pair into the connector and run Test Connection. If you also use Datto SaaS Protection, re-enter it there too.

Some tools work and others are refused. Datto keys carry no individual permissions, so this is an entitlement gap rather than a permissions problem. Direct-to-Cloud tools need Direct-to-Cloud on your account; a device belonging to a child reseller will not be visible to a parent account that cannot see it in the portal either.

A tool reports "not found" for something you can see in Datto. Check you are using the right kind of identifier — serial number for appliances, UUID for Direct-to-Cloud. Ask your AI to list the devices or assets first and use what that returns.

Requests are being slowed down. Datto's allowance is counted per account and shared with Datto SaaS Protection, so a busy period on either connector can throttle both. StackJack paces itself and backs off automatically; asking for smaller pages of results also helps.

A screenshot tool returns an error instead of an image. Screenshot images are handed back as a short-lived download link rather than being embedded in the response. If file storage is unavailable the tool fails clearly rather than returning a link that would not work — that is deliberate. The link expires after about ten minutes, so fetch it promptly.

Full tool list

See the generated Datto BCDR tool reference for the current inventory, plan assignment, input schemas, and destructive-action labels.

Datto BCDR tools

dattobcdr_ · 18 tools · Free 17 · Pro 1

Devices

Tool	What it does
`dattobcdr_get_device` Free · Read-only	Get one BCDR appliance by serial number, with its full detail: model, service plan and expiry, local and offsite storage usage, last-seen time, and protected-asset and alert rollups.
`dattobcdr_list_devices` Free · Read-only	List the partner's BCDR appliances (SIRIS, ALTO, NAS) — the ENTRY POINT for this connector.

Agents

Tool	What it does
`dattobcdr_list_agents` Free · Read-only	List every client (organization) and its protected agents across ALL of the partner's appliances at once — the partner-wide rollup.
`dattobcdr_list_device_agents` Free · Read-only	List the protected AGENTS on one appliance — backed-up machines only, excluding file shares.

Assets

Tool	What it does
`dattobcdr_get_device_volume_asset` Free · Read-only	Get ONE protected asset (agent or share) on an appliance, addressed by its volume name.
`dattobcdr_list_device_assets` Free · Read-only	List ALL protected assets on one appliance — agents (backed-up machines) and shares (file shares) together, in one call.
`dattobcdr_list_device_shares` Free · Read-only	List the protected SHARES on one appliance — NAS and SIRIS file shares only, excluding backed-up machines.

Screenshots

Tool	What it does
`dattobcdr_get_asset_latest_screenshot` Free · Read-only	Get the most recent screenshot-verification image for a protected volume on an appliance — the screen capture Datto takes when it boots a backup to prove the backup is restorable.
`dattobcdr_get_dtc_asset_latest_screenshot` Free · Read-only	Get the most recent screenshot-verification image for a Direct-to-Cloud asset — the screen capture Datto takes when it boots a cloud backup to prove it is restorable.

Alerts

Tool	What it does
`dattobcdr_list_device_alerts` Free · Read-only	List the alerts raised by one appliance — backup failures, screenshot-verification failures, storage pressure, offsite-sync problems and connectivity loss.

Restores

Tool	What it does
`dattobcdr_list_device_vm_restores` Free · Read-only	List the VM restore records on one appliance — virtualizations that already exist, with the asset each one restores, the snapshot it was built from, its type (local or offsite virtualization) and its current state.

Reporting

Tool	What it does
`dattobcdr_get_activity_log` Free · Read-only	Read the partner's activity log, newest first — who did what, to which device or asset, and when.

Direct-to-Cloud

Tool	What it does
`dattobcdr_get_dtc_asset` Free · Read-only	Get one Direct-to-Cloud asset in full: hostname, operating system, protected volumes, agent version, last check-in and backup times, retention and cloud storage consumption.
`dattobcdr_get_dtc_storage_pool` Free · Read-only	Read Direct-to-Cloud cloud storage consumption broken down by storage pool, with each pool's name, capacity and used space.
`dattobcdr_list_client_dtc_assets` Free · Read-only	List the Direct-to-Cloud assets belonging to ONE client (organization), with each asset's UUID, hostname, operating system, protected size and backup state.
`dattobcdr_list_dtc_assets` Free · Read-only	List every Direct-to-Cloud asset across ALL of the partner's clients — machines that back up straight to the Datto cloud with no on-site appliance.
`dattobcdr_list_dtc_rmm_templates` Free · Read-only	List the RMM deployment templates available for rolling out Direct-to-Cloud agents — the prepared configurations used to install the DTC agent through an RMM rather than by hand.
`dattobcdr_update_dtc_agent_bandwidth` Pro · Write	Update the bandwidth throttle settings for one Direct-to-Cloud agent — how much network capacity that agent may use when sending backups to the Datto cloud.

Still need help? Ask the team