To retrieve data for all tenants (or a specific one) you will need a portal level account that has the access profile of DEF. A portal level user has access to the full API and therefore they can protect/unprotect a tenant machine.
The tenant account can also use the API to retrieve data/perform actions for their own machines. The tenant account does not have access to the portal level calls e.g. create a protection type, add a new location.
The tenant user credentials to access the API reflect the users access rights for that account, any access rights that have been enabled/disabled for the user account for hiding/showing machines or enabling/disabling services will be the same through the UI as the API.
"Getting started with the NetBackup Self Service API" is available with the release documentation and can be found at https://www.veritas.com/support/en_US.html. (Do a search for search for "NetBackup Self Service PDF's" using the Ask a Question field, top right of the screen)
Documentation for the latest version (as of Jan 2017) V8 is available at https://www.veritas.com/support/en_US/article.000116411
