anchorectl app

App related operations.

Every command on this page also accepts the global flags.

Subcommands

app add — Create a new app
app delete — Delete an app by name or ID
app get — Get an app by name or ID
app job — Job operations for an app
app list — List all apps
app update — Update an existing app
app version — App version related operations

app add

Create a new app.

anchorectl app add NAME [flags]

Arguments

Argument	Description
`NAME`	The name of the app.

Flags

Flag	Type	Environment variable	Default	Required	Description
`--contact-name`	string	`ANCHORECTL_CONTACT_NAME`	`""`	Yes	Contact person name.
`--contact-email`	string	`ANCHORECTL_CONTACT_EMAIL`	`""`	No	Contact email address.
`--contact-phone`	string	`ANCHORECTL_CONTACT_PHONE`	`""`	No	Contact phone number.
`--description`	string	`ANCHORECTL_DESCRIPTION`	`""`	No	The description of the app.
`-o`, `--output`	string	`ANCHORECTL_FORMAT`	`text`	No	The format to show the results. Allowable values: `text`, `json`, `json-raw`, `id`. See Output Formats.
`--policy-id`	string	`ANCHORECTL_POLICY_ID`	`""`	No	The policy name or ID to associate with the app.

app delete

Delete an app by name or ID.

anchorectl app delete APP [flags]

Aliases: del

Arguments

Argument	Description
`APP`	The app name or ID.

Flags

Flag	Type	Environment variable	Default	Required	Description
`--force`	bool	`ANCHORECTL_FORCE`	`false`	No	Force delete (removes all versions and associations).
`-o`, `--output`	string	`ANCHORECTL_FORMAT`	`text`	No	The format to show the results. Allowable values: `text`, `json`, `json-raw`, `id`. See Output Formats.

app get

Get an app by name or ID.

anchorectl app get APP [flags]

Arguments

Argument	Description
`APP`	The app name or ID.

Flags

Flag	Type	Environment variable	Default	Required	Description
`-o`, `--output`	string	`ANCHORECTL_FORMAT`	`text`	No	The format to show the results. Allowable values: `text`, `json`, `json-raw`, `id`. See Output Formats.

app job

Job operations for an app.

anchorectl app job [command]

Subcommands

app job cancel — Cancel a job
app job get — Get a job by ID. Pass --detail with -o json-raw to fetch the type-specific job payload (job_spec, completion_detail, etc.).
app job list — List jobs for an app

app job cancel

Cancel a job.

anchorectl app job cancel JOB_ID [flags]

Arguments

Argument	Description
`JOB_ID`	The job UUID.

Flags

Flag	Type	Environment variable	Default	Required	Description
`--app`	string	`ANCHORECTL_APP`	`""`	Yes	The app name or ID.
`-o`, `--output`	string	`ANCHORECTL_FORMAT`	`text`	No	The format to show the results. Allowable values: `text`, `json`, `json-raw`, `id`. See Output Formats.

app job get

Get a job by ID. Pass --detail with -o json-raw to fetch the type-specific job payload (job_spec, completion_detail, etc.).

anchorectl app job get JOB_ID [flags]

Arguments

Argument	Description
`JOB_ID`	The job UUID.

Flags

Flag	Type	Environment variable	Default	Required	Description
`--app`	string	`ANCHORECTL_APP`	`""`	Yes	The app name or ID.
`--detail`	bool	`ANCHORECTL_DETAIL`	`false`	No	Fetch the type-specific job payload (requires `-o` json-raw).
`-o`, `--output`	string	`ANCHORECTL_FORMAT`	`text`	No	The format to show the results. Allowable values: `text`, `json`, `json-raw`, `id`. See Output Formats.

app job list

List jobs for an app.

anchorectl app job list APP [flags]

Arguments

Argument	Description
`APP`	The app name or ID.

Flags

Flag	Type	Environment variable	Default	Required	Description
`--created-since`	string	`ANCHORECTL_CREATED_SINCE`	`""`	No	Only show jobs created since: Go duration syntax (units s/m/h, e.g. “30m”, “1h”, “2h45m”, “1.5h”) or a datetime (“2026-04-15”, “2026-04-15 09:00:00”, “2026-04-15T09:00:00Z”). Bare datetimes are interpreted in local time.
`--mine`	bool	`ANCHORECTL_MINE`	`false`	No	Only show jobs owned by the current user.
`-o`, `--output`	string	`ANCHORECTL_FORMAT`	`text`	No	The format to show the results. Allowable values: `text`, `json`, `json-raw`, `id`. See Output Formats.
`--status`	string (repeatable)	`ANCHORECTL_STATUS`	`[]`	No	Filter by job status (comma-separated for multiple, OR semantics). Allowable values: `pending`, `processing`, `cancelled`, `complete`, `failed`.
`--version`	string	`ANCHORECTL_VERSION`	`""`	No	Filter by version name or UUID.

app list

List all apps.

anchorectl app list [flags]

Flags

Flag	Type	Environment variable	Default	Required	Description
`--name`	string	`ANCHORECTL_NAME`	`""`	No	Filter by exact app name.
`-o`, `--output`	string	`ANCHORECTL_FORMAT`	`text`	No	The format to show the results. Allowable values: `text`, `json`, `json-raw`, `id`. See Output Formats.

app update

Update an existing app.

anchorectl app update APP [flags]

Arguments

Argument	Description
`APP`	The app name or ID.

Flags

Flag	Type	Environment variable	Default	Required	Description
`--contact-email`	string	`ANCHORECTL_CONTACT_EMAIL`	`""`	No	Contact email address.
`--contact-name`	string	`ANCHORECTL_CONTACT_NAME`	`""`	No	Contact person name.
`--contact-phone`	string	`ANCHORECTL_CONTACT_PHONE`	`""`	No	Contact phone number.
`--description`	string	`ANCHORECTL_DESCRIPTION`	`""`	No	The new description.
`--name`	string	`ANCHORECTL_NAME`	`""`	No	The new name for the app.
`-o`, `--output`	string	`ANCHORECTL_FORMAT`	`text`	No	The format to show the results. Allowable values: `text`, `json`, `json-raw`, `id`. See Output Formats.
`--policy-id`	string	`ANCHORECTL_POLICY_ID`	`""`	No	The policy name or ID to associate.

app version

App version related operations.

anchorectl app version [command]

Subcommands

app version add — Create a new app version
app version asset — App version asset operations
app version delete — Delete an app version by name or ID
app version export — Export documents for an app version
app version get — Get an app version by name or ID
app version list — List all versions of an app
app version package — App version package operations
app version policy — App version policy operations
app version update — Update an existing app version
app version vex — VEX annotation operations for an app version
app version vuln — App version vulnerability operations

app version add

Create a new app version.

anchorectl app version add NAME [flags]

Arguments

Argument	Description
`NAME`	The name of the version.

Examples

# Create a released version of an app
anchorectl app version add 1.4.0 --app my-service --status released

# Create the next version and chain it to its predecessor
anchorectl app version add 1.5.0 --app my-service --status in_progress --previous-version 1.4.0

Flags

Flag	Type	Environment variable	Default	Required	Description
`--app`	string	`ANCHORECTL_APP`	`""`	Yes	The app name or ID.
`--description`	string	`ANCHORECTL_DESCRIPTION`	`""`	No	The version description.
`-o`, `--output`	string	`ANCHORECTL_FORMAT`	`text`	No	The format to show the results. Allowable values: `text`, `json`, `json-raw`, `id`. See Output Formats.
`--previous-version`	string	`ANCHORECTL_PREVIOUS_VERSION`	`""`	No	The previous version name or UUID.
`--release-date`	string	`ANCHORECTL_RELEASE_DATE`	`""`	No	Date of release of this version (e.g. 2026-01-15).
`--status`	string	`ANCHORECTL_STATUS`	`""`	No	The status of the app version (in_progress, released, eol).

app version asset

App version asset operations.

anchorectl app version asset [command]

Subcommands

app version asset add — Add an asset to an app version
app version asset delete — Delete an asset from an app version
app version asset get — Get an asset by ID for an app version
app version asset list — List assets for an app version
app version asset sbom — App version asset SBOM operations
app version asset update — Update an asset for an app version

app version asset add

Add an asset to an app version.

anchorectl app version asset add [command]

Subcommands

app version asset add analysis-bundle — Upload an analysis bundle produced by anchorectl generate analysis-bundle as an asset to an app version. Creates a job to import and process the analysis.
app version asset add container-image — Add a container image as an asset. By default pulls from a registry. Use --from docker or --from podman to analyze a local daemon image, or --from docker-archive:/path/to.tar to load from an archive.
app version asset add container-image-remote — Add a container image via centralized analysis. Enterprise pulls and analyzes the image from the registry.
app version asset add filesystem — Add a filesystem directory as an asset. Analyzes the directory locally using Syft, generates an SBOM, and uploads it to Enterprise.
app version asset add sbom — Upload an SBOM file as an asset to an app version. Creates a job to import and process the SBOM.

app version asset add analysis-bundle

Upload an analysis bundle produced by anchorectl generate analysis-bundle as an asset to an app version. Creates a job to import and process the analysis.

anchorectl app version asset add analysis-bundle BUNDLE [flags]

Arguments

Argument	Description
`BUNDLE`	Path to the analysis bundle tar archive (uncompressed; typically named .tar).

Flags

Flag	Type	Environment variable	Default	Required	Description
`--app`	string	`ANCHORECTL_APP`	`""`	Yes	The app name or ID.
`--asset`	string	`ANCHORECTL_ASSET`	`""`	Yes	The name for the new asset.
`--version`	string	`ANCHORECTL_VERSION`	`""`	Yes	The version name or UUID.
`-a`, `--annotations`	string	`ANCHORECTL_ANNOTATIONS`	`""`	No	Annotations as comma-separated key=value pairs.
`-o`, `--output`	string	`ANCHORECTL_FORMAT`	`text`	No	The format to show the results. Allowable values: `text`, `json`, `json-raw`, `id`. See Output Formats.
`-t`, `--type`	string	`ANCHORECTL_TYPE`	`unknown`	No	The asset type (image analysis bundles default to container).
`-w`, `--wait`	bool	`ANCHORECTL_WAIT`	`false`	No	Wait for the job to complete before returning.

app version asset add container-image

Add a container image as an asset. By default pulls from a registry. Use --from docker or --from podman to analyze a local daemon image, or --from docker-archive:/path/to.tar to load from an archive.

anchorectl app version asset add container-image IMAGE [flags]

Arguments

Argument	Description
`IMAGE`	The container image reference (e.g. docker.io/library/nginx:latest).

Flags

Flag	Type	Environment variable	Default	Required	Description
`--app`	string	`ANCHORECTL_APP`	`""`	Yes	The app name or ID.
`--asset`	string	`ANCHORECTL_ASSET`	`""`	Yes	The name for the new asset.
`--version`	string	`ANCHORECTL_VERSION`	`""`	Yes	The version name or UUID.
`-a`, `--annotations`	string	`ANCHORECTL_ANNOTATIONS`	`""`	No	Annotations as comma-separated key=value pairs.
`--dockerfile`	string	`ANCHORECTL_DOCKERFILE`	`""`	No	Path to the Dockerfile used to build the image.
`--from`	string	`ANCHORECTL_FROM`	`""`	No	Image source: registry (default), docker, podman, or docker-archive:`<path>` (docker and podman: if the image is not present in the daemon it is pulled from the registry).
`-o`, `--output`	string	`ANCHORECTL_FORMAT`	`text`	No	The format to show the results. Allowable values: `text`, `json`, `json-raw`, `id`. See Output Formats.
`-p`, `--platform`	string	`ANCHORECTL_PLATFORM`	`""`	No	Platform specifier (e.g. linux/amd64).
`-t`, `--type`	string	`ANCHORECTL_TYPE`	`container`	No	The asset type.
`-w`, `--wait`	bool	`ANCHORECTL_WAIT`	`false`	No	Wait for the job to complete before returning.

app version asset add container-image-remote

Add a container image via centralized analysis. Enterprise pulls and analyzes the image from the registry.

anchorectl app version asset add container-image-remote IMAGE [flags]

Arguments

Argument	Description
`IMAGE`	The container image reference (e.g. docker.io/library/nginx:latest).

Examples

anchorectl app version asset add container-image-remote registry.example.com/my-service:1.4.0 \
  --app my-service --version 1.4.0 --asset api-image --wait

Flags

Flag	Type	Environment variable	Default	Required	Description
`--app`	string	`ANCHORECTL_APP`	`""`	Yes	The app name or ID.
`--asset`	string	`ANCHORECTL_ASSET`	`""`	Yes	The name for the new asset.
`--version`	string	`ANCHORECTL_VERSION`	`""`	Yes	The version name or UUID.
`-a`, `--annotations`	string	`ANCHORECTL_ANNOTATIONS`	`""`	No	Annotations as comma-separated key=value pairs.
`--dockerfile`	string	`ANCHORECTL_DOCKERFILE`	`""`	No	Path to the Dockerfile used to build the image.
`-o`, `--output`	string	`ANCHORECTL_FORMAT`	`text`	No	The format to show the results. Allowable values: `text`, `json`, `json-raw`, `id`. See Output Formats.
`-t`, `--type`	string	`ANCHORECTL_TYPE`	`container`	No	The asset type.
`-w`, `--wait`	bool	`ANCHORECTL_WAIT`	`false`	No	Wait for the job to complete before returning.

app version asset add filesystem

Add a filesystem directory as an asset. Analyzes the directory locally using Syft, generates an SBOM, and uploads it to Enterprise.

anchorectl app version asset add filesystem DIRECTORY [flags]

Arguments

Argument	Description
`DIRECTORY`	The path to the directory to analyze (e.g. /mnt/unpacked-vm, ./myapp).

Flags

Flag	Type	Environment variable	Default	Required	Description
`--app`	string	`ANCHORECTL_APP`	`""`	Yes	The app name or ID.
`--asset`	string	`ANCHORECTL_ASSET`	`""`	Yes	The name for the new asset.
`--version`	string	`ANCHORECTL_VERSION`	`""`	Yes	The version name or UUID.
`-a`, `--annotations`	string	`ANCHORECTL_ANNOTATIONS`	`""`	No	Annotations as comma-separated key=value pairs.
`--author`	string	`ANCHORECTL_AUTHOR`	`unknown`	No	SBOM document author (e.g. “Name `<email>`”).
`-o`, `--output`	string	`ANCHORECTL_FORMAT`	`text`	No	The format to show the results. Allowable values: `text`, `json`, `json-raw`, `id`. See Output Formats.
`--supplier`	string	`ANCHORECTL_SUPPLIER`	`unknown`	No	SBOM document supplier name.
`-t`, `--type`	string	`ANCHORECTL_TYPE`	`filesystem`	No	The asset type.
`-w`, `--wait`	bool	`ANCHORECTL_WAIT`	`false`	No	Wait for the job to complete before returning.

app version asset add sbom

Upload an SBOM file as an asset to an app version. Creates a job to import and process the SBOM.

anchorectl app version asset add sbom SBOM_FILE [flags]

Arguments

Argument	Description
`SBOM_FILE`	Path to the SBOM file.

Flags

Flag	Type	Environment variable	Default	Required	Description
`--app`	string	`ANCHORECTL_APP`	`""`	Yes	The app name or ID.
`--asset`	string	`ANCHORECTL_ASSET`	`""`	Yes	The name for the new asset.
`--version`	string	`ANCHORECTL_VERSION`	`""`	Yes	The version name or UUID.
`-a`, `--annotations`	string	`ANCHORECTL_ANNOTATIONS`	`""`	No	Annotations as comma-separated key=value pairs.
`-o`, `--output`	string	`ANCHORECTL_FORMAT`	`text`	No	The format to show the results. Allowable values: `text`, `json`, `json-raw`, `id`. See Output Formats.
`-t`, `--type`	string	`ANCHORECTL_TYPE`	`unknown`	No	The asset type.
`-w`, `--wait`	bool	`ANCHORECTL_WAIT`	`false`	No	Wait for the job to complete before returning.

app version asset delete

Delete an asset from an app version.

anchorectl app version asset delete ASSET [flags]

Arguments

Argument	Description
`ASSET`	The asset name or UUID.

Flags

Flag	Type	Environment variable	Default	Required	Description
`--app`	string	`ANCHORECTL_APP`	`""`	Yes	The app name or ID.
`--version`	string	`ANCHORECTL_VERSION`	`""`	Yes	The version name or UUID.
`-o`, `--output`	string	`ANCHORECTL_FORMAT`	`text`	No	The format to show the results. Allowable values: `text`, `json`, `json-raw`, `id`. See Output Formats.

app version asset get

Get an asset by ID for an app version.

anchorectl app version asset get ASSET [flags]

Arguments

Argument	Description
`ASSET`	The asset name or UUID.

Flags

Flag	Type	Environment variable	Default	Required	Description
`--app`	string	`ANCHORECTL_APP`	`""`	Yes	The app name or ID.
`--version`	string	`ANCHORECTL_VERSION`	`""`	Yes	The version name or UUID.
`-o`, `--output`	string	`ANCHORECTL_FORMAT`	`text`	No	The format to show the results. Allowable values: `text`, `json`, `json-raw`, `id`. See Output Formats.

app version asset list

List assets for an app version.

anchorectl app version asset list VERSION [flags]

Arguments

Argument	Description
`VERSION`	The version name or UUID.

Flags

Flag	Type	Environment variable	Default	Required	Description
`--app`	string	`ANCHORECTL_APP`	`""`	Yes	The app name or ID.
`--name`	string	`ANCHORECTL_NAME`	`""`	No	Filter by asset name.
`-o`, `--output`	string	`ANCHORECTL_FORMAT`	`text`	No	The format to show the results. Allowable values: `text`, `json`, `json-raw`, `id`. See Output Formats.

app version asset sbom

App version asset SBOM operations.

anchorectl app version asset sbom [command]

Subcommands

app version asset sbom get — Get the SBOM for an asset in an app version

app version asset sbom get

Get the SBOM for an asset in an app version.

anchorectl app version asset sbom get ASSET [flags]

Arguments

Argument	Description
`ASSET`	The asset name or UUID.

Flags

Flag	Type	Environment variable	Default	Required	Description
`--app`	string	`ANCHORECTL_APP`	`""`	Yes	The app name or ID.
`--version`	string	`ANCHORECTL_VERSION`	`""`	Yes	The version name or UUID.
`-f`, `--file`	string	`ANCHORECTL_FILE`	`""`	No	Write SBOM to file instead of stdout.

app version asset update

Update an asset for an app version.

anchorectl app version asset update ASSET [flags]

Arguments

Argument	Description
`ASSET`	The asset name or UUID.

Flags

Flag	Type	Environment variable	Default	Required	Description
`--app`	string	`ANCHORECTL_APP`	`""`	Yes	The app name or ID.
`--version`	string	`ANCHORECTL_VERSION`	`""`	Yes	The version name or UUID.
`--annotations`	string	`ANCHORECTL_ANNOTATIONS`	`""`	No	Annotations as comma-separated key=value pairs (merge with existing, set value to empty to remove).
`--name`	string	`ANCHORECTL_NAME`	`""`	No	The new name for the asset.
`-o`, `--output`	string	`ANCHORECTL_FORMAT`	`text`	No	The format to show the results. Allowable values: `text`, `json`, `json-raw`, `id`. See Output Formats.
`--type`	string	`ANCHORECTL_TYPE`	`""`	No	The asset type.

app version delete

Delete an app version by name or ID.

anchorectl app version delete VERSION [flags]

Aliases: del

Arguments

Argument	Description
`VERSION`	The version name or UUID.

Flags

Flag	Type	Environment variable	Default	Required	Description
`--app`	string	`ANCHORECTL_APP`	`""`	Yes	The app name or ID.
`--force`	bool	`ANCHORECTL_FORCE`	`false`	No	Force delete (removes all associations).

app version export

Export documents for an app version.

anchorectl app version export [command]

Subcommands

app version export packages — Export package data for an app version. Creates an export job, waits for completion, and outputs the result.
app version export policy-compliance — Export policy compliance findings for an app version. Creates an export job, waits for completion, and outputs the result.
app version export sbom-cyclonedx-1 — Export a combined CycloneDX 1.x JSON SBOM for an app version. Creates an export job, waits for completion, and outputs the result.
app version export sbom-spdx-2 — Export a combined SPDX 2.x JSON SBOM for an app version. Creates an export job, waits for completion, and outputs the result.
app version export vdr — Export a CycloneDX VDR (Vulnerability Disclosure Report) for an app version. Creates an export job, waits for completion, and outputs the result.
app version export vex — Export VEX (Vulnerability Exploitability eXchange) annotations for an app version. Creates an export job, waits for completion, and outputs the result.
app version export vulnerabilities — Export vulnerability data for an app version. Creates an export job, waits for completion, and outputs the result.

app version export packages

Export package data for an app version. Creates an export job, waits for completion, and outputs the result.

anchorectl app version export packages VERSION [flags]

Arguments

Argument	Description
`VERSION`	The version name or UUID.

Flags

Flag	Type	Environment variable	Default	Required	Description
`--app`	string	`ANCHORECTL_APP`	`""`	Yes	The app name or ID.
`-f`, `--file`	string	`ANCHORECTL_FILE`	`""`	No	Write output to file instead of stdout.
`--format`	string	`ANCHORECTL_FORMAT`	`csv`	No	The export format. Allowable values: `csv`.

app version export policy-compliance

Export policy compliance findings for an app version. Creates an export job, waits for completion, and outputs the result.

anchorectl app version export policy-compliance VERSION [flags]

Arguments

Argument	Description
`VERSION`	The version name or UUID.

Flags

Flag	Type	Environment variable	Default	Required	Description
`--app`	string	`ANCHORECTL_APP`	`""`	Yes	The app name or ID.
`-f`, `--file`	string	`ANCHORECTL_FILE`	`""`	No	Write output to file instead of stdout.
`--format`	string	`ANCHORECTL_FORMAT`	`csv`	No	The export format. Allowable values: `csv`.

app version export sbom-cyclonedx-1

Export a combined CycloneDX 1.x JSON SBOM for an app version. Creates an export job, waits for completion, and outputs the result.

anchorectl app version export sbom-cyclonedx-1 VERSION [flags]

Arguments

Argument	Description
`VERSION`	The version name or UUID.

Flags

Flag	Type	Environment variable	Default	Required	Description
`--app`	string	`ANCHORECTL_APP`	`""`	Yes	The app name or ID.
`-f`, `--file`	string	`ANCHORECTL_FILE`	`""`	No	Write output to file instead of stdout.

app version export sbom-spdx-2

Export a combined SPDX 2.x JSON SBOM for an app version. Creates an export job, waits for completion, and outputs the result.

anchorectl app version export sbom-spdx-2 VERSION [flags]

Arguments

Argument	Description
`VERSION`	The version name or UUID.

Flags

Flag	Type	Environment variable	Default	Required	Description
`--app`	string	`ANCHORECTL_APP`	`""`	Yes	The app name or ID.
`-f`, `--file`	string	`ANCHORECTL_FILE`	`""`	No	Write output to file instead of stdout.

app version export vdr

Export a CycloneDX VDR (Vulnerability Disclosure Report) for an app version. Creates an export job, waits for completion, and outputs the result.

anchorectl app version export vdr VERSION [flags]

Arguments

Argument	Description
`VERSION`	The version name or UUID.

Flags

Flag	Type	Environment variable	Default	Required	Description
`--app`	string	`ANCHORECTL_APP`	`""`	Yes	The app name or ID.
`-f`, `--file`	string	`ANCHORECTL_FILE`	`""`	No	Write output to file instead of stdout.
`--format`	string	`ANCHORECTL_FORMAT`	`cyclonedx-json`	No	The export format. Allowable values: `cyclonedx-json`.

app version export vex

Export VEX (Vulnerability Exploitability eXchange) annotations for an app version. Creates an export job, waits for completion, and outputs the result.

anchorectl app version export vex VERSION [flags]

Arguments

Argument	Description
`VERSION`	The version name or UUID.

Flags

Flag	Type	Environment variable	Default	Required	Description
`--app`	string	`ANCHORECTL_APP`	`""`	Yes	The app name or ID.
`-f`, `--file`	string	`ANCHORECTL_FILE`	`""`	No	Write output to file instead of stdout.
`--format`	string	`ANCHORECTL_FORMAT`	`cyclonedx-json`	No	The export format. Allowable values: `cyclonedx-json`.

app version export vulnerabilities

Export vulnerability data for an app version. Creates an export job, waits for completion, and outputs the result.

anchorectl app version export vulnerabilities VERSION [flags]

Arguments

Argument	Description
`VERSION`	The version name or UUID.

Flags

Flag	Type	Environment variable	Default	Required	Description
`--app`	string	`ANCHORECTL_APP`	`""`	Yes	The app name or ID.
`-f`, `--file`	string	`ANCHORECTL_FILE`	`""`	No	Write output to file instead of stdout.
`--format`	string	`ANCHORECTL_FORMAT`	`csv`	No	The export format. Allowable values: `csv`.

app version get

Get an app version by name or ID.

anchorectl app version get VERSION [flags]

Arguments

Argument	Description
`VERSION`	The version name or UUID.

Flags

Flag	Type	Environment variable	Default	Required	Description
`--app`	string	`ANCHORECTL_APP`	`""`	Yes	The app name or ID.
`-o`, `--output`	string	`ANCHORECTL_FORMAT`	`text`	No	The format to show the results. Allowable values: `text`, `json`, `json-raw`, `id`. See Output Formats.

app version list

List all versions of an app.

anchorectl app version list APP [flags]

Arguments

Argument	Description
`APP`	The app name or ID.

Flags

Flag	Type	Environment variable	Default	Required	Description
`--name`	string	`ANCHORECTL_NAME`	`""`	No	Filter by exact version name.
`-o`, `--output`	string	`ANCHORECTL_FORMAT`	`text`	No	The format to show the results. Allowable values: `text`, `json`, `json-raw`, `id`. See Output Formats.

app version package

App version package operations.

anchorectl app version package [command]

Subcommands

app version package list — List packages for an app version

app version package list

List packages for an app version.

anchorectl app version package list VERSION [flags]

Arguments

Argument	Description
`VERSION`	The version name or UUID.

Flags

Flag	Type	Environment variable	Default	Required	Description
`--app`	string	`ANCHORECTL_APP`	`""`	Yes	The app name or ID.
`-o`, `--output`	string	`ANCHORECTL_FORMAT`	`text`	No	The format to show the results. Allowable values: `text`, `json`, `json-raw`, `id`. See Output Formats.

app version policy

App version policy operations.

anchorectl app version policy [command]

Subcommands

app version policy findings — App version policy findings operations
app version policy status — App version policy status operations

app version policy findings

App version policy findings operations.

anchorectl app version policy findings [command]

Subcommands

app version policy findings list — List policy findings for an app version

app version policy findings list

List policy findings for an app version.

anchorectl app version policy findings list VERSION [flags]

Arguments

Argument	Description
`VERSION`	The version name or UUID.

Flags

Flag	Type	Environment variable	Default	Required	Description
`--app`	string	`ANCHORECTL_APP`	`""`	Yes	The app name or ID.
`-o`, `--output`	string	`ANCHORECTL_FORMAT`	`text`	No	The format to show the results. Allowable values: `text`, `json`, `json-raw`, `id`. See Output Formats.

app version policy status

App version policy status operations.

anchorectl app version policy status [command]

Subcommands

app version policy status get — Get policy evaluation status for an app version

app version policy status get

Get policy evaluation status for an app version.

anchorectl app version policy status get VERSION [flags]

Arguments

Argument	Description
`VERSION`	The version name or UUID.

Flags

Flag	Type	Environment variable	Default	Required	Description
`--app`	string	`ANCHORECTL_APP`	`""`	Yes	The app name or ID.
`-f`, `--fail-based-on-results`	bool	`ANCHORECTL_FAIL_BASED_ON_RESULTS`	`false`	No	Set the return code to 1 if the policy evaluation result shows as `fail`.
`-o`, `--output`	string	`ANCHORECTL_FORMAT`	`text`	No	The format to show the results. Allowable values: `text`, `json`, `json-raw`, `id`. See Output Formats.

app version update

Update an existing app version.

anchorectl app version update VERSION [flags]

Arguments

Argument	Description
`VERSION`	The version name or UUID.

Flags

Flag	Type	Environment variable	Default	Required	Description
`--app`	string	`ANCHORECTL_APP`	`""`	Yes	The app name or ID.
`--description`	string	`ANCHORECTL_DESCRIPTION`	`""`	No	The new description.
`--name`	string	`ANCHORECTL_NAME`	`""`	No	The new name for the version.
`-o`, `--output`	string	`ANCHORECTL_FORMAT`	`text`	No	The format to show the results. Allowable values: `text`, `json`, `json-raw`, `id`. See Output Formats.
`--previous-version`	string	`ANCHORECTL_PREVIOUS_VERSION`	`""`	No	The previous version name or UUID.
`--release-date`	string	`ANCHORECTL_RELEASE_DATE`	`""`	No	Date of release of this version (e.g. 2026-01-15).
`--status`	string	`ANCHORECTL_STATUS`	`""`	No	The status of the app version (in_progress, released, eol).

app version vex

VEX annotation operations for an app version.

anchorectl app version vex [command]

Subcommands

app version vex add — Add a VEX annotation to an app version
app version vex delete — Delete a VEX annotation
app version vex get — Get a VEX annotation by ID
app version vex list — List VEX annotations for an app
app version vex update — Update a VEX annotation

app version vex add

Add a VEX annotation to an app version.

anchorectl app version vex add VERSION [flags]

Arguments

Argument	Description
`VERSION`	The version name or UUID.

Flags

Flag	Type	Environment variable	Default	Required	Description
`--app`	string	`ANCHORECTL_APP`	`""`	Yes	The app name or ID.
`--pkg-name`	string	`ANCHORECTL_PKG_NAME`	`""`	Yes	The package name.
`--pkg-type`	string	`ANCHORECTL_PKG_TYPE`	`""`	Yes	The package type (e.g. java-archive, npm, python).
`--pkg-version`	string	`ANCHORECTL_PKG_VERSION`	`""`	Yes	The package version.
`--status`	string	`ANCHORECTL_STATUS`	`""`	Yes	The VEX status. Allowable values: `not_affected`, `affected`, `fixed`, `under_investigation`.
`--vuln-id`	string	`ANCHORECTL_VULN_ID`	`""`	Yes	The vulnerability ID (e.g. CVE-2021-44228).
`--action-statement`	string	`ANCHORECTL_ACTION_STATEMENT`	`""`	No	Action statement for remediation.
`--additional-details`	string	`ANCHORECTL_ADDITIONAL_DETAILS`	`""`	No	Free-form additional details.
`--impact-statement`	string	`ANCHORECTL_IMPACT_STATEMENT`	`""`	No	Impact statement for the vulnerability.
`--justification`	string	`ANCHORECTL_JUSTIFICATION`	`""`	No	Justification for not_affected status. Allowable values: `component_not_present`, `vulnerable_code_not_present`, `vulnerable_code_not_in_execute_path`, `vulnerable_code_cannot_be_controlled_by_adversary`, `inline_mitigations_already_exist`.
`-o`, `--output`	string	`ANCHORECTL_FORMAT`	`text`	No	The format to show the results. Allowable values: `text`, `json`, `json-raw`, `id`. See Output Formats.
`--status-notes`	string	`ANCHORECTL_STATUS_NOTES`	`""`	No	Additional notes about the status.

app version vex delete

Delete a VEX annotation.

anchorectl app version vex delete VULN_ANNOTATION_ID [flags]

Aliases: del

Arguments

Argument	Description
`VULN_ANNOTATION_ID`	The VEX annotation UUID.

Flags

Flag	Type	Environment variable	Default	Required	Description
`--app`	string	`ANCHORECTL_APP`	`""`	Yes	The app name or ID.
`--version`	string	`ANCHORECTL_VERSION`	`""`	Yes	The version name or UUID.
`-o`, `--output`	string	`ANCHORECTL_FORMAT`	`text`	No	The format to show the results. Allowable values: `text`, `json`, `json-raw`, `id`. See Output Formats.

app version vex get

Get a VEX annotation by ID.

anchorectl app version vex get VULN_ANNOTATION_ID [flags]

Arguments

Argument	Description
`VULN_ANNOTATION_ID`	The VEX annotation UUID.

Flags

Flag	Type	Environment variable	Default	Required	Description
`--app`	string	`ANCHORECTL_APP`	`""`	Yes	The app name or ID.
`--version`	string	`ANCHORECTL_VERSION`	`""`	Yes	The version name or UUID.
`-o`, `--output`	string	`ANCHORECTL_FORMAT`	`text`	No	The format to show the results. Allowable values: `text`, `json`, `json-raw`, `id`. See Output Formats.

app version vex list

List VEX annotations for an app.

anchorectl app version vex list VERSION [flags]

Arguments

Argument	Description
`VERSION`	The version name or UUID.

Flags

Flag	Type	Environment variable	Default	Required	Description
`--app`	string	`ANCHORECTL_APP`	`""`	Yes	The app name or ID.
`-o`, `--output`	string	`ANCHORECTL_FORMAT`	`text`	No	The format to show the results. Allowable values: `text`, `json`, `json-raw`, `id`. See Output Formats.

app version vex update

Update a VEX annotation.

anchorectl app version vex update VULN_ANNOTATION_ID [flags]

Arguments

Argument	Description
`VULN_ANNOTATION_ID`	The VEX annotation UUID.

Flags

Flag	Type	Environment variable	Default	Required	Description
`--app`	string	`ANCHORECTL_APP`	`""`	Yes	The app name or ID.
`--version`	string	`ANCHORECTL_VERSION`	`""`	Yes	The version name or UUID.
`--action-statement`	string	`ANCHORECTL_ACTION_STATEMENT`	`""`	No	Action statement for remediation.
`--additional-details`	string	`ANCHORECTL_ADDITIONAL_DETAILS`	`""`	No	Free-form additional details.
`--impact-statement`	string	`ANCHORECTL_IMPACT_STATEMENT`	`""`	No	Impact statement for the vulnerability.
`--justification`	string	`ANCHORECTL_JUSTIFICATION`	`""`	No	Justification for not_affected status. Allowable values: `component_not_present`, `vulnerable_code_not_present`, `vulnerable_code_not_in_execute_path`, `vulnerable_code_cannot_be_controlled_by_adversary`, `inline_mitigations_already_exist`.
`-o`, `--output`	string	`ANCHORECTL_FORMAT`	`text`	No	The format to show the results. Allowable values: `text`, `json`, `json-raw`, `id`. See Output Formats.
`--status`	string	`ANCHORECTL_STATUS`	`""`	No	The VEX status. Allowable values: `not_affected`, `affected`, `fixed`, `under_investigation`.
`--status-notes`	string	`ANCHORECTL_STATUS_NOTES`	`""`	No	Additional notes about the status.

app version vuln

App version vulnerability operations.

anchorectl app version vuln [command]

Subcommands

app version vuln list — List vulnerabilities for an app version

app version vuln list

List vulnerabilities for an app version.

anchorectl app version vuln list VERSION [flags]

Arguments

Argument	Description
`VERSION`	The version name or UUID.

Flags

Flag	Type	Environment variable	Default	Required	Description
`--app`	string	`ANCHORECTL_APP`	`""`	Yes	The app name or ID.
`-o`, `--output`	string	`ANCHORECTL_FORMAT`	`text`	No	The format to show the results. Allowable values: `text`, `json`, `json-raw`. See Output Formats.

Last modified September 22, 2026