> ## Documentation Index
> Fetch the complete documentation index at: https://docs.ankra.ai/llms.txt
> Use this file to discover all available pages before exploring further.

# ankra backup

> Backup operations

## ankra backup

Commands for managing the organisation's backup infrastructure.

## ankra backup vaults

Manage the organisation's backup vaults: S3-compatible object-storage targets that cluster backups are written to. The platform verifies each vault's credentials against its bucket and reports the outcome as the vault's status.

## ankra backup vaults create

Create a backup vault: an S3-compatible bucket cluster backups are written to.

The access keys are prompted for interactively when not passed as flags, so
they never have to appear in your shell history. The platform verifies the
keys against the bucket immediately and the command reports the outcome.

Example:
ankra backup vaults create offsite --endpoint [https://s3.example.com](https://s3.example.com) --bucket cluster-backups

```bash theme={null}
ankra backup vaults create <name> [flags]
```

**Flags**

| Flag                  | Default | Description                                                                                                        |
| --------------------- | ------- | ------------------------------------------------------------------------------------------------------------------ |
| `--access-key-id`     |         | Access key ID (prompted for when omitted)                                                                          |
| `--bucket`            |         | Bucket the backups are written to (required)                                                                       |
| `--endpoint`          |         | S3-compatible endpoint URL (required)                                                                              |
| `--path-style`        | `true`  | Address the bucket path-style ([https://endpoint/bucket](https://endpoint/bucket)) instead of virtual-hosted-style |
| `--provider`          | `other` | Object-storage provider                                                                                            |
| `--region`            |         | Bucket region (leave empty when the endpoint implies it)                                                           |
| `--secret-access-key` |         | Secret access key (prompted for hidden when omitted; prefer the prompt so the key stays out of your shell history) |

## ankra backup vaults delete

Delete a backup vault.

By default this removes only Ankra's record of the vault and the access keys
it stored: the bucket, everything in it, and any provider resource Ankra
created for it are left in your cloud account.

\--destroy-provider-resources also destroys what Ankra created for an
Ankra-provisioned vault - it empties and deletes the bucket, and removes the
UpCloud object storage service or DigitalOcean Spaces key that was minted
for it. Restore points in that bucket are gone for good. It is refused for a
vault that registers a bucket you created yourself.

```bash theme={null}
ankra backup vaults delete [vault-name|vault-id] [flags]
```

**Flags**

| Flag                           | Default | Description                                                                                                                                                                                   |
| ------------------------------ | ------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| `--destroy-provider-resources` | `false` | Also destroy what Ankra created for this vault: empty and delete the bucket (every restore point in it is lost) and remove the provider resource minted for it. Ankra-provisioned vaults only |
| `--yes`                        | `false` | Skip the confirmation prompt                                                                                                                                                                  |

## ankra backup vaults get

Describe a backup vault: its endpoint, bucket, verification status, and - when the last credential check failed - the failure excerpt.

```bash theme={null}
ankra backup vaults get [vault-name|vault-id] [flags]
```

**Flags**

| Flag             | Default | Description                                           |
| ---------------- | ------- | ----------------------------------------------------- |
| `-o`, `--output` |         | Output format: json or yaml (default: human-readable) |

## ankra backup vaults list

List the organisation's backup vaults

```bash theme={null}
ankra backup vaults list [flags]
```

**Flags**

| Flag             | Default | Description                                           |
| ---------------- | ------- | ----------------------------------------------------- |
| `-o`, `--output` |         | Output format: json or yaml (default: human-readable) |

## ankra backup vaults provision

Create a backup vault and let Ankra create the bucket for it, using one of
the organisation's provider credentials (Hetzner, UpCloud, DigitalOcean or
Scaleway). Ankra creates the bucket, mints or stores the access keys,
verifies the bucket and registers the vault; the vault shows "provisioning"
until that finishes.

Everything is decided for you unless you say otherwise: the name defaults to
"backups" (then "backups-2" and so on), the credential to the only one Ankra
can provision from, and the region to that provider's usual one. The command
prints what it chose before it creates anything.

Hetzner alone needs its Object Storage key pair passed in (or prompted for):
Hetzner issues those in the Cloud Console (Object Storage > Manage
credentials) and its Cloud API cannot mint them. The other providers need
nothing beyond the credential.

Examples:
ankra backup vaults provision
ankra backup vaults provision offsite --credential upcloud-main --region europe-1 --wait
ankra backup vaults provision offsite --credential hetzner-main --region fsn1

```bash theme={null}
ankra backup vaults provision [name] [flags]
```

**Flags**

| Flag                  | Default | Description                                                                                                  |
| --------------------- | ------- | ------------------------------------------------------------------------------------------------------------ |
| `--access-key-id`     |         | Hetzner Object Storage access key (Hetzner only; prompted for when omitted)                                  |
| `--bucket`            |         | Bucket name (default: a unique name derived from the vault name)                                             |
| `--credential`        |         | Provider credential (name or id) Ankra creates the bucket with (default: the only one it can provision from) |
| `--region`            |         | Provider region for the bucket (default: that provider's usual one - fsn1, europe-1, fra1, fr-par)           |
| `--secret-access-key` |         | Hetzner Object Storage secret key (Hetzner only; prompted for hidden when omitted)                           |
| `--timeout`           | `10m0s` | Maximum time to wait when --wait is set                                                                      |
| `--wait`              | `false` | Wait for the operation to finish and report success or failure (default: submit and return immediately)      |

## ankra backup vaults verify

Re-run the platform's credential check against the vault's bucket and report the new status. Use this after rotating or fixing the access keys.

```bash theme={null}
ankra backup vaults verify [vault-name|vault-id]
```