Anchore

Connect Anchore to collect vulnerability scanning evidence with automated compliance tests, switched on per workspace.

Connect with an API token

1. In Anchore:

   1. Use (or have an admin create) an Anchore Enterprise user that holds the read-only role in the account Safeguard should read.
   2. Signed in as that user, open the Enterprise UI, click the top right button and select API Keys.
   3. In the dialog that lists your keys, click Create New API Key.
   4. Enter a Name (mandatory and unique), an optional Description, and an Expiry Date (cannot exceed 365 days by default).
   5. Click save and copy the value that is output. There is no way to get this key value back.
   6. To assign the role as an admin: the read-only role grants listImages, getImage, listPolicies, getPolicy, getImageEvaluation and similar read permissions. API keys inherit the permissions and roles of the user they were generated for.

   Where to find the other values:

   • Account (optional): The Anchore account the user belongs to; system admins see account names under the System icon › Accounts.
   • Username (optional): When authenticating with an API key, the username is the special value _api_key.
   • Password (optional): Only for username/password authentication instead of an API key; with an API key, the key value is the password for the _api_key user.

   Anchore shows the secret only once, so copy it before you leave the page.

   API keys require Anchore Enterprise 5.1 or later. API keys for SAML (SSO) users are disabled by default (user_authentication.allow_api_keys_for_saml_users). Maximum key age defaults to 365 days (max_api_key_age_days).

   Source: docs.anchore.com, docs.anchore.com, docs.anchore.com, checked 2026-10-07.

   The permissions Safeguard needs: read-only role.

2. On Compliance › Connectors, open Anchore, click Connect, choose API token and fill in:

   Field	What to enter
   API URL	Optional. Your own server: an https address reachable from the internet.
   API key	Optional. Stored encrypted and never shown again.
   Account (optional)	—

   Or, instead: Username (optional), Password (optional).

3. Click Connect with token.

Frameworks

Safeguard's automated tests read Anchore and map to the controls below. When a test passes, the result is evidence toward each control it maps to, in every framework listed. It is evidence toward a control, not proof that the control is met on its own.

These tests are switched on per workspace by the Safeguard team.

Related

• Vulnerability Scanning connectors
• Compliance connectors: how connecting works, card statuses and multiple accounts
• Connector setup reference: every connector in one table
• Frameworks and connectors: how connectors provide evidence for frameworks