This page describes how to use JFrog CLI with JFrog Xray.

Read more about JFrog CLI here.


When used with JFrog Artifactory, JFrog CLI uses the following syntax:

$ jfrog xr command-name arguments options


When used with Xray, JFrog CLI offers several means of authentication: JFrog CLI does not support accessing  Xray without authentication. 

Authenticating with Username and Password

To authenticate yourself using your Xray login credentials, configure your credentials once using the jfrog c add command.

Authenticating with an Access Token

To authenticate yourself using an Xray Access Token, either configure your Access Token once using the jfrog c add command or use the --access-token command option with each command.


Running cUrl

Execute a cUrl command, using the configured Xray details. The command expects the cUrl client to be included in the PATH. 

Command name


Command options



Server ID configured using the jfrog rt c add command. If not specified, the default configured server is used.

Command arguments

cUrl arguments and flags

The same list of arguments and flags passed to cUrl, except for the following changes:

  1. The full Xray URL should not be passed. Instead, the REST endpoint URI should be sent.
  2. The login credentials should not be passed. Instead, the --server-id should be used.


Example 1

Execute the cUrl client, to sent a GET request to the /api/system/version endpoint to the default configured Xray server.

jfrog xr curl -XGET /api/v1/system/version

Example 2

Execute the cUrl client, to send a GET request to the /api/v1/system/version endpoint to the configured my-xr-server server ID.

jfrog rt curl -XGET /api/v1/system/version --server-id my-xr-server

Downloading updates Xray's database

The offline-update command downloads updates to the for Xray's vulnerabilities database. The Xray UI allows building the command structure for you.

Command name


Command options



Xray license ID



From update date in YYYY-MM-DD format.



To update date in YYYY-MM-DD format.



Xray API version.


[Default: ./]

Path for downloaded update files.

Command arguments
The command accepts no arguments.