SYNERGY
Chapters

7.7Using the Recycle Bin from the REST API

Last updated

The Recycle Bin is available to integrations on the machine surface under /api/ad/deleted-objects. All routes need the recycle-bin licence feature and act on the directory selected by the request's connection. The Recycle Bin is not offered as an AI-agent tool or as an n8n operation.

Method and pathPermissionPurpose
GET /api/ad/deleted-objectsad:deleted-objects:listOne page of restorable objects (search, objectClass, pageSize up to 1000, continuationToken)
GET /api/ad/deleted-objects/summaryad:deleted-objects:listWhole-bin totals, expiring-soon count and per-class counts
GET /api/ad/deleted-objects/{objectGuid}/restore-checkad:deleted-objects:restore and ad:objects:readWhat a restore would do; changes nothing
POST /api/ad/deleted-objects/{objectGuid}/restoread:deleted-objects:restore (plus restore-privileged for privileged objects)Restore an object
GET /api/ad/deleted-objects/{objectGuid}/reapply-planad:deleted-objects:reapply-attributesWhat a reapply would write; changes nothing
POST /api/ad/deleted-objects/{objectGuid}/reapply-attributesad:deleted-objects:reapply-attributesWrite attributes back from the restore image

A restore request body has two optional fields, targetParentDn and newName. An empty body restores the object in place under its original name:

json
{
  "targetParentDn": "OU=Staff,DC=example,DC=com",
  "newName": "Jane Smith (restored)"
}

The response states where the object landed and whether it came back stripped:

json
{
  "objectGuid": "3f2c…",
  "distinguishedName": "CN=Jane Smith (restored),OU=Staff,DC=example,DC=com",
  "name": "Jane Smith (restored)",
  "objectClassName": "user",
  "restoredToAlternateParent": true,
  "attributesNotPreserved": false
}

A reapply request may name a subset of the attributes from the plan in attributes; an empty list writes everything the plan marked writable. The list can only narrow the plan, never add to it. The reapply route answers 404 when no usable image is held.

When the caller is an API key subject to approval, the restore and reapply routes can answer 202 Accepted with an operation handle instead of the result. See Chapter 15, REST API for integrators.

Troubleshooting

SymptomWhat to check
Recycle Bin is missing from the navigationThe licence lacks the recycle-bin feature, no directory is selected in the workspace, or your role lacks ad:deleted-objects:list
"Could not load the recycle bin."The connection's service account cannot read the Deleted Objects container, or the domain controller is unreachable. Select Retry after fixing it
An object you expect is not listedIts deleted object lifetime has passed and Active Directory has recycled it, or it was deleted in a different domain than the one selected
Restore is not shown in the rowsYour role lacks ad:deleted-objects:restore
The restore is refused with a rights errorThe connection's service account lacks Reanimate Tombstones on the domain or create rights in the destination
The restored object is disabled and emptyThe Active Directory Recycle Bin feature is off. Use Review what can be put back, then re-add group memberships
Review what can be put back is not shown after a stripped restoreYour role lacks ad:deleted-objects:reapply-attributes
Review what can be put back says no copy is heldThe object was not deleted through the platform, or the image passed RestoreImages:RetentionDays

Last updated

Did this page help you?