From de86d5709abfbc7d9c880e35b4dd6d79a0f23be7 Mon Sep 17 00:00:00 2001 From: Tom Bojer Date: Wed, 22 Jul 2026 08:23:57 +0200 Subject: [PATCH 1/2] chore: paas native service account grant explanation --- products/paas/shopware/fundamentals/account.md | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/products/paas/shopware/fundamentals/account.md b/products/paas/shopware/fundamentals/account.md index e2f75b444b..9ee7cfe25c 100644 --- a/products/paas/shopware/fundamentals/account.md +++ b/products/paas/shopware/fundamentals/account.md @@ -107,6 +107,10 @@ sw-paas account service-account grant policies sw-paas account service-account grant revoke ``` +:::warning +Service account tokens can have stricter authorization policies than human users. When using a strictly scoped token, specify resources with `--organization-id`, `--project-id`, and `--application-id`. The corresponding `--organization`, `--project`, and `--application` options accept names, which the CLI resolves to IDs through internal list API calls. These lookups require additional permissions that a strictly scoped token might not have. To use resource names instead, grant the service account the `organization:viewer` and `project:viewer` policies. +::: + ## Authentication tokens The `token` command manages access tokens for either your own account or a service account. Personal access tokens can be used for personal scripts. For CI/CD, you should use service accounts. From 276c7160be90580895a90ff94d5efb99b8fdb33a Mon Sep 17 00:00:00 2001 From: Tom Bojer Date: Wed, 22 Jul 2026 10:02:50 +0200 Subject: [PATCH 2/2] chore: paas native snapshot docs --- .../paas/shopware/fundamentals/account.md | 7 +- .../shopware/fundamentals/applications.md | 2 + .../paas/shopware/fundamentals/snapshots.md | 91 +++++++++++++++++++ 3 files changed, 99 insertions(+), 1 deletion(-) create mode 100644 products/paas/shopware/fundamentals/snapshots.md diff --git a/products/paas/shopware/fundamentals/account.md b/products/paas/shopware/fundamentals/account.md index 9ee7cfe25c..7fd1969548 100644 --- a/products/paas/shopware/fundamentals/account.md +++ b/products/paas/shopware/fundamentals/account.md @@ -108,7 +108,12 @@ sw-paas account service-account grant revoke ``` :::warning -Service account tokens can have stricter authorization policies than human users. When using a strictly scoped token, specify resources with `--organization-id`, `--project-id`, and `--application-id`. The corresponding `--organization`, `--project`, and `--application` options accept names, which the CLI resolves to IDs through internal list API calls. These lookups require additional permissions that a strictly scoped token might not have. To use resource names instead, grant the service account the `organization:viewer` and `project:viewer` policies. +Service account tokens can have stricter authorization policies than human users. When using a +strictly scoped token, specify resources with `--organization-id`, `--project-id`, and +`--application-id`. The corresponding `--organization`, `--project`, and `--application` options +accept names, which the CLI resolves to IDs through internal list API calls. These lookups require +additional permissions that a strictly scoped token might not have. To use resource names instead, +grant the service account the `organization:viewer` and `project:viewer` policies. ::: ## Authentication tokens diff --git a/products/paas/shopware/fundamentals/applications.md b/products/paas/shopware/fundamentals/applications.md index 67948708f3..dc422db776 100644 --- a/products/paas/shopware/fundamentals/applications.md +++ b/products/paas/shopware/fundamentals/applications.md @@ -115,6 +115,8 @@ To get details about a given deployment: sw-paas application deploy get ``` +To back up and restore application assets and database data, see [Snapshots](./snapshots.md). + ## Plugin Management Plugin management is done [via Composer](../../../../guides/hosting/installation-updates/extension-management#installing-extensions-with-composer) because the platform runs in a high-availability and clustered environment. diff --git a/products/paas/shopware/fundamentals/snapshots.md b/products/paas/shopware/fundamentals/snapshots.md new file mode 100644 index 0000000000..3a2e30b86b --- /dev/null +++ b/products/paas/shopware/fundamentals/snapshots.md @@ -0,0 +1,91 @@ +--- +nav: + title: Snapshots + position: 65 +--- + +# Snapshots + +Snapshots provide backups of application deployments. Each snapshot consists of a compressed archive containing the application assets and a database dump. + +Use the `sw-paas snapshot` commands to create, inspect, restore, download, and delete snapshots. If +you omit resource identifiers, the CLI prompts you to select the organization, project, application, +deployment, or snapshot where required. + +## Create a snapshot + +Create a snapshot of an application deployment: + +```sh +sw-paas snapshot create +``` + +You can select a deployment and add an optional description directly: + +```sh +sw-paas snapshot create \ + --deployment-id \ + --description "Before updating Shopware" +``` + +## List snapshots + +List the snapshots for an application deployment: + +```sh +sw-paas snapshot list +``` + +To include deleted snapshots in the output, use the `--include-deleted` option: + +```sh +sw-paas snapshot list --include-deleted +``` + +## Get snapshot details + +Display the details of a snapshot: + +```sh +sw-paas snapshot get --snapshot-id +``` + +## Restore a snapshot + +Restore an application deployment from a snapshot: + +```sh +sw-paas snapshot restore --snapshot-id +``` + +## Get a snapshot download URL + +Generate a URL for downloading a snapshot archive: + +```sh +sw-paas snapshot download-url --snapshot-id +``` + +## Delete a snapshot + +Delete a snapshot: + +```sh +sw-paas snapshot delete --snapshot-id +``` + +## Select resources by name + +All snapshot commands support selecting an organization, project, and application by name: + +```sh +sw-paas snapshot list \ + --organization \ + --project \ + --application \ + --deployment-id +``` + +When using a strictly scoped service account token, use resource IDs instead of names or grant the +service account the policies required for name resolution. For more information, see +[Service accounts](./account.md#service-accounts).