# Download with NGC CLI

After [scanning a NIM container](/docs/products/supply-chain/cli/usage_examples#scan-a-nim-container), use the [NVIDIA GPU Cloud (NGC) CLI](https://org.ngc.nvidia.com/setup/installers/cli) to download model artifacts listed in `summary.referenced_models`. Supply Chain does not download these files during the container scan. See [NIM Container Scanning](/docs/products/supply-chain/cli/nim_container) for manifest parsing and advisory details.

## Why Referenced Files Must Be Downloaded

- **`ngc://` is not a supported `--input` scheme.** Supply Chain accepts local paths, cloud storage URLs, Hugging Face URLs, and `oci://` container references — not `ngc://` artifact URIs.
- **NGC serves model files over authenticated HTTPS APIs.** Individual model artifacts require NGC credentials (`NGC_API_KEY`) to download.
- **The scanner does not pass NGC credentials to artifact download endpoints.** While `NGC_API_KEY` is used to pull `oci://nvcr.io/nim/...` container images, that credential is not applied when fetching files referenced by `ngc://` URIs in the manifest.


## Prerequisites

1. Create an API key in the NGC portal.
2. Set the environment variable:

```
export NGC_API_KEY=<your-api-key>
```
3. Configure the CLI:

```
ngc config set
```
Provide your API key when prompted.


## Parse a referenced URI

Referenced models from a NIM container scan use this URI format:

```
ngc://{org}/{team}/{model}:{version}?file={filename}
```

Map the URI to an NGC CLI download command:

| URI component | NGC CLI argument |
|  --- | --- |
| `ngc://{org}/{team}/{model}:{version}?file={filename}` | `ngc registry model download-version {org}/{team}/{model}:{version} --file {filename}` |


Example:

| Referenced URI | Download command |
|  --- | --- |
| `ngc://nim/nvidia/test-model:1.0.0?file=model.bin` | `ngc registry model download-version nim/nvidia/test-model:1.0.0 --file model.bin` |


## Follow-up scan

After downloading artifacts, scan the files locally using Supply Chain CLI. See [Scanning a single file](/docs/products/supply-chain/cli/usage_examples#scanning-a-single-file) in Usage Examples for `docker run` commands.