7.7Using the Recycle Bin from the REST API
Last updated
The Recycle Bin is available to integrations on the machine surface under /api/ad/deleted-objects. All routes need the recycle-bin licence feature and act on the directory selected by the request's connection. The Recycle Bin is not offered as an AI-agent tool or as an n8n operation.
| Method and path | Permission | Purpose |
|---|---|---|
GET /api/ad/deleted-objects | ad:deleted-objects:list | One page of restorable objects (search, objectClass, pageSize up to 1000, continuationToken) |
GET /api/ad/deleted-objects/summary | ad:deleted-objects:list | Whole-bin totals, expiring-soon count and per-class counts |
GET /api/ad/deleted-objects/{objectGuid}/restore-check | ad:deleted-objects:restore and ad:objects:read | What a restore would do; changes nothing |
POST /api/ad/deleted-objects/{objectGuid}/restore | ad:deleted-objects:restore (plus restore-privileged for privileged objects) | Restore an object |
GET /api/ad/deleted-objects/{objectGuid}/reapply-plan | ad:deleted-objects:reapply-attributes | What a reapply would write; changes nothing |
POST /api/ad/deleted-objects/{objectGuid}/reapply-attributes | ad:deleted-objects:reapply-attributes | Write attributes back from the restore image |
A restore request body has two optional fields, targetParentDn and newName. An empty body restores the object in place under its original name:
{
"targetParentDn": "OU=Staff,DC=example,DC=com",
"newName": "Jane Smith (restored)"
}The response states where the object landed and whether it came back stripped:
{
"objectGuid": "3f2c…",
"distinguishedName": "CN=Jane Smith (restored),OU=Staff,DC=example,DC=com",
"name": "Jane Smith (restored)",
"objectClassName": "user",
"restoredToAlternateParent": true,
"attributesNotPreserved": false
}A reapply request may name a subset of the attributes from the plan in attributes; an empty list writes everything the plan marked writable. The list can only narrow the plan, never add to it. The reapply route answers 404 when no usable image is held.
When the caller is an API key subject to approval, the restore and reapply routes can answer 202 Accepted with an operation handle instead of the result. See Chapter 15, REST API for integrators.
Troubleshooting
| Symptom | What to check |
|---|---|
| Recycle Bin is missing from the navigation | The licence lacks the recycle-bin feature, no directory is selected in the workspace, or your role lacks ad:deleted-objects:list |
| "Could not load the recycle bin." | The connection's service account cannot read the Deleted Objects container, or the domain controller is unreachable. Select Retry after fixing it |
| An object you expect is not listed | Its deleted object lifetime has passed and Active Directory has recycled it, or it was deleted in a different domain than the one selected |
| Restore is not shown in the rows | Your role lacks ad:deleted-objects:restore |
| The restore is refused with a rights error | The connection's service account lacks Reanimate Tombstones on the domain or create rights in the destination |
| The restored object is disabled and empty | The Active Directory Recycle Bin feature is off. Use Review what can be put back, then re-add group memberships |
| Review what can be put back is not shown after a stripped restore | Your role lacks ad:deleted-objects:reapply-attributes |
| Review what can be put back says no copy is held | The object was not deleted through the platform, or the image passed RestoreImages:RetentionDays |
Last updated
Thank you for your feedback.