> ## Documentation Index
> Fetch the complete documentation index at: https://docs.ankra.ai/llms.txt
> Use this file to discover all available pages before exploring further.

# ankra backup

> Backup operations

## ankra backup

Commands for managing the organisation's backup infrastructure.

## ankra backup restore-points

List the organisation's restore points across every cluster

## ankra backup restore-points list

List every restore point the organisation holds, newest first, across
every cluster and stack.

Examples:

```bash theme={null}
ankra backup restore-points list
ankra backup restore-points list --cluster production --status complete
ankra backup restore-points list --stack shop
```

```bash theme={null}
ankra backup restore-points list [flags]
```

**Flags**

| Flag | Default | Description |
| - | - | - |
| `--cluster` | | Only restore points taken from this cluster (name or id) |
| `--cursor` | | Continue from a previous page's cursor |
| `--limit` | `0` | Page size (server default, maximum 200) |
| `-o`, `--output` | | Output format: json or yaml (default: human-readable) |
| `--stack` | | Only restore points taken of this stack |
| `--status` | `[]` | Only restore points in these statuses (creating, complete, failed, expiring, expired, deleted) |
| `--trigger` | `[]` | Only restore points with these triggers (manual, scheduled, clone, migrate, pre\_restore, verification) |
| `--vault` | | Only restore points in this backup vault (name or id) |

## ankra backup vaults

Manage the organisation's backup vaults: S3-compatible object-storage targets that cluster backups are written to. The platform verifies each vault's credentials against its bucket and reports the outcome as the vault's status.

## ankra backup vaults contents

List what a backup vault's bucket actually holds, per restore point.

This reads the object store, not Ankra's rows, so it can disagree with the
platform - which is the point. Use it to confirm that deleting a restore point
removed its objects, and to find objects no restore point accounts for.

Two prefixes are reported per restore point because they differ:

```text theme={null}
declared  the prefix the restore point records, and that a delete sweeps
located   where the objects actually are, written by the backup data plane
```

Volume data lives in a SHARED repository per cluster and namespace. Its bytes
are reported separately and never counted into a single restore point: the
blocks are deduplicated across every backup of that namespace, so no restore
point owns them and deleting the prefix would destroy other restore points'
data.

A vault whose bucket cannot be read fails with an error rather than printing an
empty listing. An unreadable vault and an empty vault are different facts.

```bash theme={null}
ankra backup vaults contents [vault-name|vault-id] [flags]
```

**Flags**

| Flag | Default | Description |
| - | - | - |
| `--objects` | `false` | List every object key the listing read |
| `--orphans-only` | `false` | Print only the objects no restore point accounts for |
| `-o`, `--output` | | Output format: json or yaml (default: human-readable) |
| `--prefix` | | Only read objects under this prefix (narrows a large vault; orphan detection is withheld for a partial read) |
| `--restore-point` | | Report only this restore point (accepts an id prefix) |

## ankra backup vaults create

Create a backup vault: an S3-compatible bucket cluster backups are written to.

The access keys are prompted for interactively when not passed as flags, so
they never have to appear in your shell history. The platform verifies the
keys against the bucket immediately and the command reports the outcome.

Example:

```bash theme={null}
ankra backup vaults create offsite --endpoint https://s3.example.com --bucket cluster-backups
```

```bash theme={null}
ankra backup vaults create <name> [flags]
```

**Flags**

| Flag | Default | Description |
| - | - | - |
| `--access-key-id` | | Access key ID (prompted for when omitted) |
| `--bucket` | | Bucket the backups are written to (required) |
| `--endpoint` | | S3-compatible endpoint URL (required) |
| `--path-style` | `true` | Address the bucket path-style ([https://endpoint/bucket](https://endpoint/bucket)) instead of virtual-hosted-style |
| `--provider` | `other` | Object-storage provider |
| `--region` | | Bucket region (leave empty when the endpoint implies it) |
| `--secret-access-key` | | Secret access key (prompted for hidden when omitted; prefer the prompt so the key stays out of your shell history) |

## ankra backup vaults delete

Delete a backup vault.

By default this removes only Ankra's record of the vault and the access keys
it stored: the bucket, everything in it, and any provider resource Ankra
created for it are left in your cloud account.

`--destroy-provider-resources` also destroys what Ankra created for an
Ankra-provisioned vault - it empties and deletes the bucket, and removes the
UpCloud object storage service or DigitalOcean Spaces key that was minted
for it. Restore points in that bucket are gone for good. It is refused for a
vault that registers a bucket you created yourself.

```bash theme={null}
ankra backup vaults delete [vault-name|vault-id] [flags]
```

**Flags**

| Flag | Default | Description |
| - | - | - |
| `--destroy-provider-resources` | `false` | Also destroy what Ankra created for this vault: empty and delete the bucket (every restore point in it is lost) and remove the provider resource minted for it. Ankra-provisioned vaults only |
| `--yes` | `false` | Skip the confirmation prompt |

## ankra backup vaults get

Describe a backup vault: its endpoint, bucket, verification status, and - when the last credential check failed - the failure excerpt.

```bash theme={null}
ankra backup vaults get [vault-name|vault-id] [flags]
```

**Flags**

| Flag | Default | Description |
| - | - | - |
| `-o`, `--output` | | Output format: json or yaml (default: human-readable) |

## ankra backup vaults list

List the organisation's backup vaults

```bash theme={null}
ankra backup vaults list [flags]
```

**Flags**

| Flag | Default | Description |
| - | - | - |
| `-o`, `--output` | | Output format: json or yaml (default: human-readable) |

## ankra backup vaults provision

Create a backup vault and let Ankra create the bucket for it, using one of
the organisation's provider credentials (Hetzner, UpCloud, DigitalOcean or
Scaleway). Ankra creates the bucket, mints or stores the access keys,
verifies the bucket and registers the vault; the vault shows "provisioning"
until that finishes.

Everything is decided for you unless you say otherwise: the name defaults to
"backups" (then "backups-2" and so on), the credential to the only one Ankra
can provision from, and the region to that provider's usual one. The command
prints what it chose before it creates anything.

Hetzner alone needs its Object Storage key pair passed in (or prompted for):
Hetzner issues those in the Cloud Console (Object Storage > Manage
credentials) and its Cloud API cannot mint them. The other providers need
nothing beyond the credential.

Examples:

```bash theme={null}
ankra backup vaults provision
ankra backup vaults provision offsite --credential upcloud-main --region europe-1 --wait
ankra backup vaults provision offsite --credential hetzner-main --region fsn1
```

```bash theme={null}
ankra backup vaults provision [name] [flags]
```

**Flags**

| Flag | Default | Description |
| - | - | - |
| `--access-key-id` | | Hetzner Object Storage access key (Hetzner only; prompted for when omitted) |
| `--bucket` | | Bucket name (default: a unique name derived from the vault name) |
| `--credential` | | Provider credential (name or id) Ankra creates the bucket with (default: the only one it can provision from) |
| `--region` | | Provider region for the bucket (default: that provider's usual one - fsn1, europe-1, fra1, fr-par) |
| `--secret-access-key` | | Hetzner Object Storage secret key (Hetzner only; prompted for hidden when omitted) |
| `--timeout` | `25m0s` | Maximum time to wait when `--wait` is set |
| `--wait` | `false` | Wait for the operation to finish and report success or failure (default: submit and return immediately) |

## ankra backup vaults verify

Re-run the platform's credential check against the vault's bucket and report the new status. Use this after rotating or fixing the access keys.

```bash theme={null}
ankra backup vaults verify [vault-name|vault-id]
```


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.