This is the multi-page printable view of this section. Click here to print.

Return to the regular view of this page.

AnchoreCTL Reference

AnchoreCTL (anchorectl) is the command-line client for Anchore Enterprise. Every function available in the Anchore Enterprise UI is built on the same APIs that AnchoreCTL calls, so anything you can do in the browser you can also do from a terminal or a CI pipeline.

This is the complete reference for the AnchoreCTL command set: every command group, every subcommand, and every flag with its environment variable and default. Each top-level command group has its own page; the Command Index below links to every individual command. It describes AnchoreCTL v6.2.3; run anchorectl version to check yours.

AnchoreCTL reads its settings from a configuration file, environment variables, and command-line flags, in ascending order of precedence. This page documents the flags; for the configuration file and the full list of ANCHORECTL_* variables, see Configuring AnchoreCTL.

Deploying AnchoreCTL — download and install the binary for Linux, macOS, or Windows.
Configuring AnchoreCTL — the configuration file, environment variables, and how settings are resolved.
AnchoreCTL Release Notes — what changed in each release.

Command Syntax

anchorectl [command] [subcommand] [ARGUMENTS] [flags]

Arguments shown in UPPER_CASE in a command synopsis are positional and required. Anything in [square brackets] is optional. A trailing ..., as in anchorectl image delete IMAGE..., means the argument can be repeated.

In the flag tables on each page, the Flag column shows exactly what you type and the Type column shows the kind of value it takes:

Type	Meaning
`bool`	Takes no value. The flag’s presence turns it on, as in `--wait`.
`string`	Takes one value, as in `--output json`.
`string (repeatable)`	Takes one value and may be given more than once, as in `--annotation owner=platform-team --annotation commit=a3f7c01`.
`int`	Takes a whole number, as in `--timeout 300`.
`count`	Takes no value; repeat it to increase the effect, as in `-vv`.

Global Flags

These four flags are accepted by every command.

Flag	Type	Environment variable	Default	Required	Description
`-c`, `--config`	string	`ANCHORECTL_CONFIG`	`""`	No	Path to the AnchoreCTL configuration file. Bypasses the default search order.
`-h`, `--help`	bool	—	`false`	No	Show help for the command and exit.
`-q`, `--quiet`	bool	`ANCHORECTL_QUIET`	`false`	No	Suppress all logging output. Results are still written to stdout.
`-v`, `--verbose`	count	`ANCHORECTL_VERBOSITY`	`0`	No	Increase log verbosity. `-v` sets `info`, `-vv` sets `debug`. Takes precedence over `log.level`.

The settings that connect you to Anchore Enterprise — url, username, password, and account — have no command-line flags at all. Set them in the configuration file or through ANCHORECTL_URL, ANCHORECTL_USERNAME, ANCHORECTL_PASSWORD, and ANCHORECTL_ACCOUNT. See Configuring AnchoreCTL.

registry add --username and user add --account are unrelated flags with their own variables — the registry’s credential and the new user’s account.

Output Formats

-o/--output selects how results are printed. It is not a global flag — it is defined per command, on 127 of the 148 commands, and the root command does not accept it at all. Values and defaults differ per command; each command’s flag table lists what it accepts. ANCHORECTL_FORMAT sets it on most of them, though anchorectl image sbom, anchorectl system artifact-lifecycle-policy add and update, and anchorectl version ignore the variable and need the flag passed explicitly.

The app version export commands are the main exception. They emit a document rather than a result listing, so they take --format for the document format and --file to write it to disk instead of stdout. anchorectl image one-time-scan likewise uses --format together with --output-directory.

Value	Description
`text`	Human-readable table. The default for most commands.
`json`	Structured JSON, normalized by AnchoreCTL.
`json-raw`	The unmodified JSON response from the Anchore Enterprise API. Use this when you need fields AnchoreCTL does not surface.
`id`	The identifier of the affected object only. Useful for shell pipelines.
`csv`	Comma-separated values, for export commands.
`html`	Self-contained HTML report. Set `ui-url` in your configuration to make the report link back to the Anchore Enterprise UI.
`cyclonedx-json`	CycloneDX document in JSON form.
`cyclonedx-xml`	CycloneDX document in XML form.
`spdx-json`	SPDX document in JSON form.
`spdx-tag-value`	SPDX document in tag-value form.
`syft-json`	Syft’s native JSON SBOM format. The default for `anchorectl image sbom`.
`purls`	A plain list of Package URLs.
`table`	Syft’s table rendering of an SBOM.

--output-directory — available on anchorectl image check, anchorectl image vulnerabilities, and anchorectl image one-time-scan — accepts only json, json-raw, html, and csv. Any other value, including the default text, fails with output directory can only be used with json, json-raw, html, or csv output format.

On anchorectl image vulnerabilities, the cyclonedx-json and cyclonedx-xml formats require an image digest. Passing a tag fails with digest required to call GetImage.

Exit Codes

Code	Meaning
`0`	The command ran successfully.
`1`	The command failed — a request error, invalid input, or an unreachable server.

The exit code reflects whether the command itself ran, not the outcome of a policy evaluation: a fail result is still a successful command and exits 0. To make a failing evaluation break a CI build, pass -f/--fail-based-on-results to anchorectl image check or anchorectl app version policy status get, or --fail-on-policy-error to anchorectl image one-time-scan.

Command Index

Each page below documents that command’s complete subcommand tree, with every flag and argument.

account — Account related operations
airgap — Airgap related operations
app — App related operations
archive — Archive rule and image operations
auth — Auth related operations for the current user
completion — Generate the autocompletion script for anchorectl for the specified shell.
correction — Correction related operations
event — Event related operations
feed — Feed related operations
generate — Generate analysis artifacts locally
image — Image related operations
inventory — Inventory list operation
policy — Policy related operations
registry — Registry credential operations
repo — Repository related operations
stig — STIG related operations
subscription — Subscription related operations
system — System related operations
user — User related operations
usergroup — User Group Management Operations
version — Show anchorectl version information

1 - anchorectl account

Account related operations.

Every command on this page also accepts the global flags.

Subcommands

account add — Create a new account. Only available to admin user.
account delete — Delete the specified account, only allowed if the account is in the disabled state. All users will be deleted along with the account and all resources will be garbage collected
account disable — Disable an account
account enable — Enable a previously disabled account
account get — Get info about an account. Only available to admin user. Uses the main user Id, not a username.
account list — List account summaries. Only available to the system admin user.
account update — Update an account. Only available to admin user.

account add

Create a new account. Only available to admin user.

anchorectl account add NAME [flags]

Arguments

Argument	Description
`NAME`	Name of the account to create.

Flags

Flag	Type	Environment variable	Default	Required	Description
`--email`	string	`ANCHORECTL_ACCOUNT_EMAIL`	`""`	No	The account email.
`-o`, `--output`	string	`ANCHORECTL_FORMAT`	`text`	No	The format to show the results. Allowable values: `text`, `json`, `json-raw`, `id`. See Output Formats.

account delete

Delete the specified account, only allowed if the account is in the disabled state. All users will be deleted along with the account and all resources will be garbage collected.

anchorectl account delete NAME [flags]

Aliases: del

Arguments

Argument	Description
`NAME`	Name of the account.

Flags

Flag	Type	Environment variable	Default	Required	Description
`-o`, `--output`	string	`ANCHORECTL_FORMAT`	`text`	No	The format to show the results. Allowable values: `text`, `json`, `json-raw`, `id`. See Output Formats.

account disable

Disable an account.

anchorectl account disable NAME [flags]

Arguments

Argument	Description
`NAME`	Name of the account.

Flags

Flag	Type	Environment variable	Default	Required	Description
`-o`, `--output`	string	`ANCHORECTL_FORMAT`	`text`	No	The format to show the results. Allowable values: `text`, `json`, `json-raw`, `id`. See Output Formats.

account enable

Enable a previously disabled account.

anchorectl account enable NAME [flags]

Arguments

Argument	Description
`NAME`	Name of the account.

Flags

Flag	Type	Environment variable	Default	Required	Description
`-o`, `--output`	string	`ANCHORECTL_FORMAT`	`text`	No	The format to show the results. Allowable values: `text`, `json`, `json-raw`, `id`. See Output Formats.

account get

Get info about an account. Only available to admin user. Uses the main user Id, not a username.

anchorectl account get NAME [flags]

Arguments

Argument	Description
`NAME`	Name of account.

Flags

Flag	Type	Environment variable	Default	Required	Description
`-o`, `--output`	string	`ANCHORECTL_FORMAT`	`text`	No	The format to show the results. Allowable values: `text`, `json`, `json-raw`, `id`. See Output Formats.

account list

List account summaries. Only available to the system admin user.

anchorectl account list [flags]

Flags

Flag	Type	Environment variable	Default	Required	Description
`-o`, `--output`	string	`ANCHORECTL_FORMAT`	`text`	No	The format to show the results. Allowable values: `text`, `json`, `json-raw`, `id`. See Output Formats.
`--state`	string	`ANCHORECTL_ACCOUNT_STATE`	`""`	No	Filter accounts by state. Allowable values: `enabled`, `disabled`, `deleting`.

account update

Update an account. Only available to admin user.

anchorectl account update NAME [flags]

Arguments

Argument	Description
`NAME`	Name of the account.

Flags

Flag	Type	Environment variable	Default	Required	Description
`--email`	string	`ANCHORECTL_ACCOUNT_EMAIL`	`""`	No	The account email.
`-o`, `--output`	string	`ANCHORECTL_FORMAT`	`text`	No	The format to show the results. Allowable values: `text`, `json`, `json-raw`, `id`. See Output Formats.

2 - anchorectl airgap

Airgap related operations.

Every command on this page also accepts the global flags.

Subcommands

airgap feed — Feed related operations

airgap feed

Feed related operations.

anchorectl airgap feed [command]

Subcommands

airgap feed download — Check for updates to Hosted Feeds and download the latest changes
airgap feed upload — Upload the specified feedset into Anchore Enterprise

airgap feed download

Check for updates to Hosted Feeds and download the latest changes.

anchorectl airgap feed download [flags]

Flags

Flag	Type	Environment variable	Default	Required	Description
`-f`, `--file`	string	`ANCHORECTL_FEEDS_FILE`	`""`	No	The file path to create or update a feedset archive.
`-k`, `--key`	string	`ANCHORECTL_API_KEY`	`""`	No	The API key to authorize the request.
`-l`, `--license`	string	`ANCHORECTL_LICENSE_FILE`	`""`	No	The path to an Anchore license file.
`-o`, `--output`	string	`ANCHORECTL_FORMAT`	`text`	No	The format to show the results. Allowable values: `text`, `json`, `json-raw`. See Output Formats.
`-r`, `--retries`	int	`ANCHORECTL_RETRIES`	`3`	No	The number of times to retry a failed download.

airgap feed upload

Upload the specified feedset into Anchore Enterprise.

anchorectl airgap feed upload [flags]

Flags

Flag	Type	Environment variable	Default	Required	Description
`-f`, `--file`	string	`ANCHORECTL_INPUT_FILE`	`""`	Yes	Path to a previously downloaded feedset archive.
`--force`	bool	`ANCHORECTL_FORCE`	`false`	No	Perform feed upload even if checksums match.
`-o`, `--output`	string	`ANCHORECTL_FORMAT`	`text`	No	The format to show the results. Allowable values: `text`, `json`, `json-raw`. See Output Formats.

3 - anchorectl app

App related operations.

Every command on this page also accepts the global flags.

Subcommands

app add — Create a new app
app delete — Delete an app by name or ID
app get — Get an app by name or ID
app job — Job operations for an app
app list — List all apps
app update — Update an existing app
app version — App version related operations

app add

Create a new app.

anchorectl app add NAME [flags]

Arguments

Argument	Description
`NAME`	The name of the app.

Flags

Flag	Type	Environment variable	Default	Required	Description
`--contact-name`	string	`ANCHORECTL_CONTACT_NAME`	`""`	Yes	Contact person name.
`--contact-email`	string	`ANCHORECTL_CONTACT_EMAIL`	`""`	No	Contact email address.
`--contact-phone`	string	`ANCHORECTL_CONTACT_PHONE`	`""`	No	Contact phone number.
`--description`	string	`ANCHORECTL_DESCRIPTION`	`""`	No	The description of the app.
`-o`, `--output`	string	`ANCHORECTL_FORMAT`	`text`	No	The format to show the results. Allowable values: `text`, `json`, `json-raw`, `id`. See Output Formats.
`--policy-id`	string	`ANCHORECTL_POLICY_ID`	`""`	No	The policy name or ID to associate with the app.

app delete

Delete an app by name or ID.

anchorectl app delete APP [flags]

Aliases: del

Arguments

Argument	Description
`APP`	The app name or ID.

Flags

Flag	Type	Environment variable	Default	Required	Description
`--force`	bool	`ANCHORECTL_FORCE`	`false`	No	Force delete (removes all versions and associations).
`-o`, `--output`	string	`ANCHORECTL_FORMAT`	`text`	No	The format to show the results. Allowable values: `text`, `json`, `json-raw`, `id`. See Output Formats.

app get

Get an app by name or ID.

anchorectl app get APP [flags]

Arguments

Argument	Description
`APP`	The app name or ID.

Flags

Flag	Type	Environment variable	Default	Required	Description
`-o`, `--output`	string	`ANCHORECTL_FORMAT`	`text`	No	The format to show the results. Allowable values: `text`, `json`, `json-raw`, `id`. See Output Formats.

app job

Job operations for an app.

anchorectl app job [command]

Subcommands

app job cancel — Cancel a job
app job get — Get a job by ID. Pass --detail with -o json-raw to fetch the type-specific job payload (job_spec, completion_detail, etc.).
app job list — List jobs for an app

app job cancel

Cancel a job.

anchorectl app job cancel JOB_ID [flags]

Arguments

Argument	Description
`JOB_ID`	The job UUID.

Flags

Flag	Type	Environment variable	Default	Required	Description
`--app`	string	`ANCHORECTL_APP`	`""`	Yes	The app name or ID.
`-o`, `--output`	string	`ANCHORECTL_FORMAT`	`text`	No	The format to show the results. Allowable values: `text`, `json`, `json-raw`, `id`. See Output Formats.

app job get

Get a job by ID. Pass --detail with -o json-raw to fetch the type-specific job payload (job_spec, completion_detail, etc.).

anchorectl app job get JOB_ID [flags]

Arguments

Argument	Description
`JOB_ID`	The job UUID.

Flags

Flag	Type	Environment variable	Default	Required	Description
`--app`	string	`ANCHORECTL_APP`	`""`	Yes	The app name or ID.
`--detail`	bool	`ANCHORECTL_DETAIL`	`false`	No	Fetch the type-specific job payload (requires `-o` json-raw).
`-o`, `--output`	string	`ANCHORECTL_FORMAT`	`text`	No	The format to show the results. Allowable values: `text`, `json`, `json-raw`, `id`. See Output Formats.

app job list

List jobs for an app.

anchorectl app job list APP [flags]

Arguments

Argument	Description
`APP`	The app name or ID.

Flags

Flag	Type	Environment variable	Default	Required	Description
`--created-since`	string	`ANCHORECTL_CREATED_SINCE`	`""`	No	Only show jobs created since: Go duration syntax (units s/m/h, e.g. “30m”, “1h”, “2h45m”, “1.5h”) or a datetime (“2026-04-15”, “2026-04-15 09:00:00”, “2026-04-15T09:00:00Z”). Bare datetimes are interpreted in local time.
`--mine`	bool	`ANCHORECTL_MINE`	`false`	No	Only show jobs owned by the current user.
`-o`, `--output`	string	`ANCHORECTL_FORMAT`	`text`	No	The format to show the results. Allowable values: `text`, `json`, `json-raw`, `id`. See Output Formats.
`--status`	string (repeatable)	`ANCHORECTL_STATUS`	`[]`	No	Filter by job status (comma-separated for multiple, OR semantics). Allowable values: `pending`, `processing`, `cancelled`, `complete`, `failed`.
`--version`	string	`ANCHORECTL_VERSION`	`""`	No	Filter by version name or UUID.

app list

List all apps.

anchorectl app list [flags]

Flags

Flag	Type	Environment variable	Default	Required	Description
`--name`	string	`ANCHORECTL_NAME`	`""`	No	Filter by exact app name.
`-o`, `--output`	string	`ANCHORECTL_FORMAT`	`text`	No	The format to show the results. Allowable values: `text`, `json`, `json-raw`, `id`. See Output Formats.

app update

Update an existing app.

anchorectl app update APP [flags]

Arguments

Argument	Description
`APP`	The app name or ID.

Flags

Flag	Type	Environment variable	Default	Required	Description
`--contact-email`	string	`ANCHORECTL_CONTACT_EMAIL`	`""`	No	Contact email address.
`--contact-name`	string	`ANCHORECTL_CONTACT_NAME`	`""`	No	Contact person name.
`--contact-phone`	string	`ANCHORECTL_CONTACT_PHONE`	`""`	No	Contact phone number.
`--description`	string	`ANCHORECTL_DESCRIPTION`	`""`	No	The new description.
`--name`	string	`ANCHORECTL_NAME`	`""`	No	The new name for the app.
`-o`, `--output`	string	`ANCHORECTL_FORMAT`	`text`	No	The format to show the results. Allowable values: `text`, `json`, `json-raw`, `id`. See Output Formats.
`--policy-id`	string	`ANCHORECTL_POLICY_ID`	`""`	No	The policy name or ID to associate.

app version

App version related operations.

anchorectl app version [command]

Subcommands

app version add — Create a new app version
app version asset — App version asset operations
app version delete — Delete an app version by name or ID
app version export — Export documents for an app version
app version get — Get an app version by name or ID
app version list — List all versions of an app
app version package — App version package operations
app version policy — App version policy operations
app version update — Update an existing app version
app version vex — VEX annotation operations for an app version
app version vuln — App version vulnerability operations

app version add

Create a new app version.

anchorectl app version add NAME [flags]

Arguments

Argument	Description
`NAME`	The name of the version.

Examples

# Create a released version of an app
anchorectl app version add 1.4.0 --app my-service --status released

# Create the next version and chain it to its predecessor
anchorectl app version add 1.5.0 --app my-service --status in_progress --previous-version 1.4.0

Flags

Flag	Type	Environment variable	Default	Required	Description
`--app`	string	`ANCHORECTL_APP`	`""`	Yes	The app name or ID.
`--description`	string	`ANCHORECTL_DESCRIPTION`	`""`	No	The version description.
`-o`, `--output`	string	`ANCHORECTL_FORMAT`	`text`	No	The format to show the results. Allowable values: `text`, `json`, `json-raw`, `id`. See Output Formats.
`--previous-version`	string	`ANCHORECTL_PREVIOUS_VERSION`	`""`	No	The previous version name or UUID.
`--release-date`	string	`ANCHORECTL_RELEASE_DATE`	`""`	No	Date of release of this version (e.g. 2026-01-15).
`--status`	string	`ANCHORECTL_STATUS`	`""`	No	The status of the app version (in_progress, released, eol).

app version asset

App version asset operations.

anchorectl app version asset [command]

Subcommands

app version asset add — Add an asset to an app version
app version asset delete — Delete an asset from an app version
app version asset get — Get an asset by ID for an app version
app version asset list — List assets for an app version
app version asset sbom — App version asset SBOM operations
app version asset update — Update an asset for an app version

app version asset add

Add an asset to an app version.

anchorectl app version asset add [command]

Subcommands

app version asset add analysis-bundle — Upload an analysis bundle produced by anchorectl generate analysis-bundle as an asset to an app version. Creates a job to import and process the analysis.
app version asset add container-image — Add a container image as an asset. By default pulls from a registry. Use --from docker or --from podman to analyze a local daemon image, or --from docker-archive:/path/to.tar to load from an archive.
app version asset add container-image-remote — Add a container image via centralized analysis. Enterprise pulls and analyzes the image from the registry.
app version asset add filesystem — Add a filesystem directory as an asset. Analyzes the directory locally using Syft, generates an SBOM, and uploads it to Enterprise.
app version asset add sbom — Upload an SBOM file as an asset to an app version. Creates a job to import and process the SBOM.

app version asset add analysis-bundle

Upload an analysis bundle produced by anchorectl generate analysis-bundle as an asset to an app version. Creates a job to import and process the analysis.

anchorectl app version asset add analysis-bundle BUNDLE [flags]

Arguments

Argument	Description
`BUNDLE`	Path to the analysis bundle tar archive (uncompressed; typically named .tar).

Flags

Flag	Type	Environment variable	Default	Required	Description
`--app`	string	`ANCHORECTL_APP`	`""`	Yes	The app name or ID.
`--asset`	string	`ANCHORECTL_ASSET`	`""`	Yes	The name for the new asset.
`--version`	string	`ANCHORECTL_VERSION`	`""`	Yes	The version name or UUID.
`-a`, `--annotations`	string	`ANCHORECTL_ANNOTATIONS`	`""`	No	Annotations as comma-separated key=value pairs.
`-o`, `--output`	string	`ANCHORECTL_FORMAT`	`text`	No	The format to show the results. Allowable values: `text`, `json`, `json-raw`, `id`. See Output Formats.
`-t`, `--type`	string	`ANCHORECTL_TYPE`	`unknown`	No	The asset type (image analysis bundles default to container).
`-w`, `--wait`	bool	`ANCHORECTL_WAIT`	`false`	No	Wait for the job to complete before returning.

app version asset add container-image

Add a container image as an asset. By default pulls from a registry. Use --from docker or --from podman to analyze a local daemon image, or --from docker-archive:/path/to.tar to load from an archive.

anchorectl app version asset add container-image IMAGE [flags]

Arguments

Argument	Description
`IMAGE`	The container image reference (e.g. docker.io/library/nginx:latest).

Flags

Flag	Type	Environment variable	Default	Required	Description
`--app`	string	`ANCHORECTL_APP`	`""`	Yes	The app name or ID.
`--asset`	string	`ANCHORECTL_ASSET`	`""`	Yes	The name for the new asset.
`--version`	string	`ANCHORECTL_VERSION`	`""`	Yes	The version name or UUID.
`-a`, `--annotations`	string	`ANCHORECTL_ANNOTATIONS`	`""`	No	Annotations as comma-separated key=value pairs.
`--dockerfile`	string	`ANCHORECTL_DOCKERFILE`	`""`	No	Path to the Dockerfile used to build the image.
`--from`	string	`ANCHORECTL_FROM`	`""`	No	Image source: registry (default), docker, podman, or docker-archive:`<path>` (docker and podman: if the image is not present in the daemon it is pulled from the registry).
`-o`, `--output`	string	`ANCHORECTL_FORMAT`	`text`	No	The format to show the results. Allowable values: `text`, `json`, `json-raw`, `id`. See Output Formats.
`-p`, `--platform`	string	`ANCHORECTL_PLATFORM`	`""`	No	Platform specifier (e.g. linux/amd64).
`-t`, `--type`	string	`ANCHORECTL_TYPE`	`container`	No	The asset type.
`-w`, `--wait`	bool	`ANCHORECTL_WAIT`	`false`	No	Wait for the job to complete before returning.

app version asset add container-image-remote

Add a container image via centralized analysis. Enterprise pulls and analyzes the image from the registry.

anchorectl app version asset add container-image-remote IMAGE [flags]

Arguments

Argument	Description
`IMAGE`	The container image reference (e.g. docker.io/library/nginx:latest).

Examples

anchorectl app version asset add container-image-remote registry.example.com/my-service:1.4.0 \
  --app my-service --version 1.4.0 --asset api-image --wait

Flags

Flag	Type	Environment variable	Default	Required	Description
`--app`	string	`ANCHORECTL_APP`	`""`	Yes	The app name or ID.
`--asset`	string	`ANCHORECTL_ASSET`	`""`	Yes	The name for the new asset.
`--version`	string	`ANCHORECTL_VERSION`	`""`	Yes	The version name or UUID.
`-a`, `--annotations`	string	`ANCHORECTL_ANNOTATIONS`	`""`	No	Annotations as comma-separated key=value pairs.
`--dockerfile`	string	`ANCHORECTL_DOCKERFILE`	`""`	No	Path to the Dockerfile used to build the image.
`-o`, `--output`	string	`ANCHORECTL_FORMAT`	`text`	No	The format to show the results. Allowable values: `text`, `json`, `json-raw`, `id`. See Output Formats.
`-t`, `--type`	string	`ANCHORECTL_TYPE`	`container`	No	The asset type.
`-w`, `--wait`	bool	`ANCHORECTL_WAIT`	`false`	No	Wait for the job to complete before returning.

app version asset add filesystem

Add a filesystem directory as an asset. Analyzes the directory locally using Syft, generates an SBOM, and uploads it to Enterprise.

anchorectl app version asset add filesystem DIRECTORY [flags]

Arguments

Argument	Description
`DIRECTORY`	The path to the directory to analyze (e.g. /mnt/unpacked-vm, ./myapp).

Flags

Flag	Type	Environment variable	Default	Required	Description
`--app`	string	`ANCHORECTL_APP`	`""`	Yes	The app name or ID.
`--asset`	string	`ANCHORECTL_ASSET`	`""`	Yes	The name for the new asset.
`--version`	string	`ANCHORECTL_VERSION`	`""`	Yes	The version name or UUID.
`-a`, `--annotations`	string	`ANCHORECTL_ANNOTATIONS`	`""`	No	Annotations as comma-separated key=value pairs.
`--author`	string	`ANCHORECTL_AUTHOR`	`unknown`	No	SBOM document author (e.g. “Name `<email>`”).
`-o`, `--output`	string	`ANCHORECTL_FORMAT`	`text`	No	The format to show the results. Allowable values: `text`, `json`, `json-raw`, `id`. See Output Formats.
`--supplier`	string	`ANCHORECTL_SUPPLIER`	`unknown`	No	SBOM document supplier name.
`-t`, `--type`	string	`ANCHORECTL_TYPE`	`filesystem`	No	The asset type.
`-w`, `--wait`	bool	`ANCHORECTL_WAIT`	`false`	No	Wait for the job to complete before returning.

app version asset add sbom

Upload an SBOM file as an asset to an app version. Creates a job to import and process the SBOM.

anchorectl app version asset add sbom SBOM_FILE [flags]

Arguments

Argument	Description
`SBOM_FILE`	Path to the SBOM file.

Flags

Flag	Type	Environment variable	Default	Required	Description
`--app`	string	`ANCHORECTL_APP`	`""`	Yes	The app name or ID.
`--asset`	string	`ANCHORECTL_ASSET`	`""`	Yes	The name for the new asset.
`--version`	string	`ANCHORECTL_VERSION`	`""`	Yes	The version name or UUID.
`-a`, `--annotations`	string	`ANCHORECTL_ANNOTATIONS`	`""`	No	Annotations as comma-separated key=value pairs.
`-o`, `--output`	string	`ANCHORECTL_FORMAT`	`text`	No	The format to show the results. Allowable values: `text`, `json`, `json-raw`, `id`. See Output Formats.
`-t`, `--type`	string	`ANCHORECTL_TYPE`	`unknown`	No	The asset type.
`-w`, `--wait`	bool	`ANCHORECTL_WAIT`	`false`	No	Wait for the job to complete before returning.

app version asset delete

Delete an asset from an app version.

anchorectl app version asset delete ASSET [flags]

Arguments

Argument	Description
`ASSET`	The asset name or UUID.

Flags

Flag	Type	Environment variable	Default	Required	Description
`--app`	string	`ANCHORECTL_APP`	`""`	Yes	The app name or ID.
`--version`	string	`ANCHORECTL_VERSION`	`""`	Yes	The version name or UUID.
`-o`, `--output`	string	`ANCHORECTL_FORMAT`	`text`	No	The format to show the results. Allowable values: `text`, `json`, `json-raw`, `id`. See Output Formats.

app version asset get

Get an asset by ID for an app version.

anchorectl app version asset get ASSET [flags]

Arguments

Argument	Description
`ASSET`	The asset name or UUID.

Flags

Flag	Type	Environment variable	Default	Required	Description
`--app`	string	`ANCHORECTL_APP`	`""`	Yes	The app name or ID.
`--version`	string	`ANCHORECTL_VERSION`	`""`	Yes	The version name or UUID.
`-o`, `--output`	string	`ANCHORECTL_FORMAT`	`text`	No	The format to show the results. Allowable values: `text`, `json`, `json-raw`, `id`. See Output Formats.

app version asset list

List assets for an app version.

anchorectl app version asset list VERSION [flags]

Arguments

Argument	Description
`VERSION`	The version name or UUID.

Flags

Flag	Type	Environment variable	Default	Required	Description
`--app`	string	`ANCHORECTL_APP`	`""`	Yes	The app name or ID.
`--name`	string	`ANCHORECTL_NAME`	`""`	No	Filter by asset name.
`-o`, `--output`	string	`ANCHORECTL_FORMAT`	`text`	No	The format to show the results. Allowable values: `text`, `json`, `json-raw`, `id`. See Output Formats.

app version asset sbom

App version asset SBOM operations.

anchorectl app version asset sbom [command]

Subcommands

app version asset sbom get — Get the SBOM for an asset in an app version

app version asset sbom get

Get the SBOM for an asset in an app version.

anchorectl app version asset sbom get ASSET [flags]

Arguments

Argument	Description
`ASSET`	The asset name or UUID.

Flags

Flag	Type	Environment variable	Default	Required	Description
`--app`	string	`ANCHORECTL_APP`	`""`	Yes	The app name or ID.
`--version`	string	`ANCHORECTL_VERSION`	`""`	Yes	The version name or UUID.
`-f`, `--file`	string	`ANCHORECTL_FILE`	`""`	No	Write SBOM to file instead of stdout.

app version asset update

Update an asset for an app version.

anchorectl app version asset update ASSET [flags]

Arguments

Argument	Description
`ASSET`	The asset name or UUID.

Flags

Flag	Type	Environment variable	Default	Required	Description
`--app`	string	`ANCHORECTL_APP`	`""`	Yes	The app name or ID.
`--version`	string	`ANCHORECTL_VERSION`	`""`	Yes	The version name or UUID.
`--annotations`	string	`ANCHORECTL_ANNOTATIONS`	`""`	No	Annotations as comma-separated key=value pairs (merge with existing, set value to empty to remove).
`--name`	string	`ANCHORECTL_NAME`	`""`	No	The new name for the asset.
`-o`, `--output`	string	`ANCHORECTL_FORMAT`	`text`	No	The format to show the results. Allowable values: `text`, `json`, `json-raw`, `id`. See Output Formats.
`--type`	string	`ANCHORECTL_TYPE`	`""`	No	The asset type.

app version delete

Delete an app version by name or ID.

anchorectl app version delete VERSION [flags]

Aliases: del

Arguments

Argument	Description
`VERSION`	The version name or UUID.

Flags

Flag	Type	Environment variable	Default	Required	Description
`--app`	string	`ANCHORECTL_APP`	`""`	Yes	The app name or ID.
`--force`	bool	`ANCHORECTL_FORCE`	`false`	No	Force delete (removes all associations).

app version export

Export documents for an app version.

anchorectl app version export [command]

Subcommands

app version export packages — Export package data for an app version. Creates an export job, waits for completion, and outputs the result.
app version export policy-compliance — Export policy compliance findings for an app version. Creates an export job, waits for completion, and outputs the result.
app version export sbom-cyclonedx-1 — Export a combined CycloneDX 1.x JSON SBOM for an app version. Creates an export job, waits for completion, and outputs the result.
app version export sbom-spdx-2 — Export a combined SPDX 2.x JSON SBOM for an app version. Creates an export job, waits for completion, and outputs the result.
app version export vdr — Export a CycloneDX VDR (Vulnerability Disclosure Report) for an app version. Creates an export job, waits for completion, and outputs the result.
app version export vex — Export VEX (Vulnerability Exploitability eXchange) annotations for an app version. Creates an export job, waits for completion, and outputs the result.
app version export vulnerabilities — Export vulnerability data for an app version. Creates an export job, waits for completion, and outputs the result.

app version export packages

Export package data for an app version. Creates an export job, waits for completion, and outputs the result.

anchorectl app version export packages VERSION [flags]

Arguments

Argument	Description
`VERSION`	The version name or UUID.

Flags

Flag	Type	Environment variable	Default	Required	Description
`--app`	string	`ANCHORECTL_APP`	`""`	Yes	The app name or ID.
`-f`, `--file`	string	`ANCHORECTL_FILE`	`""`	No	Write output to file instead of stdout.
`--format`	string	`ANCHORECTL_FORMAT`	`csv`	No	The export format. Allowable values: `csv`.

app version export policy-compliance

Export policy compliance findings for an app version. Creates an export job, waits for completion, and outputs the result.

anchorectl app version export policy-compliance VERSION [flags]

Arguments

Argument	Description
`VERSION`	The version name or UUID.

Flags

Flag	Type	Environment variable	Default	Required	Description
`--app`	string	`ANCHORECTL_APP`	`""`	Yes	The app name or ID.
`-f`, `--file`	string	`ANCHORECTL_FILE`	`""`	No	Write output to file instead of stdout.
`--format`	string	`ANCHORECTL_FORMAT`	`csv`	No	The export format. Allowable values: `csv`.

app version export sbom-cyclonedx-1

Export a combined CycloneDX 1.x JSON SBOM for an app version. Creates an export job, waits for completion, and outputs the result.

anchorectl app version export sbom-cyclonedx-1 VERSION [flags]

Arguments

Argument	Description
`VERSION`	The version name or UUID.

Flags

Flag	Type	Environment variable	Default	Required	Description
`--app`	string	`ANCHORECTL_APP`	`""`	Yes	The app name or ID.
`-f`, `--file`	string	`ANCHORECTL_FILE`	`""`	No	Write output to file instead of stdout.

app version export sbom-spdx-2

Export a combined SPDX 2.x JSON SBOM for an app version. Creates an export job, waits for completion, and outputs the result.

anchorectl app version export sbom-spdx-2 VERSION [flags]

Arguments

Argument	Description
`VERSION`	The version name or UUID.

Flags

Flag	Type	Environment variable	Default	Required	Description
`--app`	string	`ANCHORECTL_APP`	`""`	Yes	The app name or ID.
`-f`, `--file`	string	`ANCHORECTL_FILE`	`""`	No	Write output to file instead of stdout.

app version export vdr

Export a CycloneDX VDR (Vulnerability Disclosure Report) for an app version. Creates an export job, waits for completion, and outputs the result.

anchorectl app version export vdr VERSION [flags]

Arguments

Argument	Description
`VERSION`	The version name or UUID.

Flags

Flag	Type	Environment variable	Default	Required	Description
`--app`	string	`ANCHORECTL_APP`	`""`	Yes	The app name or ID.
`-f`, `--file`	string	`ANCHORECTL_FILE`	`""`	No	Write output to file instead of stdout.
`--format`	string	`ANCHORECTL_FORMAT`	`cyclonedx-json`	No	The export format. Allowable values: `cyclonedx-json`.

app version export vex

Export VEX (Vulnerability Exploitability eXchange) annotations for an app version. Creates an export job, waits for completion, and outputs the result.

anchorectl app version export vex VERSION [flags]

Arguments

Argument	Description
`VERSION`	The version name or UUID.

Flags

Flag	Type	Environment variable	Default	Required	Description
`--app`	string	`ANCHORECTL_APP`	`""`	Yes	The app name or ID.
`-f`, `--file`	string	`ANCHORECTL_FILE`	`""`	No	Write output to file instead of stdout.
`--format`	string	`ANCHORECTL_FORMAT`	`cyclonedx-json`	No	The export format. Allowable values: `cyclonedx-json`.

app version export vulnerabilities

Export vulnerability data for an app version. Creates an export job, waits for completion, and outputs the result.

anchorectl app version export vulnerabilities VERSION [flags]

Arguments

Argument	Description
`VERSION`	The version name or UUID.

Flags

Flag	Type	Environment variable	Default	Required	Description
`--app`	string	`ANCHORECTL_APP`	`""`	Yes	The app name or ID.
`-f`, `--file`	string	`ANCHORECTL_FILE`	`""`	No	Write output to file instead of stdout.
`--format`	string	`ANCHORECTL_FORMAT`	`csv`	No	The export format. Allowable values: `csv`.

app version get

Get an app version by name or ID.

anchorectl app version get VERSION [flags]

Arguments

Argument	Description
`VERSION`	The version name or UUID.

Flags

Flag	Type	Environment variable	Default	Required	Description
`--app`	string	`ANCHORECTL_APP`	`""`	Yes	The app name or ID.
`-o`, `--output`	string	`ANCHORECTL_FORMAT`	`text`	No	The format to show the results. Allowable values: `text`, `json`, `json-raw`, `id`. See Output Formats.

app version list

List all versions of an app.

anchorectl app version list APP [flags]

Arguments

Argument	Description
`APP`	The app name or ID.

Flags

Flag	Type	Environment variable	Default	Required	Description
`--name`	string	`ANCHORECTL_NAME`	`""`	No	Filter by exact version name.
`-o`, `--output`	string	`ANCHORECTL_FORMAT`	`text`	No	The format to show the results. Allowable values: `text`, `json`, `json-raw`, `id`. See Output Formats.

app version package

App version package operations.

anchorectl app version package [command]

Subcommands

app version package list — List packages for an app version

app version package list

List packages for an app version.

anchorectl app version package list VERSION [flags]

Arguments

Argument	Description
`VERSION`	The version name or UUID.

Flags

Flag	Type	Environment variable	Default	Required	Description
`--app`	string	`ANCHORECTL_APP`	`""`	Yes	The app name or ID.
`-o`, `--output`	string	`ANCHORECTL_FORMAT`	`text`	No	The format to show the results. Allowable values: `text`, `json`, `json-raw`, `id`. See Output Formats.

app version policy

App version policy operations.

anchorectl app version policy [command]

Subcommands

app version policy findings — App version policy findings operations
app version policy status — App version policy status operations

app version policy findings

App version policy findings operations.

anchorectl app version policy findings [command]

Subcommands

app version policy findings list — List policy findings for an app version

app version policy findings list

List policy findings for an app version.

anchorectl app version policy findings list VERSION [flags]

Arguments

Argument	Description
`VERSION`	The version name or UUID.

Flags

Flag	Type	Environment variable	Default	Required	Description
`--app`	string	`ANCHORECTL_APP`	`""`	Yes	The app name or ID.
`-o`, `--output`	string	`ANCHORECTL_FORMAT`	`text`	No	The format to show the results. Allowable values: `text`, `json`, `json-raw`, `id`. See Output Formats.

app version policy status

App version policy status operations.

anchorectl app version policy status [command]

Subcommands

app version policy status get — Get policy evaluation status for an app version

app version policy status get

Get policy evaluation status for an app version.

anchorectl app version policy status get VERSION [flags]

Arguments

Argument	Description
`VERSION`	The version name or UUID.

Flags

Flag	Type	Environment variable	Default	Required	Description
`--app`	string	`ANCHORECTL_APP`	`""`	Yes	The app name or ID.
`-f`, `--fail-based-on-results`	bool	`ANCHORECTL_FAIL_BASED_ON_RESULTS`	`false`	No	Set the return code to 1 if the policy evaluation result shows as `fail`.
`-o`, `--output`	string	`ANCHORECTL_FORMAT`	`text`	No	The format to show the results. Allowable values: `text`, `json`, `json-raw`, `id`. See Output Formats.

app version update

Update an existing app version.

anchorectl app version update VERSION [flags]

Arguments

Argument	Description
`VERSION`	The version name or UUID.

Flags

Flag	Type	Environment variable	Default	Required	Description
`--app`	string	`ANCHORECTL_APP`	`""`	Yes	The app name or ID.
`--description`	string	`ANCHORECTL_DESCRIPTION`	`""`	No	The new description.
`--name`	string	`ANCHORECTL_NAME`	`""`	No	The new name for the version.
`-o`, `--output`	string	`ANCHORECTL_FORMAT`	`text`	No	The format to show the results. Allowable values: `text`, `json`, `json-raw`, `id`. See Output Formats.
`--previous-version`	string	`ANCHORECTL_PREVIOUS_VERSION`	`""`	No	The previous version name or UUID.
`--release-date`	string	`ANCHORECTL_RELEASE_DATE`	`""`	No	Date of release of this version (e.g. 2026-01-15).
`--status`	string	`ANCHORECTL_STATUS`	`""`	No	The status of the app version (in_progress, released, eol).

app version vex

VEX annotation operations for an app version.

anchorectl app version vex [command]

Subcommands

app version vex add — Add a VEX annotation to an app version
app version vex delete — Delete a VEX annotation
app version vex get — Get a VEX annotation by ID
app version vex list — List VEX annotations for an app
app version vex update — Update a VEX annotation

app version vex add

Add a VEX annotation to an app version.

anchorectl app version vex add VERSION [flags]

Arguments

Argument	Description
`VERSION`	The version name or UUID.

Flags

Flag	Type	Environment variable	Default	Required	Description
`--app`	string	`ANCHORECTL_APP`	`""`	Yes	The app name or ID.
`--pkg-name`	string	`ANCHORECTL_PKG_NAME`	`""`	Yes	The package name.
`--pkg-type`	string	`ANCHORECTL_PKG_TYPE`	`""`	Yes	The package type (e.g. java-archive, npm, python).
`--pkg-version`	string	`ANCHORECTL_PKG_VERSION`	`""`	Yes	The package version.
`--status`	string	`ANCHORECTL_STATUS`	`""`	Yes	The VEX status. Allowable values: `not_affected`, `affected`, `fixed`, `under_investigation`.
`--vuln-id`	string	`ANCHORECTL_VULN_ID`	`""`	Yes	The vulnerability ID (e.g. CVE-2021-44228).
`--action-statement`	string	`ANCHORECTL_ACTION_STATEMENT`	`""`	No	Action statement for remediation.
`--additional-details`	string	`ANCHORECTL_ADDITIONAL_DETAILS`	`""`	No	Free-form additional details.
`--impact-statement`	string	`ANCHORECTL_IMPACT_STATEMENT`	`""`	No	Impact statement for the vulnerability.
`--justification`	string	`ANCHORECTL_JUSTIFICATION`	`""`	No	Justification for not_affected status. Allowable values: `component_not_present`, `vulnerable_code_not_present`, `vulnerable_code_not_in_execute_path`, `vulnerable_code_cannot_be_controlled_by_adversary`, `inline_mitigations_already_exist`.
`-o`, `--output`	string	`ANCHORECTL_FORMAT`	`text`	No	The format to show the results. Allowable values: `text`, `json`, `json-raw`, `id`. See Output Formats.
`--status-notes`	string	`ANCHORECTL_STATUS_NOTES`	`""`	No	Additional notes about the status.

app version vex delete

Delete a VEX annotation.

anchorectl app version vex delete VULN_ANNOTATION_ID [flags]

Aliases: del

Arguments

Argument	Description
`VULN_ANNOTATION_ID`	The VEX annotation UUID.

Flags

Flag	Type	Environment variable	Default	Required	Description
`--app`	string	`ANCHORECTL_APP`	`""`	Yes	The app name or ID.
`--version`	string	`ANCHORECTL_VERSION`	`""`	Yes	The version name or UUID.
`-o`, `--output`	string	`ANCHORECTL_FORMAT`	`text`	No	The format to show the results. Allowable values: `text`, `json`, `json-raw`, `id`. See Output Formats.

app version vex get

Get a VEX annotation by ID.

anchorectl app version vex get VULN_ANNOTATION_ID [flags]

Arguments

Argument	Description
`VULN_ANNOTATION_ID`	The VEX annotation UUID.

Flags

Flag	Type	Environment variable	Default	Required	Description
`--app`	string	`ANCHORECTL_APP`	`""`	Yes	The app name or ID.
`--version`	string	`ANCHORECTL_VERSION`	`""`	Yes	The version name or UUID.
`-o`, `--output`	string	`ANCHORECTL_FORMAT`	`text`	No	The format to show the results. Allowable values: `text`, `json`, `json-raw`, `id`. See Output Formats.

app version vex list

List VEX annotations for an app.

anchorectl app version vex list VERSION [flags]

Arguments

Argument	Description
`VERSION`	The version name or UUID.

Flags

Flag	Type	Environment variable	Default	Required	Description
`--app`	string	`ANCHORECTL_APP`	`""`	Yes	The app name or ID.
`-o`, `--output`	string	`ANCHORECTL_FORMAT`	`text`	No	The format to show the results. Allowable values: `text`, `json`, `json-raw`, `id`. See Output Formats.

app version vex update

Update a VEX annotation.

anchorectl app version vex update VULN_ANNOTATION_ID [flags]

Arguments

Argument	Description
`VULN_ANNOTATION_ID`	The VEX annotation UUID.

Flags

Flag	Type	Environment variable	Default	Required	Description
`--app`	string	`ANCHORECTL_APP`	`""`	Yes	The app name or ID.
`--version`	string	`ANCHORECTL_VERSION`	`""`	Yes	The version name or UUID.
`--action-statement`	string	`ANCHORECTL_ACTION_STATEMENT`	`""`	No	Action statement for remediation.
`--additional-details`	string	`ANCHORECTL_ADDITIONAL_DETAILS`	`""`	No	Free-form additional details.
`--impact-statement`	string	`ANCHORECTL_IMPACT_STATEMENT`	`""`	No	Impact statement for the vulnerability.
`--justification`	string	`ANCHORECTL_JUSTIFICATION`	`""`	No	Justification for not_affected status. Allowable values: `component_not_present`, `vulnerable_code_not_present`, `vulnerable_code_not_in_execute_path`, `vulnerable_code_cannot_be_controlled_by_adversary`, `inline_mitigations_already_exist`.
`-o`, `--output`	string	`ANCHORECTL_FORMAT`	`text`	No	The format to show the results. Allowable values: `text`, `json`, `json-raw`, `id`. See Output Formats.
`--status`	string	`ANCHORECTL_STATUS`	`""`	No	The VEX status. Allowable values: `not_affected`, `affected`, `fixed`, `under_investigation`.
`--status-notes`	string	`ANCHORECTL_STATUS_NOTES`	`""`	No	Additional notes about the status.

app version vuln

App version vulnerability operations.

anchorectl app version vuln [command]

Subcommands

app version vuln list — List vulnerabilities for an app version

app version vuln list

List vulnerabilities for an app version.

anchorectl app version vuln list VERSION [flags]

Arguments

Argument	Description
`VERSION`	The version name or UUID.

Flags

Flag	Type	Environment variable	Default	Required	Description
`--app`	string	`ANCHORECTL_APP`	`""`	Yes	The app name or ID.
`-o`, `--output`	string	`ANCHORECTL_FORMAT`	`text`	No	The format to show the results. Allowable values: `text`, `json`, `json-raw`. See Output Formats.

4 - anchorectl archive

Archive rule and image operations.

Every command on this page also accepts the global flags.

Subcommands

archive image — Archive image related operations
archive rule — Archive rule related operations

archive image

Archive image related operations.

anchorectl archive image [command]

Subcommands

archive image add — Archive images
archive image delete — Performs a synchronous archive deletion
archive image get — Returns the archive metadata record identifying the image and tags for the analysis in the archive.
archive image list — List archived images
archive image restore — Creates a new analysis task that is executed asynchronously

archive image add

Archive images.

anchorectl archive image add IMAGE_DIGESTS [flags]

Arguments

Argument	Description
`IMAGE_DIGESTS`	List of image digests to archive.

Flags

Flag	Type	Environment variable	Default	Required	Description
`-o`, `--output`	string	`ANCHORECTL_FORMAT`	`text`	No	The format to show the results. Allowable values: `text`, `json`, `json-raw`, `id`. See Output Formats.

archive image delete

Performs a synchronous archive deletion.

anchorectl archive image delete IMAGEDIGEST [flags]

Aliases: del

Arguments

Argument	Description
`IMAGEDIGEST`	Image digest to delete from archive.

Flags

Flag	Type	Environment variable	Default	Required	Description
`--force`	bool	`ANCHORECTL_ARCHIVE_IMAGE_FORCE`	`false`	No	Force archive image deletion.
`-o`, `--output`	string	`ANCHORECTL_FORMAT`	`text`	No	The format to show the results. Allowable values: `text`, `json`, `json-raw`, `id`. See Output Formats.

archive image get

Returns the archive metadata record identifying the image and tags for the analysis in the archive.

anchorectl archive image get IMAGE_DIGEST [flags]

Arguments

Argument	Description
`IMAGE_DIGEST`	The image digest to identify the image analysis.

Flags

Flag	Type	Environment variable	Default	Required	Description
`-o`, `--output`	string	`ANCHORECTL_FORMAT`	`text`	No	The format to show the results. Allowable values: `text`, `json`, `json-raw`, `id`. See Output Formats.

archive image list

List archived images.

anchorectl archive image list [flags]

Flags

Flag	Type	Environment variable	Default	Required	Description
`-o`, `--output`	string	`ANCHORECTL_FORMAT`	`text`	No	The format to show the results. Allowable values: `text`, `json`, `json-raw`, `id`. See Output Formats.

archive image restore

Creates a new analysis task that is executed asynchronously.

anchorectl archive image restore DIGEST [flags]

Arguments

Argument	Description
`DIGEST`	The image digest identify the analysis. Archived analyses are based on digest, tag records are restored as analysis is restored.

Flags

Flag	Type	Environment variable	Default	Required	Description
`--force`	bool	`ANCHORECTL_ARCHIVE_IMAGE_FORCE`	`false`	No	Override any existing entry in the system.
`-o`, `--output`	string	`ANCHORECTL_FORMAT`	`text`	No	The format to show the results. Allowable values: `text`, `json`, `json-raw`, `id`. See Output Formats.

archive rule

Archive rule related operations.

anchorectl archive rule [command]

Subcommands

archive rule add — Add an analysis archive rule
archive rule delete — Delete an analysis archive rule
archive rule get — Get an analysis archive rule
archive rule list — List the analysis archive rules

archive rule add

Add an analysis archive rule.

anchorectl archive rule add [flags]

Flags

Flag	Type	Environment variable	Default	Required	Description
`--transition`	string	`ANCHORECTL_ARCHIVE_RULE_TRANSITION`	`""`	Yes	The type of transition to make. If “archive”, then archive an image from the working set and remove it from the working set. If “delete”, then match against archived images and delete from the archive if match. Allowable values: `archive`, `delete`.
`--analysis-age-days`	int	`ANCHORECTL_ARCHIVE_RULE_ANALYSIS_AGE_DAYS`	`0`	No	Matches if the analysis is strictly older than this number of days.
`--exclude-expiration-days`	int	`ANCHORECTL_ARCHIVE_RULE_EXCLUDE_EXPIRATION_DAYS`	`0`	No	How long the image selected will be excluded from the archive transition.
`--exclude-last-seen-in-days`	int	`ANCHORECTL_ARCHIVE_RULE_EXCLUDE_LAST_SEEN_IN_DAYS`	`0`	No	Exclude image from archive if last seen in inventory within defined number of days.
`--exclude-selector-registry`	string	`ANCHORECTL_ARCHIVE_RULE_EXCLUDE_SELECTOR_REGISTRY`	`""`	No	The registry section of a pull string. e.g. with “docker.io/anchore/anchore-engine:latest”, this is “docker.io”.
`--exclude-selector-repository`	string	`ANCHORECTL_ARCHIVE_RULE_EXCLUDE_SELECTOR_REPOSITORY`	`""`	No	The repository section of a pull string. e.g. with “docker.io/anchore/anchore-engine:latest”, this is “anchore/anchore-engine”.
`--exclude-selector-tag`	string	`ANCHORECTL_ARCHIVE_RULE_EXCLUDE_SELECTOR_TAG`	`""`	No	The tag-only section of a pull string. e.g. with “docker.io/anchore/anchore-engine:latest”, this is “latest”.
`-i`, `--input`	string	`ANCHORECTL_INPUT`	`""`	No	Path to a JSON input file or - to read from stdin.
`--max-images-per-account`	int	`ANCHORECTL_ARCHIVE_RULE_MAX_IMAGES_PER_ACCOUNT`	`0`	No	This is the maximum number of image analyses an account can have. Can only be set on system_global rules.
`-o`, `--output`	string	`ANCHORECTL_FORMAT`	`text`	No	The format to show the results. Allowable values: `text`, `json`, `json-raw`, `id`. See Output Formats.
`--rule-id`	string	`ANCHORECTL_ARCHIVE_RULE_RULE_ID`	`""`	No	Unique identifier for archive rule.
`--selector-registry`	string	`ANCHORECTL_ARCHIVE_RULE_SELECTOR_REGISTRY`	`*`	No	The registry section of a pull string. e.g. with “docker.io/anchore/anchore-engine:latest”, this is “docker.io”.
`--selector-repository`	string	`ANCHORECTL_ARCHIVE_RULE_SELECTOR_REPOSITORY`	`*`	No	The repository section of a pull string. e.g. with “docker.io/anchore/anchore-engine:latest”, this is “anchore/anchore-engine”.
`--selector-tag`	string	`ANCHORECTL_ARCHIVE_RULE_SELECTOR_TAG`	`*`	No	The tag-only section of a pull string. e.g. with “docker.io/anchore/anchore-engine:latest”, this is “latest”.
`--system-global`	bool	`ANCHORECTL_ARCHIVE_RULE_SYSTEM_GLOBAL`	`false`	No	True if the rule applies to all accounts in the system. This is only available to admin users to update/modify, but all users with permission to list rules can see them.
`--tag-versions-newer`	int	`ANCHORECTL_ARCHIVE_RULE_TAG_VERSIONS_NEWER`	`0`	No	Number of images mapped to the tag that are newer.

archive rule delete

Delete an analysis archive rule.

anchorectl archive rule delete ID [flags]

Aliases: del

Arguments

Argument	Description
`ID`	The rule id.

Flags

Flag	Type	Environment variable	Default	Required	Description
`-o`, `--output`	string	`ANCHORECTL_FORMAT`	`text`	No	The format to show the results. Allowable values: `text`, `json`, `json-raw`, `id`. See Output Formats.

archive rule get

Get an analysis archive rule.

anchorectl archive rule get ID [flags]

Arguments

Argument	Description
`ID`	The rule id.

Flags

Flag	Type	Environment variable	Default	Required	Description
`-o`, `--output`	string	`ANCHORECTL_FORMAT`	`text`	No	The format to show the results. Allowable values: `text`, `json`, `json-raw`, `id`. See Output Formats.

archive rule list

List the analysis archive rules.

anchorectl archive rule list [flags]

Flags

Flag	Type	Environment variable	Default	Required	Description
`--global`	bool	`ANCHORECTL_ARCHIVE_RULE_GLOBAL`	`true`	No	Include system global rules (owned by admin) even for non-admin users.
`-o`, `--output`	string	`ANCHORECTL_FORMAT`	`text`	No	The format to show the results. Allowable values: `text`, `json`, `json-raw`, `id`. See Output Formats.

5 - anchorectl auth

Auth related operations for the current user.

Every command on this page also accepts the global flags.

Subcommands

auth set-password — Set the password for the current user

auth set-password

Set the password for the current user.

anchorectl auth set-password [flags]

Flags

Flag	Type	Environment variable	Default	Required	Description
`-o`, `--output`	string	`ANCHORECTL_FORMAT`	`text`	No	The format to show the results. Allowable values: `text`, `json`, `json-raw`, `id`. See Output Formats.

6 - anchorectl completion

Generate the autocompletion script for anchorectl for the specified shell. See each sub-command’s help for details on how to use the generated script.

Every command on this page also accepts the global flags.

Subcommands

completion bash — Generate the autocompletion script for the bash shell.
completion fish — Generate the autocompletion script for the fish shell.
completion powershell — Generate the autocompletion script for powershell.
completion zsh — Generate the autocompletion script for the zsh shell.

completion bash

Generate the autocompletion script for the bash shell.

This script depends on the bash-completion package. If it is not installed already, you can install it via your OS’s package manager.

To load completions in your current shell session:

source <(anchorectl completion bash)

To load completions for every new session, execute once:

Linux

anchorectl completion bash > /etc/bash_completion.d/anchorectl

macOS

anchorectl completion bash > $(brew --prefix)/etc/bash_completion.d/anchorectl

You will need to start a new shell for this setup to take effect.

anchorectl completion bash

Flags

Flag	Type	Environment variable	Default	Required	Description
`--no-descriptions`	bool	—	`false`	No	Disable completion descriptions.

completion fish

Generate the autocompletion script for the fish shell.

To load completions in your current shell session:

anchorectl completion fish | source

To load completions for every new session, execute once:

anchorectl completion fish > ~/.config/fish/completions/anchorectl.fish

You will need to start a new shell for this setup to take effect.

anchorectl completion fish [flags]

Flags

Flag	Type	Environment variable	Default	Required	Description
`--no-descriptions`	bool	—	`false`	No	Disable completion descriptions.

completion powershell

Generate the autocompletion script for powershell.

To load completions in your current shell session:

anchorectl completion powershell | Out-String | Invoke-Expression

To load completions for every new session, add the output of the above command to your powershell profile.

anchorectl completion powershell [flags]

Flags

Flag	Type	Environment variable	Default	Required	Description
`--no-descriptions`	bool	—	`false`	No	Disable completion descriptions.

completion zsh

Generate the autocompletion script for the zsh shell.

If shell completion is not already enabled in your environment you will need to enable it. You can execute the following once:

echo "autoload -U compinit; compinit" >> ~/.zshrc

To load completions in your current shell session:

source <(anchorectl completion zsh)

To load completions for every new session, execute once:

Linux

anchorectl completion zsh > "${fpath[1]}/_anchorectl"

macOS

anchorectl completion zsh > $(brew --prefix)/share/zsh/site-functions/_anchorectl

You will need to start a new shell for this setup to take effect.

anchorectl completion zsh [flags]

Flags

Flag	Type	Environment variable	Default	Required	Description
`--no-descriptions`	bool	—	`false`	No	Disable completion descriptions.

7 - anchorectl correction

Correction related operations.

Every command on this page also accepts the global flags.

Subcommands

correction add — Add a correction record that will be used to fix false positive vulnerabilities
correction delete — Delete a single correction, looked up via it’s uuid
correction get — Returns a single correction, looked up via it’s uuid
correction list — Returns a list of corrections

correction add

Add a correction record that will be used to fix false positive vulnerabilities.

anchorectl correction add [flags]

Flags

Flag	Type	Environment variable	Default	Required	Description
`--description`	string	`ANCHORECTL_CORRECTION_DESCRIPTION`	`""`	No	Optional description of this correction rule.
`-i`, `--input`	string	`ANCHORECTL_INPUT`	`""`	No	Path to a JSON input file or - to read from stdin.
`--match`	string (repeatable)	`ANCHORECTL_CORRECTION_MATCH`	`[]`	No	Matches of the form key=value (e.g. package=spring-core).
`-o`, `--output`	string	`ANCHORECTL_FORMAT`	`text`	No	The format to show the results. Allowable values: `text`, `json`, `json-raw`, `id`. See Output Formats.
`--replace`	string (repeatable)	`ANCHORECTL_CORRECTION_REPLACE`	`[]`	No	Replacements of the form key=value (e.g. cpes=cpe:2.3:a:pivotal_software:spring_framework:3.2.14:::::::*).
`--type`	string	`ANCHORECTL_CORRECTION_TYPE`	`""`	No	Type of match [supports os, npm, gem, python, java, go].

correction delete

Delete a single correction, looked up via it’s uuid.

anchorectl correction delete ID [flags]

Aliases: del

Arguments

Argument	Description
`ID`	The correction ID.

Flags

Flag	Type	Environment variable	Default	Required	Description
`-o`, `--output`	string	`ANCHORECTL_FORMAT`	`text`	No	The format to show the results. Allowable values: `text`, `json`, `json-raw`, `id`. See Output Formats.

correction get

Returns a single correction, looked up via it’s uuid.

anchorectl correction get ID [flags]

Arguments

Argument	Description
`ID`	The correction ID.

Flags

Flag	Type	Environment variable	Default	Required	Description
`-o`, `--output`	string	`ANCHORECTL_FORMAT`	`text`	No	The format to show the results. Allowable values: `text`, `json`, `json-raw`, `id`. See Output Formats.

correction list

Returns a list of corrections.

anchorectl correction list [flags]

Flags

Flag	Type	Environment variable	Default	Required	Description
`-o`, `--output`	string	`ANCHORECTL_FORMAT`	`text`	No	The format to show the results. Allowable values: `text`, `json`, `json-raw`, `id`. See Output Formats.

8 - anchorectl event

Event related operations.

Every command on this page also accepts the global flags.

Subcommands

event delete — Delete an event by its event ID or set of filters
event get — Lookup an event by its event ID
event list — Returns a paginated list of events in the descending order of their occurrence. Optional query parameters may be used for filtering results

event delete

Delete an event by its event ID or set of filters.

anchorectl event delete EVENT_ID [flags]

Aliases: del

Arguments

Argument	Description
`EVENT_ID`	Id of event to delete.

Flags

Flag	Type	Environment variable	Default	Required	Description
`--all`	bool	—	`false`	No	Delete all events.
`--before`	string	`ANCHORECTL_EVENT_BEFORE`	`""`	No	Delete events that occurred before the timestamp.
`--force`	bool	`ANCHORECTL_EVENT_FORCE`	`false`	No	Force without prompt.
`--level`	string	`ANCHORECTL_EVENT_LEVEL`	`""`	No	Delete events that match the level - INFO or ERROR.
`-o`, `--output`	string	`ANCHORECTL_FORMAT`	`text`	No	The format to show the results. Allowable values: `text`, `json`, `json-raw`, `id`. See Output Formats.
`--since`	string	`ANCHORECTL_EVENT_SINCE`	`""`	No	Delete events that occurred after the timestamp.

event get

Lookup an event by its event ID.

anchorectl event get ID [flags]

Arguments

Argument	Description
`ID`	Event ID of the event for lookup.

Flags

Flag	Type	Environment variable	Default	Required	Description
`-o`, `--output`	string	`ANCHORECTL_FORMAT`	`text`	No	The format to show the results. Allowable values: `text`, `json`, `json-raw`, `id`. See Output Formats.

event list

Returns a paginated list of events in the descending order of their occurrence. Optional query parameters may be used for filtering results.

anchorectl event list [flags]

Flags

Flag	Type	Environment variable	Default	Required	Description
`--all`	bool	`ANCHORECTL_EVENT_ALL`	`false`	No	Return all events.
`--before`	string	`ANCHORECTL_EVENT_BEFORE`	`""`	No	Return events that occurred before the ISO8601 formatted UTC timestamp.
`--event-type`	string	`ANCHORECTL_EVENT_TYPE`	`""`	No	Filter events by a prefix match on the event type (e.g. “user.image.”).
`--host`	string	`ANCHORECTL_EVENT_SOURCE_HOST_ID`	`""`	No	Filter events by the originating host ID.
`--level`	string	`ANCHORECTL_EVENT_LEVEL`	`""`	No	Filter events by the level - INFO or ERROR.
`-o`, `--output`	string	`ANCHORECTL_FORMAT`	`text`	No	The format to show the results. Allowable values: `text`, `json`, `json-raw`, `id`. See Output Formats.
`--page`	int	`ANCHORECTL_PAGE`	`0`	No	Return the nth page of results starting from 1. Defaults to first page if left empty.
`--resource-id`	string	`ANCHORECTL_EVENT_RESOURCE_ID`	`""`	No	Filter events by a specified resource ID.
`--resource-type`	string	`ANCHORECTL_EVENT_RESOURCE_TYPE`	`""`	No	Filter events by the type of resource - tag, imageDigest, repository etc.
`--service`	string	`ANCHORECTL_EVENT_SOURCE_SERVICE_NAME`	`""`	No	Filter events by the originating service.
`--since`	string	`ANCHORECTL_EVENT_SINCE`	`""`	No	Return events that occurred after the ISO8601 formatted UTC timestamp.

9 - anchorectl feed

Feed related operations.

Every command on this page also accepts the global flags.

Subcommands

feed list — Return a list of feed and their groups along with update and record count information. This data reflects the state of the policy engine, not the upstream feed service itself.
feed sync — Execute a synchronous update all the datasets. The response will block until complete.

feed list

Return a list of feed and their groups along with update and record count information. This data reflects the state of the policy engine, not the upstream feed service itself.

anchorectl feed list [flags]

Flags

Flag	Type	Environment variable	Default	Required	Description
`-o`, `--output`	string	`ANCHORECTL_FORMAT`	`text`	No	The format to show the results. Allowable values: `text`, `json`, `json-raw`, `id`. See Output Formats.

feed sync

Execute a synchronous update all the datasets. The response will block until complete.

anchorectl feed sync [flags]

Flags

Flag	Type	Environment variable	Default	Required	Description
`-f`, `--force_sync`	bool	`ANCHORECTL_FORCE_SYNC`	`false`	No	Force the feed sync to occur.
`-t`, `--timeout`	int	`ANCHORECTL_TIMEOUT`	`-1`	No	The maximum time to wait for the feed sync to complete.

10 - anchorectl generate

Generate analysis artifacts locally.

Every command on this page also accepts the global flags.

Subcommands

generate analysis-bundle — Generate an analysis bundle from a source

generate analysis-bundle

Generate an analysis bundle from a source.

anchorectl generate analysis-bundle [command]

Subcommands

generate analysis-bundle filesystem — Generate an analysis bundle (an uncompressed tar archive containing the SBOM) for a local filesystem directory
generate analysis-bundle image — Run a full local analysis of a container image (SBOM, secrets, content search, file contents, manifests) and package the result set into an analysis bundle for later upload with app version asset add analysis.

generate analysis-bundle filesystem

Generate an analysis bundle (an uncompressed tar archive containing the SBOM) for a local filesystem directory.

anchorectl generate analysis-bundle filesystem SOURCE [flags]

Arguments

Argument	Description
`SOURCE`	Path to the directory to analyze.

Flags

Flag	Type	Environment variable	Default	Required	Description
`-f`, `--output-file`	string	`ANCHORECTL_OUTPUT_FILE`	`""`	Yes	File to write the analysis bundle tar archive (uncompressed; typically named .tar).
`-o`, `--output`	string	`ANCHORECTL_FORMAT`	`syft-json`	No	The SBOM format inside the bundle, options: `cyclonedx-json`, `cyclonedx-xml`, `spdx-json`, `spdx-tag-value`, `syft-json`. See Output Formats.
`--overwrite`	bool	`ANCHORECTL_OVERWRITE`	`false`	No	Overwrite the output file if it exists.

generate analysis-bundle image

Run a full local analysis of a container image (SBOM, secrets, content search, file contents, manifests) and package the result set into an analysis bundle for later upload with app version asset add analysis.

anchorectl generate analysis-bundle image IMAGE [flags]

Arguments

Argument	Description
`IMAGE`	The image reference to analyze.

Flags

Flag	Type	Environment variable	Default	Required	Description
`-f`, `--output-file`	string	`ANCHORECTL_OUTPUT_FILE`	`""`	Yes	Write the analysis bundle tar archive to this file.
`--from`	string	`ANCHORECTL_FROM`	`""`	No	The image source: registry (default), docker, podman, or docker-archive:`<path>` (docker and podman: if the image is not present in the daemon it is pulled from the registry).
`-o`, `--output`	string	`ANCHORECTL_FORMAT`	`text`	No	The format to show the results. Allowable values: `text`, `json`. See Output Formats.
`--overwrite`	bool	`ANCHORECTL_OVERWRITE`	`false`	No	Overwrite the output file if it exists.
`--platform`	string	`ANCHORECTL_PLATFORM`	`""`	No	Platform to analyze for multi-arch images, e.g. linux/amd64.

11 - anchorectl image

Image related operations.

Every command on this page also accepts the global flags.

Subcommands

image add — Analyze a container image
image ancestors — List analyzed ancestor images, which are the images that form the base layers of the image
image check — Get the policy evaluation for the given image
image content — Get image content
image delete — Delete an image analysis
image get — Get information about a single image
image list — List all images visible to the user
image metadata — Get image metadata
image one-time-scan — Analyze a container image
image sbom — Get image SBOM in the native Anchore format
image vulnerabilities — Get image vulnerabilities

image add

Analyze a container image.

anchorectl image add IMAGE [flags]

Arguments

Argument	Description
`IMAGE`	The container image to analyze (e.g. docker.io/library/nginx:latest).

Examples

# Submit image for addition to Anchore Enterprise (Anchore Enterprise will pull
# image from registry and perform full analysis)

anchorectl image add ghcr.io/place/thing:v0.1.0

# Submit image for addition to Anchore Enterprise (anchorectl will perform full
# local image analysis, SBOM + additional analysis pushed to Anchore Enterprise)

anchorectl image add ghcr.io/place/thing:v0.1.0 --from docker

# Submit image for addition to Anchore Enterprise (anchorectl will perform full
# local image analysis from a local podman daemon image, SBOM + additional
# analysis pushed to Anchore Enterprise; falls back to the registry if the image
# is not present in the local podman daemon)

anchorectl image add ghcr.io/place/thing:v0.1.0 --from podman

# Submit image for addition to Anchore Enterprise (use SBOM generated by Syft,
# no additional analysis performed, and push to Anchore Enterprise)

syft -o json ghcr.io/place/thing:v0.1.0 | anchorectl image add ghcr.io/place/thing:v0.1.0 --from -

# Submit and wait for analysis to complete

anchorectl image add ghcr.io/place/thing:v0.1.0 --wait

# Submit and get results once analysis is completed

anchorectl image add ghcr.io/place/thing:v0.1.0 --get content,vulnerabilities=/path/to/vulns.json

# Submit and fetch all results to a directory

anchorectl image add ghcr.io/place/thing:v0.1.0 --get all=/path/to/dir

# Submit image for addition to Anchore Enterprise and perform a STIG evaluation locally

anchorectl image add ghcr.io/place/thing:v0.1.0 --stig --stig-profile /path/to/profile --stig-input-file /path/to/inputfile

# Associate the added image with an app version (preferred v6 path; the
# --application/-a flag on this command is deprecated and will be removed
# in a future release)

anchorectl app version asset add container-image-remote ghcr.io/place/thing:v0.1.0 --app myapp --version v3.1.4 --asset thing

Flags

Flag	Type	Environment variable	Default	Required	Description
`--annotation`	string (repeatable)	`ANCHORECTL_IMAGE_ANNOTATION`	`[]`	No	One or more key-value annotations to add on the image in Anchore Enterprise (format: key=value).
`-a`, `--application`	string	`ANCHORECTL_APPLICATION`	`""`	No	Deprecated. Associate the image with an application at a specific version in the format `app@version` (example: [email protected]); use `anchorectl app version asset add container-image-remote` instead.
`-d`, `--dockerfile`	string	`ANCHORECTL_IMAGE_DOCKERFILE`	`""`	No	Path to the Dockerfile for this image.
`-f`, `--force`	bool	`ANCHORECTL_FORCE`	`false`	No	Re-analyze the image even if it has already been analyzed.
`--from`	string	`ANCHORECTL_IMAGE_FROM`	`""`	No	Analyze from the given source (default: `""`, indicating that Anchore Enterprise will pull the image from the registry; allowable-values: `<path-to-syft-SBOM>`, `-`, `docker`, `podman`, `registry`, `docker-archive`) (docker and podman: if the image is not present in the daemon it is pulled from the registry).
`-g`, `--get`	string (repeatable)	`ANCHORECTL_IMAGE_GET`	`[]`	No	Get results and optionally write the raw results to a file (example: `content` or `content=./path/to/file.json` or `all=/path/to/dir`; allowable-keys: `image-metadata`, `sbom`, `sbomspdx`, `sbomcyclonedx`, `content`, `vulnerability`, `policy-evaluation`, `all`).
`-n`, `--no-auto-subscribe`	bool	`ANCHORECTL_IMAGE_NO_AUTO_SUBSCRIBE`	`false`	No	Do not automatically scan newly pushed tags to the registry for the given image.
`-p`, `--platform`	string	`ANCHORECTL_IMAGE_PLATFORM`	`""`	No	An optional platform specifier for use with `--from registry` target type (e.g. `linux/arm64`, `linux/arm64/v8`, `arm64`, `linux`).
`--stig`	bool	`ANCHORECTL_STIG`	`false`	No	Perform a STIG evaluation on the image.
`--stig-container-manual-override`	string	`ANCHORECTL_STIG_CONTAINER_MANUAL_OVERRIDE`	`""`	No	Docker container ID to use as the STIG target (skips creating container with anchore-keep-alive binary).
`--stig-input-file`	string (repeatable)	`ANCHORECTL_STIG_INPUT_FILE`	`[]`	No	Path to input file to use for STIG generation (optional).
`--stig-output-dir`	string	`ANCHORECTL_STIG_OUTPUT_DIR`	`""`	No	Path to save the STIG evaluation (optional).
`--stig-profile`	string	`ANCHORECTL_STIG_PROFILE`	`""`	No	Path to STIG profile (required when `--stig` is set).
`--stig-tools-binary-path`	string	`ANCHORECTL_STIG_TOOLS_BINARY_PATH`	`""`	No	Path to the statically-linked busybox binary inside the tools image (default: /bin/busybox).
`--stig-tools-image`	string	`ANCHORECTL_STIG_TOOLS_IMAGE`	`""`	No	Container image containing a statically-linked busybox binary for shell-less image support (e.g. docker.io/library/busybox:musl). The binary must be statically linked to work in distroless containers.
`--stig-waiver-file`	string (repeatable)	`ANCHORECTL_STIG_WAIVER_FILE`	`[]`	No	Path to waiver file to use for STIG generation. The waiver file can waive controls and dictate the running and/or reporting of those controls (optional).
`-w`, `--wait`	bool	`ANCHORECTL_IMAGE_WAIT`	`false`	No	Wait for the analysis to complete.

image ancestors

List analyzed ancestor images, which are the images that form the base layers of the image.

anchorectl image ancestors IMAGE [flags]

Aliases: ancestor

Arguments

Argument	Description
`IMAGE`	The image to fetch the ancestors for (can be a digest, id, or registry/repo:tag).

Flags

Flag	Type	Environment variable	Default	Required	Description
`-b`, `--base`	bool	`ANCHORECTL_ANCESTOR_BASE`	`false`	No	Only show the analyzed ancestor image with the fewest layers.
`-o`, `--output`	string	`ANCHORECTL_FORMAT`	`text`	No	The format to show the results. Allowable values: `text`, `json`, `id`. See Output Formats.
`-p`, `--parent`	bool	`ANCHORECTL_ANCESTOR_PARENT`	`false`	No	Only show the analyzed ancestor image with the most layers.

image check

Get the policy evaluation for the given image.

anchorectl image check IMAGE [flags]

Aliases: evaluate

Arguments

Argument	Description
`IMAGE`	The image to fetch the policy evaluation for (can be a digest, id or registry/repo:tag). If supplying a digest or image id, a tag must be supplied with the `-t` flag.

Examples

# Evaluate the active policy against an image
anchorectl image check registry.example.com/my-service:1.4.0

# Show every failing gate, and exit 1 when the evaluation result is fail
anchorectl image check registry.example.com/my-service:1.4.0 --detail --fail-based-on-results

# Evaluate against a specific policy instead of the active one
anchorectl image check registry.example.com/my-service:1.4.0 --policy strict-policy

Flags

Flag	Type	Environment variable	Default	Required	Description
`--base-digest`	string	`ANCHORECTL_IMAGE_CHECK_BASE_DIGEST`	`auto`	No	Base image digest to compare against so findings report inherited_from_base; `auto` resolves the base image automatically, empty disables the comparison.
`--detail`	bool	`ANCHORECTL_IMAGE_CHECK_DETAIL`	`false`	No	Show each failed gate within the policy evaluation report.
`-f`, `--fail-based-on-results`	bool	`ANCHORECTL_FAIL_BASED_ON_RESULTS`	`false`	No	Set the return code to 1 if the policy evaluation result shows as `fail`.
`--history`	bool	`ANCHORECTL_IMAGE_CHECK_HISTORY`	`false`	No	Show all previous policy evaluations.
`-o`, `--output`	string	`ANCHORECTL_FORMAT`	`text`	No	The format to show the results (HTML available with `--detail`). Allowable values: `text`, `json`, `json-raw`, `id`, `csv`, `html`. See Output Formats.
`-d`, `--output-directory`	string	`ANCHORECTL_OUTPUT_DIRECTORY`	`""`	No	Optional output directory to write results to.
`-p`, `--policy`	string	`ANCHORECTL_POLICY`	`""`	No	The policy name or ID to evaluate against (if not provided the default policy is used).
`-t`, `--tag`	string	`ANCHORECTL_IMAGE_TAG`	`""`	No	Specify which tag (repo:tag) is evaluated for a given image ID or Image digest.

image content

Get image content.

anchorectl image content IMAGE [flags]

Aliases: contents

Arguments

Argument	Description
`IMAGE`	The image ID, digest, or name:tag to fetch content of.

Flags

Flag	Type	Environment variable	Default	Required	Description
`-a`, `--available-types`	bool	`ANCHORECTL_AVAILABLE_TYPES`	`false`	No	Only show available content types and exit.
`--file`	string	`ANCHORECTL_FILE`	`""`	No	A file path to write a .tar file containing all retrieved files.
`-o`, `--output`	string	`ANCHORECTL_FORMAT`	`text`	No	The format to show the results. Allowable values: `text`, `json`, `json-raw`, `id`. See Output Formats.
`--overwrite`	bool	`ANCHORECTL_OVERWRITE`	`false`	No	Write over an existing file when saving retrieved files tarball.
`-t`, `--type`	string (repeatable)	`ANCHORECTL_CONTENT_TYPES`	`[]`	No	Filter down results to one or more vulnerability types; use `--available-types` to see valid values (default: fetch all available types).

image delete

Delete an image analysis.

anchorectl image delete IMAGE... [flags]

Aliases: del

Arguments

Argument	Description
`IMAGE`	One or more images to delete (can be a digest, id or registry/repo:tag). If no tag supplied defaults to `latest`.

Flags

Flag	Type	Environment variable	Default	Required	Description
`-a`, `--all`	bool	—	`false`	No	Delete all images.
`-f`, `--force`	bool	`ANCHORECTL_IMAGE_DELETE_FORCE`	`false`	No	Force deletion of image by cancelling any subscription/notification settings prior to image delete.
`-o`, `--output`	string	`ANCHORECTL_FORMAT`	`text`	No	The format to show the results. Allowable values: `text`, `json`, `json-raw`, `id`. See Output Formats.

image get

Get information about a single image.

anchorectl image get IMAGE [flags]

Arguments

Argument	Description
`IMAGE`	The image ID, `name:tag`, `name@sha256:digest`, `name:tag@sha256:digest`, or `sha256:digest` value.

Flags

Flag	Type	Environment variable	Default	Required	Description
`-i`, `--digest`	string	`ANCHORECTL_IMAGE_DIGEST`	`""`	No	The image digest.
`--history`	bool	`ANCHORECTL_IMAGE_HISTORY`	`false`	No	Show history of images that match the input image.
`-o`, `--output`	string	`ANCHORECTL_FORMAT`	`text`	No	The format to show the results. Allowable values: `text`, `json`, `json-raw`, `id`. See Output Formats.

image list

List all images visible to the user.

anchorectl image list [flags]

Flags

Flag	Type	Environment variable	Default	Required	Description
`-s`, `--analysis-status`	string	`ANCHORECTL_IMAGE_ANALYSIS_STATUS`	`""`	No	Filter by analysis_status value on the record. Allowable values: `not_analyzed`, `analyzed`, `analyzing`, `analysis_failed`.
`--history`	bool	`ANCHORECTL_IMAGE_HISTORY`	`false`	No	Include full history of images (duplicate tags with previous content).
`-i`, `--image`	string	`ANCHORECTL_IMAGE_NAME`	`""`	No	Tag-based docker-pull string to filter results by (e.g. docker.io/library/nginx:latest, or myhost.com:5000/testimages:v1.1.1).
`--image-status`	string	`ANCHORECTL_IMAGE_STATUS`	`active`	No	Filter by “image_status” value on the record. Allowable values: `all`, `active`, `deleting`.
`-o`, `--output`	string	`ANCHORECTL_FORMAT`	`text`	No	The format to show the results. Allowable values: `text`, `json`, `json-raw`, `id`. See Output Formats.

image metadata

Get image metadata.

anchorectl image metadata IMAGE [flags]

Arguments

Argument	Description
`IMAGE`	The image ID, digest, or name:tag to fetch metadata of.

Flags

Flag	Type	Environment variable	Default	Required	Description
`--file`	string	`ANCHORECTL_FILE`	`""`	No	A file path to write the metadata out to.
`--overwrite`	bool	`ANCHORECTL_OVERWRITE`	`false`	No	Write over existing metadata files.
`-t`, `--type`	string	`ANCHORECTL_METADATA_TYPE`	`""`	No	Filter down results to one or more vulnerability types (run command without this flag to see available types for the given image).

image one-time-scan

Analyze a container image.

anchorectl image one-time-scan IMAGE [flags]

Arguments

Argument	Description
`IMAGE`	The container image to analyze (e.g. docker.io/library/nginx:latest).

Examples

anchorectl image one-time-scan ghcr.io/anchore/enterprise-test-images:latest

Flags

Flag	Type	Environment variable	Default	Required	Description
`--detail`	bool	`ANCHORECTL_DETAIL`	`false`	No	Show policy evaluation details (always enabled for HTML output).
`--dockerfile`	string	`ANCHORECTL_DOCKERFILE`	`""`	No	Path to Dockerfile to use for analysis.
`--extended-support`	string	`ANCHORECTL_EXTENDED_SUPPORT`	`""`	No	Use Extended Update Support (EUS) data during the vulnerability scan. Will use the system configured behaviour if not provided. Allowable values: `true`, `false`.
`--fail-on-policy-error`	bool	`ANCHORECTL_FAIL_ON_POLICY_ERROR`	`false`	No	Fail if policy evaluation fails.
`-o`, `--format`	string	`ANCHORECTL_FORMAT`	`text`	No	Output format (text, JSON, json-raw, HTML).
`--from`	string	`ANCHORECTL_FROM`	`registry`	No	Source of the image to analyze (registry, docker, or podman) (docker and podman: if the image is not present in the daemon it is pulled from the registry).
`-d`, `--output-directory`	string	`ANCHORECTL_OUTPUT_DIRECTORY`	`""`	No	Optional output directory to write results to.
`--platform`	string	`ANCHORECTL_PLATFORM`	`""`	No	Platform to use for analysis.
`-p`, `--policy`	string	`ANCHORECTL_POLICY`	`""`	No	Policy bundle (name or id) to use for evaluation.

image sbom

Get image SBOM in the native Anchore format.

anchorectl image sbom IMAGE [flags]

Arguments

Argument	Description
`IMAGE`	The image reference (ID, digest, name:tag).

Flags

Flag	Type	Environment variable	Default	Required	Description
`-x`, `--exclude-files`	bool	`ANCHORECTL_EXCLUDE_FILES`	`false`	No	Exclude files from the SBOM (this only valid for CycloneDX formats.
`-f`, `--file`	string	`ANCHORECTL_FILE`	`""`	No	Write the SBOM content to a file (instead of STDOUT).
`-o`, `--output`	string	—	`syft-json`	No	Report output format, options: `cyclonedx-json`, `cyclonedx-xml`, `purls`, `spdx-json`, `spdx-tag-value`, `syft-json`, `table`, `text`. See Output Formats.
`--overwrite`	bool	`ANCHORECTL_OVERWRITE`	`false`	No	Write over existing SBOM files.

image vulnerabilities

Get image vulnerabilities.

anchorectl image vulnerabilities IMAGE [flags]

Aliases: vulns, vuln

Arguments

Argument	Description
`IMAGE`	The image ID, digest, or name:tag to fetch vulnerabilities for.

Examples

# All vulnerabilities for an image
anchorectl image vulnerabilities registry.example.com/my-service:1.4.0

# Only OS package findings the vendor has not marked as won't-fix
anchorectl image vulnerabilities registry.example.com/my-service:1.4.0 --type os --vendor-only

# Write JSON results to a directory. --output-directory accepts only
# json, json-raw, html, and csv
anchorectl image vulnerabilities registry.example.com/my-service:1.4.0 --output json --output-directory ./reports

# CycloneDX output requires an image digest, not a tag
anchorectl image vulnerabilities sha256:<DIGEST> --output cyclonedx-json

Flags

Flag	Type	Environment variable	Default	Required	Description
`--annotations`	string (repeatable)	`ANCHORECTL_VULNERABILITY_ANNOTATIONS`	`[]`	No	Filter results to include only vulnerabilities with the given annotation status. Accepts a comma separated list of: `not_affected`, `affected`, `fixed`, `under_investigation`.
`-a`, `--available-types`	bool	—	`false`	No	Only show available vulnerability types and exit.
`--include-description`	bool	`ANCHORECTL_VULNERABILITY_INCLUDE_DESCRIPTION`	`false`	No	Include full descriptions in the vulnerability result.
`-o`, `--output`	string	`ANCHORECTL_FORMAT`	`text`	No	The format to show the results. Allowable values: `text`, `json`, `json-raw`, `csv`, `cyclonedx-json`, `cyclonedx-xml`, `html`. See Output Formats.
`-d`, `--output-directory`	string	`ANCHORECTL_OUTPUT_DIRECTORY`	`""`	No	Optional output directory to write results to.
`-r`, `--refresh`	bool	`ANCHORECTL_VULNERABILITY_REFRESH`	`false`	No	Refresh the vulnerability match results against the original artifact.
`-t`, `--type`	string (repeatable)	`ANCHORECTL_VULNERABILITY_TYPE`	`[]`	No	Filter down results to one or more vulnerability types.
`--vendor-only`	bool	`ANCHORECTL_VULNERABILITY_VENDOR_ONLY`	`false`	No	Filter results to include only vulnerabilities that are not marked as invalid by upstream OS vendor data. When set to true, it will filter out all vulnerabilities where will_not_fix is False. If false all vulnerabilities are returned regardless of `will_not_fix`.

12 - anchorectl inventory

Inventory list operation.

Every command on this page also accepts the global flags.

Subcommands

inventory delete — Delete inventory from the system.
inventory list — Returns a list of the images that are in use
inventory watch — Inventory subscription operations

inventory delete

Delete inventory from the system.

anchorectl inventory delete [flags]

Aliases: del

Flags

Flag	Type	Environment variable	Default	Required	Description
`--type`	string	`ANCHORECTL_INVENTORY_INVENTORY_TYPE`	`""`	Yes	The type of inventory to delete.
`--context`	string	`ANCHORECTL_CONTEXT`	`""`	No	The inventory context.
`--image-digest`	string	`ANCHORECTL_IMAGE_DIGEST`	`""`	No	The image digest to delete inventory for.
`-o`, `--output`	string	`ANCHORECTL_FORMAT`	`text`	No	The format to show the results. Allowable values: `text`, `json`, `json-raw`, `id`. See Output Formats.
`-y`, `--yes`	bool	`ANCHORECTL_CONFIRM`	`false`	No	Confirm the deletion of the inventory.

inventory list

Returns a list of the images that are in use.

anchorectl inventory list [flags]

Flags

Flag	Type	Environment variable	Default	Required	Description
`--context`	string	`ANCHORECTL_INVENTORY_CONTEXT`	`""`	No	Limit results to a specific image context.
`--image-digest`	string	`ANCHORECTL_INVENTORY_IMAGE_DIGEST`	`""`	No	Search for a specific image digest.
`-o`, `--output`	string	`ANCHORECTL_FORMAT`	`text`	No	The format to show the results. Allowable values: `text`, `json`, `json-raw`, `id`. See Output Formats.
`--type`	string	`ANCHORECTL_INVENTORY_TYPE`	`""`	No	The inventory type to limit results (e.g. Kubernetes).

inventory watch

Inventory subscription operations.

anchorectl inventory watch [command]

Subcommands

inventory watch activate — Watching a runtime inventory context will cause images to be automatically scheduled for analysis on discovery
inventory watch deactivate — Runtime inventory context to stop watching
inventory watch list — List all runtime inventory which have a watch configured

inventory watch activate

Watching a runtime inventory context will cause images to be automatically scheduled for analysis on discovery.

anchorectl inventory watch activate INVENTORY_CONTEXT [flags]

Arguments

Argument	Description
`INVENTORY_CONTEXT`	Inventory context.

Flags

Flag	Type	Environment variable	Default	Required	Description
`-o`, `--output`	string	`ANCHORECTL_FORMAT`	`text`	No	The format to show the results. Allowable values: `text`, `json`, `json-raw`, `id`. See Output Formats.

inventory watch deactivate

Runtime inventory context to stop watching.

anchorectl inventory watch deactivate INVENTORY_CONTEXT [flags]

Arguments

Argument	Description
`INVENTORY_CONTEXT`	Runtime inventory context.

Flags

Flag	Type	Environment variable	Default	Required	Description
`-o`, `--output`	string	`ANCHORECTL_FORMAT`	`text`	No	The format to show the results. Allowable values: `text`, `json`, `json-raw`, `id`. See Output Formats.

inventory watch list

List all runtime inventory which have a watch configured.

anchorectl inventory watch list [flags]

Flags

Flag	Type	Environment variable	Default	Required	Description
`-k`, `--key`	string	`ANCHORECTL_SUBSCRIPTION_KEY`	`""`	No	Filter on this specific inventory context.
`-o`, `--output`	string	`ANCHORECTL_FORMAT`	`text`	No	The format to show the results. Allowable values: `text`, `json`, `json-raw`, `id`. See Output Formats.

13 - anchorectl policy

Policy related operations.

Every command on this page also accepts the global flags.

Subcommands

policy activate — Activate a policy
policy add — Adds a new policy bundle to the system
policy delete — Delete the specified policy
policy get — Get the policy content
policy list — List all saved policies
policy update — Update/replace an existing policy

policy activate

Activate a policy.

anchorectl policy activate POLICY [flags]

Arguments

Argument	Description
`POLICY`	The policy name or ID.

Examples

anchorectl policy activate strict-policy

Flags

Flag	Type	Environment variable	Default	Required	Description
`-o`, `--output`	string	`ANCHORECTL_FORMAT`	`text`	No	The format to show the results. Allowable values: `text`, `json`, `json-raw`, `id`. See Output Formats.

policy add

Adds a new policy bundle to the system.

anchorectl policy add [flags]

Examples

# Upload a policy bundle from a file
anchorectl policy add --input strict-policy.json

# Upload a policy bundle from stdin
cat strict-policy.json | anchorectl policy add --input -

Flags

Flag	Type	Environment variable	Default	Required	Description
`-i`, `--input`	string	`ANCHORECTL_INPUT`	`""`	Yes	Path to a JSON input file or - to read from stdin.
`-o`, `--output`	string	`ANCHORECTL_FORMAT`	`text`	No	The format to show the results. Allowable values: `text`, `json`, `json-raw`, `id`. See Output Formats.

policy delete

Delete the specified policy.

anchorectl policy delete POLICY [flags]

Aliases: del

Arguments

Argument	Description
`POLICY`	The policy name or ID.

Flags

Flag	Type	Environment variable	Default	Required	Description
`-o`, `--output`	string	`ANCHORECTL_FORMAT`	`text`	No	The format to show the results. Allowable values: `text`, `json`, `json-raw`, `id`. See Output Formats.

policy get

Get the policy content.

anchorectl policy get POLICY [flags]

Arguments

Argument	Description
`POLICY`	The policy name or ID.

Flags

Flag	Type	Environment variable	Default	Required	Description
`--detail`	bool	`ANCHORECTL_POLICY_DETAIL`	`true`	No	Include policy detail in the form of the full policy content.
`-o`, `--output`	string	`ANCHORECTL_FORMAT`	`text`	No	The format to show the results. Allowable values: `text`, `json`, `json-raw`, `id`. See Output Formats.

policy list

List all saved policies.

anchorectl policy list [flags]

Flags

Flag	Type	Environment variable	Default	Required	Description
`--detail`	bool	`ANCHORECTL_DETAIL`	`false`	No	Include full policy content. Available with output selections of [JSON \| json-raw].
`-o`, `--output`	string	`ANCHORECTL_FORMAT`	`text`	No	The format to show the results. Allowable values: `text`, `json`, `json-raw`, `id`. See Output Formats.

policy update

Update/replace an existing policy.

anchorectl policy update [flags]

Flags

Flag	Type	Environment variable	Default	Required	Description
`-i`, `--input`	string	`ANCHORECTL_INPUT`	`""`	Yes	Path to a JSON input file or - to read from stdin.
`-o`, `--output`	string	`ANCHORECTL_FORMAT`	`text`	No	The format to show the results. Allowable values: `text`, `json`, `json-raw`, `id`. See Output Formats.

14 - anchorectl registry

Registry credential operations.

Every command on this page also accepts the global flags.

Subcommands

registry add — Adds a new registry to the system
registry delete — Delete a registry configuration record from the system. Does not remove any images.
registry get — Get information on a specific registry
registry list — List all configured registries the system can/will watch
registry update — Replaces an existing registry record with the given record

registry add

Adds a new registry to the system.

anchorectl registry add REGISTRY [flags]

Arguments

Argument	Description
`REGISTRY`	Hostname:port string for accessing the registry, as would be used in a docker pull operation. May include some or all of a repository and wildcards (e.g. docker.io/library/* or gcr.io/myproject/myrepository).

Examples

# The password is read from the environment, never passed as a flag
ANCHORECTL_REGISTRY_PASSWORD=<REGISTRY_PASSWORD> anchorectl registry add registry.example.com \
  --username ci-runner

# Verify the credential when the registry is added. If the registry cannot be
# reached with these credentials, the command exits 1 and no record is created
ANCHORECTL_REGISTRY_PASSWORD=<REGISTRY_PASSWORD> anchorectl registry add registry.example.com \
  --username ci-runner --validate

Flags

Flag	Type	Environment variable	Default	Required	Description
`--username`	string	`ANCHORECTL_REGISTRY_USERNAME`	`""`	Yes	Username portion of credential to use for this registry.
`--name`	string	`ANCHORECTL_REGISTRY_NAME`	`""`	No	Human readable name associated with registry record.
`-o`, `--output`	string	`ANCHORECTL_FORMAT`	`text`	No	The format to show the results. Allowable values: `text`, `json`, `json-raw`, `id`. See Output Formats.
`--secure-connection`	bool	`ANCHORECTL_REGISTRY_SECURE_CONNECTION`	`true`	No	Use TLS/SSL verification for the registry URL.
`--type`	string	`ANCHORECTL_REGISTRY_TYPE`	`docker_v2`	No	Type of registry.
`--validate`	bool	`ANCHORECTL_REGISTRY_VALIDATE`	`true`	No	Whether or not to validate registry/credential at registry add time.

registry delete

Delete a registry configuration record from the system. Does not remove any images.

anchorectl registry delete REGISTRY [flags]

Aliases: del

Arguments

Argument	Description
`REGISTRY`	The registry name.

Flags

Flag	Type	Environment variable	Default	Required	Description
`-o`, `--output`	string	`ANCHORECTL_FORMAT`	`text`	No	The format to show the results. Allowable values: `text`, `json`, `json-raw`, `id`. See Output Formats.

registry get

Get information on a specific registry.

anchorectl registry get REGISTRY [flags]

Arguments

Argument	Description
`REGISTRY`	Registry name.

Flags

Flag	Type	Environment variable	Default	Required	Description
`-o`, `--output`	string	`ANCHORECTL_FORMAT`	`text`	No	The format to show the results. Allowable values: `text`, `json`, `json-raw`, `id`. See Output Formats.

registry list

List all configured registries the system can/will watch.

anchorectl registry list [flags]

Flags

Flag	Type	Environment variable	Default	Required	Description
`-o`, `--output`	string	`ANCHORECTL_FORMAT`	`text`	No	The format to show the results. Allowable values: `text`, `json`, `json-raw`, `id`. See Output Formats.

registry update

Replaces an existing registry record with the given record.

anchorectl registry update REGISTRY [flags]

Arguments

Argument	Description
`REGISTRY`	The registry name.

Flags

Flag	Type	Environment variable	Default	Required	Description
`--name`	string	`ANCHORECTL_REGISTRY_NAME`	`""`	No	Human readable name associated with registry record.
`-o`, `--output`	string	`ANCHORECTL_FORMAT`	`text`	No	The format to show the results. Allowable values: `text`, `json`, `json-raw`, `id`. See Output Formats.
`--secure-connection`	bool	`ANCHORECTL_REGISTRY_SECURE_CONNECTION`	`false`	No	Use TLS/SSL verification for the registry URL.
`--type`	string	`ANCHORECTL_REGISTRY_TYPE`	`""`	No	Type of registry.
`--username`	string	`ANCHORECTL_REGISTRY_USERNAME`	`""`	No	Username portion of credential to use for this registry.
`--validate`	bool	`ANCHORECTL_REGISTRY_VALIDATE`	`true`	No	Whether or not to validate registry/credential at registry update time.

15 - anchorectl repo

Repository related operations.

Every command on this page also accepts the global flags.

Subcommands

repo add — Add repository to watch
repo delete — Delete a repository subscription
repo get — Get a specific repository subscription
repo list — List all repository subscriptions
repo unwatch — Stop watching a specific repository
repo watch — Start watching a specific repository

repo add

Add repository to watch.

anchorectl repo add REPOSITORY [flags]

Arguments

Argument	Description
`REPOSITORY`	Full repository to add e.g. docker.io/library/alpine.

Flags

Flag	Type	Environment variable	Default	Required	Description
`--auto-subscribe`	bool	`ANCHORECTL_REPO_AUTO_SUBSCRIBE`	`false`	No	Enable/disable auto tag_update activation when new images from a repo are added.
`--dry-run`	bool	`ANCHORECTL_REPO_DRY_RUN`	`false`	No	Return tags in the repository without actually watching the repository.
`--exclude-existing-tags`	bool	`ANCHORECTL_REPO_EXCLUDE_EXISTING_TAGS`	`false`	No	Indicates if you want to ignore the existing tags in the repository on the first execution.
`-o`, `--output`	string	`ANCHORECTL_FORMAT`	`text`	No	The format to show the results. Allowable values: `text`, `json`, `json-raw`, `id`. See Output Formats.

repo delete

Delete a repository subscription.

anchorectl repo delete REPOSITORY [flags]

Aliases: del

Arguments

Argument	Description
`REPOSITORY`	Full repository e.g. docker.io/library/alpine.

Flags

Flag	Type	Environment variable	Default	Required	Description
`-o`, `--output`	string	`ANCHORECTL_FORMAT`	`text`	No	The format to show the results. Allowable values: `text`, `json`, `json-raw`, `id`. See Output Formats.

repo get

Get a specific repository subscription.

anchorectl repo get REPOSITORY [flags]

Arguments

Argument	Description
`REPOSITORY`	Full repository e.g. docker.io/library/alpine.

Flags

Flag	Type	Environment variable	Default	Required	Description
`-o`, `--output`	string	`ANCHORECTL_FORMAT`	`text`	No	The format to show the results. Allowable values: `text`, `json`, `json-raw`, `id`. See Output Formats.

repo list

List all repository subscriptions.

anchorectl repo list [flags]

Flags

Flag	Type	Environment variable	Default	Required	Description
`-o`, `--output`	string	`ANCHORECTL_FORMAT`	`text`	No	The format to show the results. Allowable values: `text`, `json`, `json-raw`, `id`. See Output Formats.
`--repository`	string	`ANCHORECTL_REPOSITORY_NAME`	`""`	No	Filter only subscriptions matching the repository.

repo unwatch

Stop watching a specific repository.

anchorectl repo unwatch REPOSITORY [flags]

Arguments

Argument	Description
`REPOSITORY`	Full repository e.g. docker.io/library/alpine.

Flags

Flag	Type	Environment variable	Default	Required	Description
`-o`, `--output`	string	`ANCHORECTL_FORMAT`	`text`	No	The format to show the results. Allowable values: `text`, `json`, `json-raw`, `id`. See Output Formats.

repo watch

Start watching a specific repository.

anchorectl repo watch REPOSITORY [flags]

Arguments

Argument	Description
`REPOSITORY`	Full repository e.g. docker.io/library/alpine.

Flags

Flag	Type	Environment variable	Default	Required	Description
`-o`, `--output`	string	`ANCHORECTL_FORMAT`	`text`	No	The format to show the results. Allowable values: `text`, `json`, `json-raw`, `id`. See Output Formats.

16 - anchorectl stig

STIG related operations.

Every command on this page also accepts the global flags.

Subcommands

stig docker — Docker related STIG operations
stig write-profiles — Write Anchore STIG profiles to disk.

stig docker

Docker related STIG operations.

anchorectl stig docker [command]

Subcommands

stig docker image — Docker image related STIG operations

stig docker image

Docker image related STIG operations.

anchorectl stig docker image [command]

Subcommands

stig docker image add — Add a STIG evaluation for an image
stig docker image delete — Delete a STIG evaluation for an image
stig docker image download — Download a STIG evaluation for an image
stig docker image execute — Perform a STIG evaluation generation for an image
stig docker image list — List the STIG evaluation metadata for an image

stig docker image add

Add a STIG evaluation for an image.

anchorectl stig docker image add IMAGE STIG_EVALUATION_FILE [flags]

Arguments

Argument	Description
`IMAGE`	The image ID, `name:tag`, `name@sha256:digest`, `name:tag@sha256:digest`, or `sha256:digest` value.
`STIG_EVALUATION_FILE`	The path and filename for the STIG evaluation file.

Flags

Flag	Type	Environment variable	Default	Required	Description
`-o`, `--output`	string	`ANCHORECTL_FORMAT`	`text`	No	The format to show the results. Allowable values: `text`, `json`, `json-raw`, `id`. See Output Formats.
`--stig-evaluation-uuid`	string	`ANCHORECTL_STIG_EVALUATION_UUID`	`""`	No	The UUID for the STIG evaluation to overwrite, if the image already has a STIG evaluation for the same profile this must be provided to upload the new evaluation.

stig docker image delete

Delete a STIG evaluation for an image.

anchorectl stig docker image delete IMAGE EVALUATION_UUID [flags]

Aliases: del

Arguments

Argument	Description
`EVALUATION_UUID`	The UUID of the STIG evaluation.
`IMAGE`	The image ID, `name:tag`, `name@sha256:digest`, `name:tag@sha256:digest`, or `sha256:digest` value.

Flags

Flag	Type	Environment variable	Default	Required	Description
`-o`, `--output`	string	`ANCHORECTL_FORMAT`	`text`	No	The format to show the results. Allowable values: `text`, `json`, `json-raw`, `id`. See Output Formats.

stig docker image download

Download a STIG evaluation for an image.

anchorectl stig docker image download IMAGE EVALUATION_UUID [flags]

Arguments

Argument	Description
`EVALUATION_UUID`	The UUID of the STIG evaluation.
`IMAGE`	The image ID, `name:tag`, `name@sha256:digest`, `name:tag@sha256:digest`, or `sha256:digest` value.

Flags

Flag	Type	Environment variable	Default	Required	Description
`--stig-output-dir`	string	`ANCHORECTL_STIG_OUTPUT_DIR`	`""`	No	Directory to save the STIG evaluation.

stig docker image execute

Perform a STIG evaluation generation for an image.

anchorectl stig docker image execute IMAGE [flags]

Arguments

Argument	Description
`IMAGE`	Fully qualified image reference in format [registry/]repository/image:tag@digest.

Flags

Flag	Type	Environment variable	Default	Required	Description
`-p`, `--stig-profile`	string	`ANCHORECTL_STIG_PROFILE`	`""`	Yes	Path to the Inspec STIG profile, can be a folder containing the extracted profile or an archive e.g. .tar.gz (required).
`--platform`	string	`ANCHORECTL_PLATFORM`	`""`	No	An optional platform specifier used when pulling the image into the docker daemon (e.g. `linux/arm64`, `linux/amd64`). Set this when the daemon cannot select an entry from a multi-arch image index on its own (optional).
`--stig-container-manual-override`	string	`ANCHORECTL_STIG_CONTAINER_MANUAL_OVERRIDE`	`""`	No	Docker container ID to use as the STIG target (skips creating container with anchore-keep-alive binary).
`-i`, `--stig-input-file`	string (repeatable)	`ANCHORECTL_STIG_INPUT_FILE`	`[]`	No	Path to input file to use for STIG generation. The input file can optionally provide variable inputs to the STIG profile that can change the execution of specific controls (optional).
`--stig-output-dir`	string	`ANCHORECTL_STIG_OUTPUT_DIR`	`""`	No	Path to save the STIG evaluation (optional).
`--stig-skip-upload`	bool	`ANCHORECTL_STIG_SKIP_UPLOAD`	`false`	No	Skip uploading the STIG evaluation to Anchore (optional).
`--stig-tools-binary-path`	string	`ANCHORECTL_STIG_TOOLS_BINARY_PATH`	`""`	No	Path to the statically-linked busybox binary inside the tools image (default: /bin/busybox).
`--stig-tools-image`	string	`ANCHORECTL_STIG_TOOLS_IMAGE`	`""`	No	Container image containing a statically-linked busybox binary for shell-less image support (e.g. docker.io/library/busybox:musl). The binary must be statically linked to work in distroless containers.
`--stig-waiver-file`	string (repeatable)	`ANCHORECTL_STIG_WAIVER_FILE`	`[]`	No	Path to waiver file to use for STIG generation. The waiver file can waive controls and dictate the running and/or reporting of those controls (optional).

stig docker image list

List the STIG evaluation metadata for an image.

anchorectl stig docker image list IMAGE [flags]

Arguments

Argument	Description
`IMAGE`	The image ID, `name:tag`, `name@sha256:digest`, `name:tag@sha256:digest`, or `sha256:digest` value.

Flags

Flag	Type	Environment variable	Default	Required	Description
`-o`, `--output`	string	`ANCHORECTL_FORMAT`	`text`	No	The format to show the results. Allowable values: `text`, `json`, `json-raw`, `id`. See Output Formats.

stig write-profiles

Write Anchore STIG profiles to disk.

anchorectl stig write-profiles PATH [flags]

Arguments

Argument	Description
`PATH`	Path to write the profiles to.

17 - anchorectl subscription

Subscription related operations.

Every command on this page also accepts the global flags.

Subcommands

subscription activate — Activate an existing subscription
subscription deactivate — Deactivate an existing subscription
subscription delete — Delete a subscription
subscription get — Get a specific subscription
subscription list — List all subscriptions

subscription activate

Activate an existing subscription.

anchorectl subscription activate KEY TYPE [flags]

Arguments

Argument	Description
`KEY`	The subscription key.
`TYPE`	The type of the subscription (e.g. tag_update, policy_eval, vuln_update, analysis_update, runtime_inventory).

Examples

anchorectl subscription activate registry.example.com/my-service:1.4.0 tag_update

Flags

Flag	Type	Environment variable	Default	Required	Description
`-o`, `--output`	string	`ANCHORECTL_FORMAT`	`text`	No	The format to show the results. Allowable values: `text`, `json`, `json-raw`, `id`. See Output Formats.

subscription deactivate

Deactivate an existing subscription.

anchorectl subscription deactivate KEY TYPE [flags]

Arguments

Argument	Description
`KEY`	The subscription key.
`TYPE`	The type of the subscription (e.g. tag_update, policy_eval, vuln_update, analysis_update, runtime_inventory).

Flags

Flag	Type	Environment variable	Default	Required	Description
`-o`, `--output`	string	`ANCHORECTL_FORMAT`	`text`	No	The format to show the results. Allowable values: `text`, `json`, `json-raw`, `id`. See Output Formats.

subscription delete

Delete a subscription.

anchorectl subscription delete KEY TYPE [flags]

Aliases: del

Arguments

Argument	Description
`KEY`	The subscription key.
`TYPE`	The type of the subscription (e.g. tag_update, policy_eval, vuln_update, analysis_update).

Flags

Flag	Type	Environment variable	Default	Required	Description
`-o`, `--output`	string	`ANCHORECTL_FORMAT`	`text`	No	The format to show the results. Allowable values: `text`, `json`, `json-raw`, `id`. See Output Formats.

subscription get

Get a specific subscription.

anchorectl subscription get KEY TYPE [flags]

Arguments

Argument	Description
`KEY`	The subscription key.
`TYPE`	The type of the subscription (e.g. tag_update, policy_eval, vuln_update, analysis_update).

Flags

Flag	Type	Environment variable	Default	Required	Description
`-o`, `--output`	string	`ANCHORECTL_FORMAT`	`text`	No	The format to show the results. Allowable values: `text`, `json`, `json-raw`, `id`. See Output Formats.

subscription list

List all subscriptions.

anchorectl subscription list [flags]

Flags

Flag	Type	Environment variable	Default	Required	Description
`-k`, `--key`	string	`ANCHORECTL_SUBSCRIPTION_KEY`	`""`	No	Filter only subscriptions matching key.
`-o`, `--output`	string	`ANCHORECTL_FORMAT`	`text`	No	The format to show the results. Allowable values: `text`, `json`, `json-raw`, `id`. See Output Formats.
`-t`, `--type`	string	`ANCHORECTL_SUBSCRIPTION_TYPE`	`""`	No	Filter only subscriptions matching type.

18 - anchorectl system

System related operations.

Every command on this page also accepts the global flags.

Subcommands

system artifact-lifecycle-policy — Global artifact lifecycle policy operations
system delete — Delete service
system integration — Product Integration Operations
system role — RBAC Role Operations
system smoke-tests — Smoke test related operations
system status — Get the system status
system wait — Wait for configured Anchore system to be running based upon set of filters

system artifact-lifecycle-policy

Global artifact lifecycle policy operations.

anchorectl system artifact-lifecycle-policy [command]

Subcommands

system artifact-lifecycle-policy add — Creates an artifact lifecycle policy.
system artifact-lifecycle-policy delete — Delete artifact lifecycle policy
system artifact-lifecycle-policy get — Get single artifact lifecycle policy with latest conditions
system artifact-lifecycle-policy list — List all artifact lifecycle policies
system artifact-lifecycle-policy update — Updates an artifact lifecycle policy.

system artifact-lifecycle-policy add

Creates an artifact lifecycle policy.

anchorectl system artifact-lifecycle-policy add [flags]

Flags

Flag	Type	Environment variable	Default	Required	Description
`--action`	string	—	`""`	Yes	The artifact policy action. Allowable values: `delete`.
`--artifact-type`	string	—	`""`	Yes	The artifact type the policy will act on. Allowable values: `image`.
`--days-since-analyzed`	string	—	`""`	Yes	The number of days elapsed since the artifact was analyzed for it to be selected for action.
`--even-if-exists-in-runtime`	string	—	`""`	Yes	When true, images matching all criteria and found in the runtime inventory can be selected for action. Allowable values: `true`, `false`.
`--include-base-images`	string	—	`""`	Yes	When true, images matching all criteria and with known children can be selected for action. Allowable values: `true`, `false`.
`--include-failed-analysis`	string	—	`""`	Yes	When true, images matching all criteria and in a failed analysis state can be selected for action. Allowable values: `true`, `false`.
`--name`	string	—	`""`	Yes	A unique name for the artifact policy.
`--description`	string	—	`""`	No	A description for the policy.
`--enable`	string	—	`false`	No	When true, the policy will be enabled. Allowable values: `true`, `false`.
`-o`, `--output`	string	—	`text`	No	The format to show the results. Allowable values: `text`, `json`, `json-raw`, `id`. See Output Formats.

system artifact-lifecycle-policy delete

Delete artifact lifecycle policy.

anchorectl system artifact-lifecycle-policy delete POLICY_UUID [flags]

Aliases: del

Arguments

Argument	Description
`POLICY_UUID`	The uuid of the artifact lifecycle policy.

Flags

Flag	Type	Environment variable	Default	Required	Description
`-o`, `--output`	string	`ANCHORECTL_FORMAT`	`text`	No	The format to show the results. Allowable values: `text`, `json`, `json-raw`, `id`. See Output Formats.

system artifact-lifecycle-policy get

Get single artifact lifecycle policy with latest conditions.

anchorectl system artifact-lifecycle-policy get POLICY_UUID [flags]

Arguments

Argument	Description
`POLICY_UUID`	The uuid of the artifact lifecycle policy.

Flags

Flag	Type	Environment variable	Default	Required	Description
`-o`, `--output`	string	`ANCHORECTL_FORMAT`	`text`	No	The format to show the results. Allowable values: `text`, `json`, `json-raw`, `id`. See Output Formats.

system artifact-lifecycle-policy list

List all artifact lifecycle policies.

anchorectl system artifact-lifecycle-policy list [flags]

Flags

Flag	Type	Environment variable	Default	Required	Description
`-o`, `--output`	string	`ANCHORECTL_FORMAT`	`text`	No	The format to show the results. Allowable values: `text`, `json`, `json-raw`, `id`. See Output Formats.

system artifact-lifecycle-policy update

Updates an artifact lifecycle policy.

anchorectl system artifact-lifecycle-policy update POLICY_UUID [flags]

Flags

Flag	Type	Environment variable	Default	Required	Description
`--action`	string	—	`""`	Yes	The artifact policy action. Allowable values: `delete`.
`--artifact-type`	string	—	`""`	Yes	The artifact type the policy will act on. Allowable values: `image`.
`--days-since-analyzed`	string	—	`""`	Yes	The number of days elapsed since the artifact was analyzed for it to be selected for action.
`--enable`	string	—	`""`	Yes	When true, the policy will be enabled. Allowable values: `true`, `false`.
`--even-if-exists-in-runtime`	string	—	`""`	Yes	When true, images matching all criteria and found in the runtime inventory can be selected for action. Allowable values: `true`, `false`.
`--include-base-images`	string	—	`""`	Yes	When true, images matching all criteria and with known children can be selected for action. Allowable values: `true`, `false`.
`--include-failed-analysis`	string	—	`""`	Yes	When true, images matching all criteria and in a failed analysis state can be selected for action. Allowable values: `true`, `false`.
`--name`	string	—	`""`	Yes	A unique name for the artifact policy.
`--description`	string	—	`""`	No	A description for the policy.
`-o`, `--output`	string	—	`text`	No	The format to show the results. Allowable values: `text`, `json`, `json-raw`, `id`. See Output Formats.

system delete

Delete service.

anchorectl system delete SERVICE_NAME HOST_ID [flags]

Aliases: del

Arguments

Argument	Description
`SERVICE_NAME`	The service to delete, as shown in the SERVICE column of `anchorectl system status`.
`HOST_ID`	The host ID of the service instance, as shown in the HOST ID column of `anchorectl system status`.

Flags

Flag	Type	Environment variable	Default	Required	Description
`-o`, `--output`	string	`ANCHORECTL_FORMAT`	`text`	No	The format to show the results. Allowable values: `text`, `json`, `json-raw`, `id`. See Output Formats.

system integration

Product Integration Operations.

anchorectl system integration [command]

Subcommands

system integration delete — Delete the health data for an integration instance
system integration get — Get information about an integration instance
system integration list — Lists all integrations that have been created (explicitly or indirectly via registration).

system integration delete

Delete the health data for an integration instance.

anchorectl system integration delete INTEGRATION_UUID [flags]

Aliases: del

Arguments

Argument	Description
`INTEGRATION_UUID`	The integration UUID.

Flags

Flag	Type	Environment variable	Default	Required	Description
`--force`	bool	`ANCHORECTL_FORCE`	`false`	No	Force deletion of the integration instance regardless of its state.
`-o`, `--output`	string	`ANCHORECTL_FORMAT`	`text`	No	The format to show the results. Allowable values: `text`, `json`, `json-raw`, `id`. See Output Formats.

system integration get

Get information about an integration instance.

anchorectl system integration get INTEGRATION [flags]

Arguments

Argument	Description
`INTEGRATION`	The integration UUID.

Flags

Flag	Type	Environment variable	Default	Required	Description
`-o`, `--output`	string	`ANCHORECTL_FORMAT`	`text`	No	The format to show the results. Allowable values: `text`, `json`, `json-raw`, `id`. See Output Formats.

system integration list

Lists all integrations that have been created (explicitly or indirectly via registration).

anchorectl system integration list [flags]

Flags

Flag	Type	Environment variable	Default	Required	Description
`-o`, `--output`	string	`ANCHORECTL_FORMAT`	`text`	No	The format to show the results. Allowable values: `text`, `json`, `json-raw`, `id`. See Output Formats.

system role

RBAC Role Operations.

anchorectl system role [command]

Subcommands

system role get — Get detailed information about a specific role
system role list — List roles available in the system

system role get

Get detailed information about a specific role.

anchorectl system role get ROLE_NAME [flags]

Arguments

Argument	Description
`ROLE_NAME`	Name of the RBAC Role.

Flags

Flag	Type	Environment variable	Default	Required	Description
`-o`, `--output`	string	`ANCHORECTL_FORMAT`	`text`	No	The format to show the results. Allowable values: `text`, `json`, `json-raw`, `id`. See Output Formats.

system role list

List roles available in the system.

anchorectl system role list [flags]

Flags

Flag	Type	Environment variable	Default	Required	Description
`-o`, `--output`	string	`ANCHORECTL_FORMAT`	`text`	No	The format to show the results. Allowable values: `text`, `json`, `json-raw`, `id`. See Output Formats.

system smoke-tests

Smoke test related operations.

anchorectl system smoke-tests [command]

Subcommands

system smoke-tests run — Run smoke tests

system smoke-tests run

Run smoke tests.

anchorectl system smoke-tests run [flags]

Flags

Flag	Type	Environment variable	Default	Required	Description
`-i`, `--image`	string	—	`""`	No	The image to run the smoke tests against.
`-o`, `--output`	string	`ANCHORECTL_FORMAT`	`text`	No	The format to show the results. Allowable values: `text`, `json`, `json-raw`, `id`. See Output Formats.

system status

Get the system status.

anchorectl system status [flags]

Examples

anchorectl system status

Flags

Flag	Type	Environment variable	Default	Required	Description
`-o`, `--output`	string	`ANCHORECTL_FORMAT`	`text`	No	The format to show the results. Allowable values: `text`, `json`, `json-raw`, `id`. See Output Formats.

system wait

Wait for configured Anchore system to be running based upon set of filters.

anchorectl system wait [flags]

Examples

# Block until the API is up and feeds have synced, giving up after 5 minutes
anchorectl system wait --timeout 300

Flags

Flag	Type	Environment variable	Default	Required	Description
`-i`, `--interval`	int	`ANCHORECTL_SYSTEM_INTERVAL`	`5`	No	Interval in which to query the system, in seconds. Default = 5.
`--services`	string (repeatable)	`ANCHORECTL_SYSTEM_SERVICES`	`[apiext]`	No	Service(s) to wait for. Options are [apiext,catalog,component_catalog,policy_engine,simplequeue,analyzer,notifications,reports,reports_worker].
`-t`, `--timeout`	int	`ANCHORECTL_SYSTEM_TIMEOUT`	`-1`	No	Number of seconds to wait until error out. < 0 waits forever. Default = -1.
`--wait-for-feeds`	bool	`ANCHORECTL_SYSTEM_WAIT_FOR_FEEDS`	`true`	No	Wait until feeds are synced. Defaults to true.

19 - anchorectl user

User related operations.

Every command on this page also accepts the global flags.

Subcommands

user add — Create a new user
user delete — Delete a specific user credential by username of the credential. Cannot be the credential used to authenticate the request.
user get — Get a specific user in the specified account
user list — List users for the account
user set-password — Set the password for a user

user add

Create a new user.

anchorectl user add USERNAME [flags]

Arguments

Argument	Description
`USERNAME`	The name of the user to create.

Flags

Flag	Type	Environment variable	Default	Required	Description
`--account`	string	`ANCHORECTL_USER_ACCOUNT`	`""`	No	The account to use, defaults to current account.
`--idp_name`	string	`ANCHORECTL_IDP_NAME`	`""`	No	The name of the IDP user will be authenticated with.
`-o`, `--output`	string	`ANCHORECTL_FORMAT`	`text`	No	The format to show the results. Allowable values: `text`, `json`, `id`. See Output Formats.
`--role`	string (repeatable)	`ANCHORECTL_USER_ROLE`	`[]`	No	The initial role(s) for the user. Defaults to (read-write) when not in the admin account.

user delete

Delete a specific user credential by username of the credential. Cannot be the credential used to authenticate the request.

anchorectl user delete USERNAME [flags]

Aliases: del

Arguments

Argument	Description
`USERNAME`	Name of the user to delete.

Flags

Flag	Type	Environment variable	Default	Required	Description
`--account`	string	`ANCHORECTL_USER_ACCOUNT`	`""`	No	The account to use, defaults to current account.
`-o`, `--output`	string	`ANCHORECTL_FORMAT`	`text`	No	The format to show the results. Allowable values: `text`, `json`, `json-raw`, `id`. See Output Formats.

user get

Get a specific user in the specified account.

anchorectl user get USERNAME [flags]

Arguments

Argument	Description
`USERNAME`	Name of the user to fetch.

Flags

Flag	Type	Environment variable	Default	Required	Description
`--account`	string	`ANCHORECTL_USER_ACCOUNT`	`""`	No	The account to use, defaults to current account.
`-o`, `--output`	string	`ANCHORECTL_FORMAT`	`text`	No	The format to show the results. Allowable values: `text`, `json`, `json-raw`, `id`. See Output Formats.

user list

List users for the account.

anchorectl user list [flags]

Flags

Flag	Type	Environment variable	Default	Required	Description
`--account`	string	`ANCHORECTL_USER_ACCOUNT`	`""`	No	The account to use, defaults to current account.
`-o`, `--output`	string	`ANCHORECTL_FORMAT`	`text`	No	The format to show the results. Allowable values: `text`, `json`, `json-raw`, `id`. See Output Formats.

user set-password

Set the password for a user.

anchorectl user set-password USERNAME [flags]

Arguments

Argument	Description
`USERNAME`	Name of the user to set the password for.

Flags

Flag	Type	Environment variable	Default	Required	Description
`--account`	string	`ANCHORECTL_USER_ACCOUNT`	`""`	No	The account to use, defaults to the current account.
`-o`, `--output`	string	`ANCHORECTL_FORMAT`	`text`	No	The format to show the results. Allowable values: `text`, `json`, `json-raw`, `id`. See Output Formats.

20 - anchorectl usergroup

User Group Management Operations.

Every command on this page also accepts the global flags.

Subcommands

usergroup add — Create a new user group
usergroup delete — Delete a user group
usergroup get — Get a user group
usergroup list — List user groups
usergroup role — User Group Role Operations
usergroup update — Update a user group
usergroup user — User Group User Operations

usergroup add

Create a new user group.

anchorectl usergroup add NAME [flags]

Arguments

Argument	Description
`NAME`	The name of the user group.

Flags

Flag	Type	Environment variable	Default	Required	Description
`-d`, `--description`	string	`ANCHORECTL_USERGROUPPOST_DESCRIPTION`	`""`	No	The description of the user group.
`-o`, `--output`	string	`ANCHORECTL_FORMAT`	`text`	No	The format to show the results. Allowable values: `text`, `json`, `json-raw`, `id`. See Output Formats.

usergroup delete

Delete a user group.

anchorectl usergroup delete USER_GROUP [flags]

Aliases: del

Arguments

Argument	Description
`USER_GROUP`	The name or uuid of the user group.

Flags

Flag	Type	Environment variable	Default	Required	Description
`-o`, `--output`	string	`ANCHORECTL_FORMAT`	`text`	No	The format to show the results. Allowable values: `text`, `json`, `json-raw`, `id`. See Output Formats.

usergroup get

Get a user group.

anchorectl usergroup get USER_GROUP [flags]

Arguments

Argument	Description
`USER_GROUP`	The name or uuid of the user group.

Flags

Flag	Type	Environment variable	Default	Required	Description
`-o`, `--output`	string	`ANCHORECTL_FORMAT`	`text`	No	The format to show the results. Allowable values: `text`, `json`, `json-raw`, `id`. See Output Formats.

usergroup list

List user groups.

anchorectl usergroup list [flags]

Flags

Flag	Type	Environment variable	Default	Required	Description
`-a`, `--contains-account`	string	`ANCHORECTL_USERGROUP_CONTAINS_ACCOUNT`	`""`	No	Filter the user groups to only those that contain the specified domain name.
`-u`, `--contains-user`	string	`ANCHORECTL_USERGROUP_CONTAINS_USER`	`""`	No	Filter the user groups to only those that contain the specified user.
`-o`, `--output`	string	`ANCHORECTL_FORMAT`	`text`	No	The format to show the results. Allowable values: `text`, `json`, `json-raw`, `id`. See Output Formats.
`-g`, `--user-group-name`	string	`ANCHORECTL_USERGROUP_USER_GROUP_NAME`	`""`	No	Filter results to match the specified user group name.

usergroup role

User Group Role Operations.

anchorectl usergroup role [command]

Subcommands

usergroup role add — Add domain name and role(s) to this user group
usergroup role delete — Remove domain name and role(s) from this user group
usergroup role list — List accounts and roles configured in this user group

usergroup role add

Add domain name and role(s) to this user group.

anchorectl usergroup role add USER_GROUP DOMAIN_NAME [flags]

Arguments

Argument	Description
`DOMAIN_NAME`	The domain name.
`USER_GROUP`	The name or uuid of the user group.

Flags

Flag	Type	Environment variable	Default	Required	Description
`-i`, `--input`	string	`ANCHORECTL_INPUT`	`""`	No	Path to a JSON input file or - to read from stdin.
`-o`, `--output`	string	`ANCHORECTL_FORMAT`	`text`	No	The format to show the results. Allowable values: `text`, `json`, `json-raw`, `id`. See Output Formats.
`-r`, `--role`	string (repeatable)	`ANCHORECTL_ROLE`	`[]`	No	The RBAC role(s) that will be associated with the specified domain.

usergroup role delete

Remove domain name and role(s) from this user group.

anchorectl usergroup role delete USER_GROUP DOMAIN_NAME [flags]

Aliases: del

Arguments

Argument	Description
`DOMAIN_NAME`	The domain name.
`USER_GROUP`	The name or uuid of the user group.

Flags

Flag	Type	Environment variable	Default	Required	Description
`-o`, `--output`	string	`ANCHORECTL_FORMAT`	`text`	No	The format to show the results. Allowable values: `text`, `json`, `json-raw`, `id`. See Output Formats.
`-r`, `--role`	string (repeatable)	`ANCHORECTL_ROLE`	`[]`	No	The RBAC role(s) that will be associated with the specified domain name.

usergroup role list

List accounts and roles configured in this user group.

anchorectl usergroup role list USER_GROUP [flags]

Arguments

Argument	Description
`USER_GROUP`	The name or uuid of the user group.

Flags

Flag	Type	Environment variable	Default	Required	Description
`-i`, `--input`	string	`ANCHORECTL_INPUT`	`""`	No	Path to a JSON input file or - to read from stdin.
`-o`, `--output`	string	`ANCHORECTL_FORMAT`	`text`	No	The format to show the results. Allowable values: `text`, `json`, `json-raw`, `id`. See Output Formats.

usergroup update

Update a user group.

anchorectl usergroup update USER_GROUP [flags]

Arguments

Argument	Description
`USER_GROUP`	The name or uuid of the user group.

Flags

Flag	Type	Environment variable	Default	Required	Description
`-d`, `--description`	string	`ANCHORECTL_USERGROUP_DESCRIPTION`	`""`	Yes	The description of the user group.
`-o`, `--output`	string	`ANCHORECTL_FORMAT`	`text`	No	The format to show the results. Allowable values: `text`, `json`, `json-raw`, `id`. See Output Formats.

usergroup user

User Group User Operations.

anchorectl usergroup user [command]

Subcommands

usergroup user add — Add user(s) to this user group
usergroup user delete — Remove user(s) from this user group
usergroup user list — List users configured in this user group

usergroup user add

Add user(s) to this user group.

anchorectl usergroup user add USER_GROUP [flags]

Arguments

Argument	Description
`USER_GROUP`	The name or uuid of the user group.

Flags

Flag	Type	Environment variable	Default	Required	Description
`-i`, `--input`	string	`ANCHORECTL_INPUT`	`""`	No	Path to a JSON input file or - to read from stdin.
`-o`, `--output`	string	`ANCHORECTL_FORMAT`	`text`	No	The format to show the results. Allowable values: `text`, `json`, `json-raw`, `id`. See Output Formats.
`-u`, `--user`	string (repeatable)	`ANCHORECTL_USER`	`[]`	No	The username(s) that will be associated with the User Group.

usergroup user delete

Remove user(s) from this user group.

anchorectl usergroup user delete USER_GROUP [flags]

Aliases: del

Arguments

Argument	Description
`USER_GROUP`	The name or uuid of the user group.

Flags

Flag	Type	Environment variable	Default	Required	Description
`-o`, `--output`	string	`ANCHORECTL_FORMAT`	`text`	No	The format to show the results. Allowable values: `text`, `json`, `json-raw`, `id`. See Output Formats.
`-u`, `--user`	string (repeatable)	`ANCHORECTL_USER`	`[]`	No	The username(s) that will be removed from the User group.

usergroup user list

List users configured in this user group.

anchorectl usergroup user list USER_GROUP [flags]

Arguments

Argument	Description
`USER_GROUP`	The name or uuid of the user group.

Flags

Flag	Type	Environment variable	Default	Required	Description
`-i`, `--input`	string	`ANCHORECTL_INPUT`	`""`	No	Path to a JSON input file or - to read from stdin.
`-o`, `--output`	string	`ANCHORECTL_FORMAT`	`text`	No	The format to show the results. Allowable values: `text`, `json`, `json-raw`, `id`. See Output Formats.

21 - anchorectl version

Show anchorectl version information.

Every command on this page also accepts the global flags.

anchorectl version [flags]

Examples

# Print just the version string; works only as a root flag
anchorectl --version

# Full build detail: Syft version, build date, commit, and platform
anchorectl version

# Machine-readable. ANCHORECTL_FORMAT is ignored here, so pass the flag explicitly
anchorectl version --output json

Flags

Flag	Type	Environment variable	Default	Required	Description
`-o`, `--output`	string	—	`text`	No	The format to show the results. Allowable values: `text`, `json`. See Output Formats.

AnchoreCTL Reference

Related Pages

Command Syntax

Global Flags

Output Formats

Exit Codes

Command Index

1 - anchorectl account

account add

account delete

account disable

account enable

account get

account list

account update

2 - anchorectl airgap

airgap feed

airgap feed download

airgap feed upload

3 - anchorectl app

app add

app delete

app get

app job

app job cancel

app job get

app job list

app list

app update

app version

app version add

app version asset

app version asset add

app version asset add analysis-bundle

app version asset add container-image

app version asset add container-image-remote

app version asset add filesystem

app version asset add sbom

app version asset delete

app version asset get

app version asset list

app version asset sbom

app version asset sbom get

app version asset update

app version delete

app version export

app version export packages

app version export policy-compliance

app version export sbom-cyclonedx-1

app version export sbom-spdx-2

app version export vdr

app version export vex

app version export vulnerabilities

app version get

app version list

app version package

app version package list

app version policy

app version policy findings

app version policy findings list

app version policy status

app version policy status get

app version update

app version vex

app version vex add

app version vex delete

app version vex get

app version vex list

app version vex update

app version vuln

app version vuln list

4 - anchorectl archive

archive image

archive image add

archive image delete

archive image get

archive image list

archive image restore

archive rule

archive rule add