diff --git a/src/apps.js b/src/apps.js
index 392e7cad4..16f516a1e 100644
--- a/src/apps.js
+++ b/src/apps.js
@@ -1391,9 +1391,9 @@ function repair(appId, data, auditSource, callback) {
     });
 }
 
-function restore(appId, data, auditSource, callback) {
+function restore(appId, backupId, auditSource, callback) {
     assert.strictEqual(typeof appId, 'string');
-    assert.strictEqual(typeof data, 'object');
+    assert.strictEqual(typeof backupId, 'string');
     assert.strictEqual(typeof auditSource, 'object');
     assert.strictEqual(typeof callback, 'function');
 
@@ -1406,7 +1406,7 @@ function restore(appId, data, auditSource, callback) {
         if (error) return callback(error);
 
         // for empty or null backupId, use existing manifest to mimic a reinstall
-        var func = data.backupId ? backups.get.bind(null, data.backupId) : function (next) { return next(null, { manifest: app.manifest }); };
+        var func = backupId ? backups.get.bind(null, backupId) : function (next) { return next(null, { manifest: app.manifest }); };
 
         func(function (error, backupInfo) {
             if (error) return callback(error);
@@ -1417,7 +1417,7 @@ function restore(appId, data, auditSource, callback) {
             error = checkManifestConstraints(backupInfo.manifest);
             if (error) return callback(error);
 
-            const restoreConfig = { backupId: data.backupId, backupFormat: backupInfo.format, oldManifest: app.manifest };
+            const restoreConfig = { backupId, backupFormat: backupInfo.format, oldManifest: app.manifest };
 
             const task = {
                 args: {
diff --git a/src/routes/apps.js b/src/routes/apps.js
index c8c7eb597..6e47da83a 100644
--- a/src/routes/apps.js
+++ b/src/routes/apps.js
@@ -377,10 +377,9 @@ function restoreApp(req, res, next) {
 
     debug('Restore app id:%s', req.params.id);
 
-    if (!('backupId' in req.body)) return next(new HttpError(400, 'backupId is required'));
-    if (data.backupId !== null && typeof data.backupId !== 'string') return next(new HttpError(400, 'backupId must be string or null'));
+    if (!data.backupId || typeof data.backupId !== 'string') return next(new HttpError(400, 'backupId must be non-empty string'));
 
-    apps.restore(req.params.id, data, auditSource.fromRequest(req), function (error, result) {
+    apps.restore(req.params.id, data.backupId, auditSource.fromRequest(req), function (error, result) {
         if (error) return next(BoxError.toHttpError(error));
 
         next(new HttpSuccess(202, { taskId: result.taskId }));