Skip to main content

Backup & Restore

nexusID backs up two independent layers, so you can move configuration between environments and recover a whole environment:

  1. Config backup — a portable, passphrase-sealed bundle of everything an operator configures (providers, policies, roles, templates, mappings, catalogs…). Use it to promote config dev → staging → prod, or to version-control your setup.
  2. Global Data Backup — a whole-database snapshot (BCP/DR). Use it to restore an entire instance, including identities and operational data.

Config backup​

Open Admin → Config Backup. Export produces a single encrypted .nxcfg bundle sealed with a passphrase you choose; import can dry-run first (shows exactly what would be created/updated/skipped) before you apply, and runs in one transaction.

Coverage is comprehensive — the bundle carries every admin-configured section, including:

  • Providers & integrations, IDP configs, RP clients, domain/attribute mappings, branding, system settings
  • Password/session/MFA policies, IP zones, office-hours, behavior rules, JIT policies
  • Directory integrations + forests, HR-source field/attribute mappings, provisioning policies & targets
  • Groups (+ rules/permissions), app roles & policies, Admin RBAC roles/permissions, governance groups
  • Access packages, entitlement catalog, approval chains, SoD policies, OBO delegations, FGA models
  • Flows/journeys, message/app/UI templates, report definitions, notification rules, API keys, saved searches
  • Storage targets & backup schedules, AI settings, security/bot configs

What config backup deliberately excludes: per-user and per-event data — user accounts, sessions, audit logs, sign-in history, access requests, and role/group assignments to specific users. Those are identity data, not portable config, so they ride the Global Data Backup instead.

Secrets & keys

Secrets travel encrypted as stored (under the instance's secret.encryption.key); the bundle records a non-reversible fingerprint of that key, so importing onto a different key warns you that carried secrets won't decrypt there (re-enter them). Signing keys and the license are per-install and are never included.

Global Data Backup (BCP/DR)​

Open Admin → Storage / the Global Data Backup action. This captures the entire database generically — it enumerates every table via the database's own metadata (skipping only system and migration-history tables), so new tables are always included with nothing to keep in sync. Restore runs in a single transaction (foreign-key enforcement suspended, wipe-and-reload per table) against a freshly-migrated, schema-present database.

Storage targets (Local / S3 / Azure Blob) and scheduled backups are configured on the same screens; credentials are encrypted in the vault.

Licensing​

Backup & Restore is a premium capability gated behind the backup_restore feature — available on the Premium and Enterprise tiers (and during the trial). On lower tiers the Backup/Restore and Storage screens show the themed upgrade panel.