# Create and protect a snapshot

Take a crash-consistent snapshot of an available or attached volume, wait for it to complete, and protect it so it can be used as a clone source.

Take a snapshot to capture a volume’s data at one point in time. Protect it when you want to create volumes or images from it. You don’t have to detach a volume to snapshot it.

## Before you begin [#before-you-begin]

<BeforeYouBegin>

- The volume’s URN.
- Permission `pvs.snapshot.create` on the volume, and `pvs.snapshot.protect` on the snapshot. See [Roles](/docs/iam/roles).
- A volume that reports `AVAILABLE` or `INUSE`. A volume in `CREATING` is refused, not queued; wait for `AVAILABLE`. A volume in `DELETING`, `DELETED`, or `ERROR` has nothing left to copy.
- An active organization and a billing account that can pay. See [Add a payment method](/docs/platform/billing/payment-method).
- Room in your snapshot quota. See [Limits](/docs/platform/reference/limits).

</BeforeYouBegin>

## Create the snapshot [#create-the-snapshot]

1. If the volume is attached to a running instance, quiesce the filesystem inside the guest when you need more than crash consistency. The snapshot is taken while the instance runs and captures the disk as a sudden power-off would.
1. Create the snapshot.

   ```sh
   origin storage create-snapshot --volume-urn <volume-urn>
   ```

   With the API, use the `createSnapshot` mutation:

   ```graphql
   mutation {
     pvs {
       createSnapshot(input: { volumeUrn: "<volume-urn>" }) {
         urn
         status
       }
     }
   }
   ```

   The snapshot reports `PENDING`. Note its `urn`.

1. Check the snapshot until it reports `status: COMPLETED`.

   ```sh
   origin storage get-snapshot --snapshot-urn <snapshot-urn>
   ```

   If it reports `ERROR`, the copy failed. Delete it and take a new one.

## Protect the snapshot [#protect-the-snapshot]

Protect the snapshot only after it reports `COMPLETED`. A protect request for a `PENDING` snapshot is refused, not queued.

1. Protect the snapshot.

   ```sh
   origin storage protect-snapshot --snapshot-urn <snapshot-urn>
   ```

   With the API, use the `protectSnapshot` mutation:

   ```graphql
   mutation {
     pvs {
       protectSnapshot(input: { snapshotUrn: "<snapshot-urn>" }) {
         accepted
         message
       }
     }
   }
   ```

1. Check the snapshot until it reports `protectionStatus: PROTECTED`.

   ```sh
   origin storage get-snapshot --snapshot-urn <snapshot-urn>
   ```

   If it reports `FAILED`, the protection state is unknown. Protect it again. See [Snapshot states](/docs/storage/snapshots/snapshot-states).

The snapshot is now a clone source: `status: COMPLETED` and `protectionStatus: PROTECTED`.

<Callout type="note">

Keep the snapshot protected for as long as you use anything built on it. The platform doesn’t check whether an image uses the snapshot: once you unprotect or delete it, creating volumes from it and launching instances from an image built on it are refused. See [Delete a snapshot](/docs/storage/snapshots/delete).

</Callout>

## Next steps [#next-steps]

- [Create a volume from a snapshot](/docs/storage/volumes/create#create-a-volume-from-a-snapshot)
- [Create an image](/docs/compute/images/create)

## Related [#related]

- [Snapshot states](/docs/storage/snapshots/snapshot-states)
- [`create-snapshot` command](/docs/storage/reference/cli#create-snapshot)
- [`protect-snapshot` command](/docs/storage/reference/cli#protect-snapshot)