Error Codes

Reference of Anchore Enterprise error codes with their message, HTTP status, and remediation steps.

Anchore Enterprise returns a structured error code with most API error responses. Each code has the form XX###, where the two-letter prefix identifies the domain that raised the error (for example, AP for Applications) and the number identifies the specific condition. A code ending in 000 is the general, catch-all error for that domain.

Error responses also include an anchore_request_id. When contacting Anchore support, include both the error code and the request id so the originating request can be located in the service logs.

The codes below are grouped by prefix and listed in ascending order within each group.

AP — Applications

Code	Message	HTTP	Remediation
`AP000`	General Application Error	500	Inspect server logs around the request_id for the underlying error. If the failure is reproducible, capture the request and contact support.
`AP501`	Application Not Found	404	Verify the application id (UUID) is correct. List applications under the same account to confirm the application exists. Confirm the account header on the request matches the account that owns the application.
`AP502`	Application Has Versions	409	Re-issue the delete with the `force` flag to cascade-delete the application’s versions and assets. Or delete each version under the application before deleting the application itself.
`AP503`	Policy Not Found	404	Verify the policy_id refers to an existing policy in the catalog service. Send null for policy_id to clear the policy and inherit the account default. Omit the policy_id field on update to leave the existing policy unchanged.
`AP504`	Policy Fetch Failed	502	Retry the request — the catalog service may be transiently unavailable. Verify the catalog service is healthy. Inspect server logs around the request_id for the upstream error detail.
`AP505`	Application Name Conflict	409	Pick a different name that’s unique within the account. Or update the existing application instead of creating a new one.
`AP506`	Application Field Validation Failed	422	Inspect the `detail` array for per-field validation messages. Each entry’s `loc` identifies the offending field; `msg` describes the problem. Resend the request with valid values.

AS — Assets & SBOMs

Code	Message	HTTP	Remediation
`AS000`	General Asset Error	500	Inspect server logs around the request_id for the underlying error. If the failure is reproducible, capture the request and contact support.
`AS501`	Asset Not Found	404	Verify the asset id (UUID) is correct under the given application id and version id. List assets under the version to confirm the asset exists. If the asset was just created via SBOM upload, wait for the import job to complete first.
`AS502`	Asset SBOM Not Found	404	Confirm the asset has an associated SBOM artifact in its artifacts list. If the artifact exists but its body is missing, the object-store key has been removed externally — re-upload the SBOM to re-create it.
`AS503`	Asset Name Conflict	409	Pick a different asset name that’s unique within the application version. Or update the existing asset instead of creating a new one.
`AS504`	Asset Artifact Not Found	404	Re-fetch the asset and confirm its artifacts list is non-empty. If the artifact was deleted out-of-band, re-upload the SBOM to re-create it.
`AS505`	Invalid Annotations	422	Send annotations as a flat object of string keys and string values (use null as a value to delete a key on update). Cap each annotation key at 150 characters and each value at 1000 characters. Cap total annotations on an asset at 10 entries. Inspect the response message for the specific limit that was breached.
`AS510`	SBOM Parse Failed	400	Inspect the AssetAddFailed event’s error_reason for the parser’s specific message. Validate the SBOM with the format’s reference tooling before re-uploading.
`AS511`	SPDX Parse Failed	400	Verify required SPDX fields are present (spdxVersion, SPDXID, documentNamespace, creationInfo). Validate the document with the SPDX online validator or `pyspdxtools`.
`AS512`	CycloneDX Parse Failed	400	Validate the document against the CycloneDX schema for its specVersion. Confirm the document is well-formed JSON/XML before re-uploading.
`AS513`	Unsupported CycloneDX Spec Version	400	Re-export the SBOM targeting one of the supported specVersion values listed in the error_reason.
`AS514`	Invalid CycloneDX XML Structure	400	Verify the document parses as XML and uses the http://cyclonedx.org/schema/bom/<version> namespace on the <bom> root.
`AS515`	Unrecognised SBOM Format	400	Verify the file is a non-empty Syft JSON, SPDX JSON or tag-value, or CycloneDX JSON or XML document. Inspect the AssetAddFailed event’s error_reason for the specific marker that was missing.
`AS516`	Syft Parse Failed	400	Re-export the SBOM with a current Syft or anchorectl release (`syft <target> -o syft-json` / `anchorectl image sbom`). Verify `schema.version` matches the format `MAJOR.MINOR.PATCH` (e.g. `16.0.39`).

AU — Authentication

Code	Message	HTTP	Remediation
`AU000`	General Authentication Error	401	Inspect the response message for the underlying detail. Confirm the request includes a valid Bearer token. If the failure is reproducible with valid credentials, capture the request and contact support.
`AU001`	Missing Authorization Header	401	Include an Authorization header on the request using the Bearer scheme. If using a client SDK, confirm credentials are configured before issuing the call.
`AU002`	Invalid Authorization Scheme	401	Use the Bearer scheme on the Authorization header (“Bearer <token>”). Other schemes (Basic, Digest, etc.) are not accepted on internal endpoints.
`AU003`	Authentication Not Configured	401	Wait for the service to finish bootstrapping and retry. Verify the service has a valid keys configuration (signing key or shared secret). Check service logs for token manager initialization errors.
`AU004`	Invalid or Expired Token	401	Obtain a new token and retry the request. Confirm the client and server clocks are reasonably in sync; large drift can cause valid tokens to appear expired. If using a long-lived token, confirm it has not been revoked.

AV — Application Versions

Code	Message	HTTP	Remediation
`AV000`	General Application Version Error	500	Inspect server logs around the request_id for the underlying error. If the failure is reproducible, capture the request and contact support.
`AV501`	Application Version Not Found	404	Verify the version id (UUID) is correct. List versions under the parent application to confirm the version exists. Confirm both the application id and the version id belong to the account on the request header.
`AV502`	Application Version Has Assets	409	Re-issue the delete with the `force` flag to cascade-delete the version’s assets. Or delete each asset under the version before deleting the version itself.
`AV503`	Application Version Name Conflict	409	Pick a different version name that’s unique within the parent application. Or update the existing version instead of creating a new one.
`AV504`	Invalid Previous Version Reference	422	Confirm previous_version_id is the UUID of an existing version under the same application. Send null (or omit the field) when there is no previous version.
`AV505`	Application Version Referenced	409	Update the referencing version to clear or change its previous_version_id before deleting this one. Or use the `force` flag on the delete — the server will null out the inbound references.
`AV506`	Application Version Cannot Reference Itself	422	Set previous_version_id to the UUID of a different version under the same application. Send null (or omit the field) when there is no previous version.

AX — Image Input

Code	Message	HTTP	Remediation
`AX500`	Image reference must be a non-empty string	400	—
`AX501`	Image reference has no pullable form	400	—
`AX502`	Cannot handle image input string	400	—

CF — Configuration

Code	Message	HTTP	Remediation
`CF000`	General Configuration Error	500	Inspect server logs around the request_id for the underlying error. If reproducible, capture the request and contact support.
`CF301`	Configuration File Not Found	500	Verify the configuration file path matches the deployment’s filesystem layout. Ensure the file exists and is readable by the service process. Check the deployment’s volume mounts and environment overrides for the path.
`CF302`	Configuration Validation Failed	500	Check the configuration file against the expected schema. Review the validation errors in the response and the service logs for the offending fields. Fix the offending values and restart the service.
`CF303`	Required Environment Variable Not Found	500	Set the required environment variable before starting the service. Confirm the service’s environment file or container env list includes the variable.
`CF501`	Configuration API Disabled	403	Enable the API-driven configuration feature flag in the deployment’s config file. Restart the service for the flag change to take effect.
`CF502`	Configuration Key Not Found	404	Verify the configuration key name is correct. Some keys are private to the service and not exposed via the API; consult the configuration documentation for the exposed surface.
`CF503`	Configuration Key Not Editable	403	Confirm the key is documented as editable; immutable / system-internal keys must be set in the config file at deploy time. If the key was recently demoted to read-only, capture the request and contact support.
`CF504`	Configuration Key Blocked By Config File	409	Edit the value in the deployment’s config file and restart the service. Or remove the key from the config file so the API can manage it (the service will use the default until set via API).
`CF505`	Configuration Schema Validation Failed	400	Inspect the response message for the field and constraint that failed. Submit a value matching the field’s documented type and bounds.
`CF506`	Configuration Schema Inconsistency	500	Verify that every API-editable key produces a leaf value when a default RootConfig is flattened. Check for recent changes to Optional fields or discriminated unions in the config models.
`CF507`	Configuration Key Mismatch	400	Set the body’s `key` field to the same value as the URL path segment. Or change the URL path segment to match the key already in the body.

DB — Database

Code	Message	HTTP	Remediation
`DB000`	General Database Error	500	Inspect server logs around the request_id for the underlying SQL error. If the failure is reproducible, capture the request and contact support.
`DB201`	Database Connection Failed	500	Verify the database connection string. Ensure the database server is running and accessible. Check network policies / firewalls between the service pod and the database.
`DB202`	Database TLS Error	500	Verify TLS certificates are correctly configured. Ensure the database supports the required TLS version. If using a custom CA bundle, confirm the bundle is mounted on the service pod.
`DB203`	EMS Not Enabled	500	Upgrade the database to Postgres 16 or greater. Move the deployment to non-FIPS-enabled hosts. Contact the Customer Success Team for assistance.
`DB204`	Database Insert Conflict	409	Inspect the response message for the conflicting field. Resubmit with a value that doesn’t collide with the existing row, or update the existing row instead.
`DB205`	Unhandled Database Integrity Error	500	Inspect server logs around the request_id for the underlying constraint name. If reproducible from a well-formed request, capture the request body and report a bug — this should be a 4xx with a typed code.

JB — Jobs

Code	Message	HTTP	Remediation
`JB000`	General Job Error	500	Inspect server logs around the request_id for the underlying error. If the failure is reproducible, capture the request and contact support.
`JB501`	Job Not Found	404	Verify the job id (UUID) is correct. List jobs under the parent application to confirm the job exists. Confirm the account header matches the account that submitted the job. If the job is a workflow step (not the workflow root), it is intentionally hidden — fetch the parent workflow id instead.
`JB502`	Job Not Found For Type	404	Confirm the job id matches a job whose type belongs to this endpoint’s category (e.g. SBOM-export endpoints only resolve SBOM-export jobs). Use the generic job lookup endpoint to inspect the job’s actual type.
`JB506`	Invalid Annotations JSON	422	Send the annotations form field as a JSON-encoded string of an object. Check for unescaped quotes when embedding JSON in a multipart form field.
`JB507`	Invalid Annotations Format	422	Send annotations as a flat object — no nested objects, no arrays, no numeric / boolean / null values. Cast all values to strings client-side before encoding.
`JB508`	App Version Not Found	404	Verify the app_version_id on the request body matches an existing version under the parent app. List versions under the application to find the correct version id.
`JB509`	Asset Not Found	404	Verify the asset_id on the request body matches an existing asset under the version. List assets under the version to find the correct asset id.
`JB513`	Cannot Cancel Workflow Step	409	Cancel the parent workflow job (its workflow_id is the same as its job_id) instead of the step. The response message includes the parent workflow id you should target.
`JB515`	Missing Username For Owner Filter	400	Send the x-anchore-username header on requests that use owned_by_me=true. Or drop the owned_by_me parameter to list jobs across all users in the account.
`JB516`	Export File Not Found	404	Re-submit the export job — the previous result has been garbage-collected or the disk it was on is gone. Confirm the job status is complete before requesting the download.

JF — Job Framework

Code	Message	HTTP	Remediation
`JF000`	General Job Framework Error	500	Inspect server logs around the request_id for the underlying error. If the failure is reproducible, capture the request and contact support.
`JF501`	Framework Job Not Found	404	Verify the job id is correct. List jobs through the job-framework admin surface to confirm the job exists.
`JF502`	Framework Job Logs Not Found	404	Verify the job id is correct. Logs may have been garbage-collected; for long-running diagnostics, capture logs while the job is still active.
`JF503`	Framework Job Not Found For Cancel	404	Verify the job id is correct. If the job has already terminated, no cancel is needed — re-fetch its status.
`JF506`	Job Type Not Registered	500	Confirm the service is fully started — handler registration happens during bootstrap. If the job type is new, verify the handler module is imported on service startup.
`JF507`	Job Handler Exception	500	Inspect the job’s error_reason field for the handler’s specific exception. Re-submit the job after addressing the underlying cause (bad input, missing data, transient upstream failure).
`JF508`	Job Timeout Exceeded	500	Re-submit the job — repeated timeouts on the same input may indicate an unusually large payload or a degraded backing service. If the job consistently times out, contact support to evaluate raising the per-type timeout for this deployment.
`JF509`	Job Memory Limit Exceeded	500	Re-submit with a smaller input if the size of the input scales with memory. Contact your system administrator if the failure persists at typical input sizes.
`JF510`	Job CPU Limit Exceeded	500	Re-submit the job — the limit may have been hit due to noisy-neighbour scheduling on the worker pod. If the failure repeats, contact your system administrator to evaluate raising worker resources.
`JF511`	Worker Died	500	Check worker logs for crash details. Ensure sufficient resources for workers. Re-submit the job once the worker pool has stabilised.
`JF512`	Workflow Type Not Registered	500	Confirm the service is fully started — workflow registration happens during bootstrap. If the workflow type is new, verify its module is imported on service startup.
`JF513`	Workflow Step Not Found	500	Inspect the workflow record’s step list to confirm the step was registered. If reproducible, capture the workflow id and contact support.
`JF514`	Job Retries Exhausted	500	Inspect the job’s error_reason for the failure that triggered every retry. Address the underlying cause and re-submit the job from scratch.

PG — Pagination

Code	Message	HTTP	Remediation
`PG000`	General Pagination Error	500	Inspect the response message for the underlying detail. If reproducible, capture the request and contact support.
`PG501`	Invalid Pagination Cursor	400	Drop the cursor / token parameter to fetch the first page from scratch. When paging, only ever send back the next_cursor / next_token value verbatim — don’t construct or modify cursors client-side. If the cursor stops decoding mid-walk, it likely belongs to a different list query (filters or sort changed); restart pagination with the new criteria.

PK — Packages

Code	Message	HTTP	Remediation
`PK000`	General Package Error	500	Inspect server logs around the request_id for the underlying error. If the failure is reproducible, capture the request and contact support.
`PK501`	Package Not Found	404	Verify the package id is correct. List packages under the version to confirm the package exists — packages are derived from the version’s SBOM, so absence usually means the package wasn’t in the SBOM.
`PK502`	Invalid Package Filter	422	Inspect the response message — it lists the operators allowed for the field. Switch to one of the listed operators, or pick a different field.
`PK503`	Conflicting Package Type	422	Remove the type parameter and let it be inferred from namespace. Ensure type matches the first segment of namespace.
`PK504`	Advisory Has Multiple Related CVEs	400	Query each related CVE listed in the response message directly. A singleton advisory (exactly one related CVE) or a bare CVE id is accepted.

PO — Policy

Code	Message	HTTP	Remediation
`PO000`	General Policy Error	500	Inspect server logs around the request_id for the underlying error. If the failure is reproducible, capture the request and contact support.
`PO501`	Policy Not Found	404	Verify the policy_id is correct. Confirm the policy exists in the catalog service for this account.
`PO502`	Policy Fetch Failed	502	Verify the catalog service is running and healthy. If the application has an active_policy_id, verify the policy exists. Retry the request — the upstream catalog service may be transiently unavailable.
`PO503`	No Active Policy	404	Update the application to set an active_policy_id pointing to a valid policy. Or configure an account-level default policy in the policy service so applications without an explicit policy fall back to it.
`PO504`	Policy Evaluation Stale	409	Trigger a policy re-evaluation for this app version. Retry the request after the evaluation job completes.

SE — Search & Filtering

Code	Message	HTTP	Remediation
`SE000`	General Search Error	500	Inspect the response message for the underlying detail. If the failure is reproducible, capture the request and contact support.
`SE501`	Unknown Filter Field	422	Check the OpenAPI documentation for the search endpoint to see the allowed field values. For asset annotations, use the annotations.<key> dot-notation form. Remove or correct the offending entry in the filters or sort array.
`SE502`	Unsupported Filter Operator	422	Inspect the response message — it lists the operators allowed for the field. Switch to one of the listed operators, or pick a different field.
`SE503`	Invalid Filter Value Shape	422	Inspect the response message for the expected shape. For the in operator, pass an array; for scalar comparators, pass a scalar matching the field’s type.
`SE504`	Unsupported Sort Field	422	Inspect the response message — it lists the offending field. Remove the sort entry, or pick a different field that supports ordering.

VS — Vulnerability Scanning

Code	Message	HTTP	Remediation
`VS001`	Grype rejected package input	500	Inspect the package’s purl/cpes for malformed values (URL-encoded delimiters, embedded sha256, etc.). Re-upload a corrected SBOM.

VX — Vulnerability Annotations

Code	Message	HTTP	Remediation
`VX000`	General Vulnerability Annotation Error	500	Inspect server logs around the request_id for the underlying error. If the failure is reproducible, capture the request and contact support.
`VX501`	Vulnerability Annotation Not Found	404	Verify the vulnerability annotation id (UUID) is correct. List annotations under the version to confirm the annotation exists. Confirm both the application id and the version id belong to the account on the request header.
`VX502`	Vulnerability Annotation Conflict	409	Look up the existing annotation by scope/vulnerability_id/package_* and update it instead. Or change one of scope, vulnerability_id, package_name, package_version, or package_type so the new annotation has a unique tuple.

WK — Worker

Code	Message	HTTP	Remediation
`WK000`	General Worker Error	500	Inspect server logs around the request_id for the underlying error. If the failure is reproducible, capture the request and contact support.
`WK501`	Worker Pool Not Found	404	Verify the worker pool name is correct. List worker pools to confirm the pool exists in this deployment.

Last modified August 17, 2026