Skip to content
deedglassdocs

Acknowledge an anomaly

POST
/v1/insights/anomalies/{id}/acknowledge
curl --request POST \
  --url http://127.0.0.1:8080/v1/insights/anomalies/example/acknowledge \
  --header 'Authorization: Bearer <token>' \
  --header 'Deedglass-Version: 2026-10-01'

Records who saw the episode (S27): status becomes acknowledged with acknowledged.by and .at. It changes nothing else: an active episode stays active until it expires, and no deed is sealed. Acknowledging an acknowledged episode answers it unchanged; a resolved one is 409 conflict. No body. An admin+ Console session (with the Deedglass-CSRF header) or an org admin key (admin scope); viewers get 403 insufficient_role and agent keys 403 insufficient_scope.

Authorizations

Section titled “Authorizations”

Parameters

Section titled “Parameters”

Path Parameters

Section titled “Path Parameters”
id
required
string

The anomaly id (anm_…).

Header Parameters

Section titled “Header Parameters”
Deedglass-Version
string
/^[0-9]{4}-[0-9]{2}-[0-9]{2}$/

The API version (YYYY-MM-DD). Leave it out to use your org’s pinned version (public routes use the latest). An unknown version is 400 api_version_invalid.

Deedglass-CSRF
string

Needed when the request uses a Console session (it changes state); without it the answer is 403 csrf_failed. Not sent with an API key.

Idempotency-Key
string
>= 1 characters <= 255 characters

1 to 255 printable ASCII characters. A retry with the same key and body returns the stored response with Deedglass-Idempotent-Replayed: true for 24 hours.

Responses

Section titled “Responses”

200

Section titled “200”

The anomaly, acknowledged.

Media typeapplication/json

An anomaly episode (S27): the unresolved series of findings for one agent, kind and tool. A signal for a person to review, not a verdict. active (until active_until) is what anomaly.active sees; status is the review inbox.

object
object
required
string
Allowed value: anomaly
id
required
string
/^anm_[0-7][0-9a-hjkmnp-tv-z]{25}$/
agent
required
object
id
required
string
name
required
string
kind
required
string
Allowed values: new_tool volume_spike off_hours deny_spike mismatch_spike user_ref_burst
tool
required

new_tool only.

string | null
severity
required
string
Allowed values: info warn high
score
required
number
title
required

Numbers first

string
status
required
string
Allowed values: open acknowledged resolved
active
required
boolean
active_until
required
string format: date-time
window
required

When the episode’s findings happened (decision time).

object
start
required
string format: date-time
end
required
string format: date-time
occurrences
required
integer
>= 1
evidence
required

What the detector saw. Always hour, timezone, window_start, window_end, history_hours, points (at most 48 hourly points) and action_ids (at most 10). By kind: count, factor, writes, share, deny_rate, baseline_rate, mismatches, new_refs, baseline_mean, baseline_stddev, tool, side_effect.

object
hour
string
timezone
string
window_start
string format: date-time
window_end
string format: date-time
history_hours
integer
count
integer
points
Array<object>
<= 48 items
object
count
number
score
number
window_start
string format: date-time
window_end
string format: date-time
action_ids
Array<string>
<= 10 items
detector_version
required
string
acknowledged
required
object
by
required

usr_… or key_….

string
at
required
string format: date-time
resolved
required
object
by
required

usr_…, key_…, or system for the 14-day close.

string
at
required
string format: date-time
reason
required
string | null
deed
required

The anomaly.resolved admin deed; null for the 14-day close.

string | null
created_at
required
string format: date-time
updated_at
required
string format: date-time
Examples
Exampleacknowledged

Acknowledged by an admin

{
  "object": "anomaly",
  "id": "anm_01m42vb285wmf0ay82683pp9m4",
  "agent": {
    "id": "agt_01m42v9q4500m4rfchvb8j53da",
    "name": "growth-agent"
  },
  "kind": "off_hours",
  "tool": null,
  "severity": "warn",
  "score": 12,
  "title": "12 calls, 02:00 to 03:00 IST · usually 0.2% of its calls at this hour",
  "status": "acknowledged",
  "active": false,
  "active_until": "2026-10-02T22:30:00Z",
  "window": {
    "start": "2026-10-02T20:30:00Z",
    "end": "2026-10-02T21:30:00Z"
  },
  "occurrences": 1,
  "evidence": {
    "hour": "02:00",
    "count": 12,
    "writes": 12,
    "share": 0.0024,
    "timezone": "IST",
    "points": [
      {
        "count": 12,
        "score": 12,
        "window_start": "2026-10-02T20:30:00.000Z",
        "window_end": "2026-10-02T21:30:00.000Z"
      }
    ],
    "action_ids": [
      "act_01m42vap394qwexdpmpazzgq31",
      "act_01m42vap52y8tmnrpbxak5gm5n",
      "act_01m42vap5e8em83fqr9x9j7eeg"
    ],
    "window_start": "2026-10-02T20:30:00Z",
    "window_end": "2026-10-02T21:30:00Z",
    "history_hours": 134
  },
  "detector_version": "1",
  "acknowledged": {
    "by": "usr_01m42v9p7c3e5g7j9m1q3s5v7x",
    "at": "2026-10-04T07:20:44.912310Z"
  },
  "resolved": null,
  "created_at": "2026-10-04T06:59:05.192752Z",
  "updated_at": "2026-10-04T07:20:44.912310Z"
}

Headers

Section titled “Headers”
Deedglass-Request-Id
string
/^req_[0-7][0-9a-hjkmnp-tv-z]{25}$/

This request’s id. Quote it to support; it matches error.request_id.

Deedglass-Version
string

The API version this response follows.

Deedglass-Idempotent-Replayed
string
Allowed values: true

Present, and true, when the response is a stored one replayed for an Idempotency-Key.

409

Section titled “409”

The anomaly is resolved.

Media typeapplication/json
object
error
required
object
type
required
string
Allowed values: invalid_request_error authentication_error permission_error policy_error rate_limit_error api_error
code
required
string
Allowed values: invalid_api_key api_key_revoked api_key_expired agent_suspended agent_stopped org_stopped insufficient_scope policy_denied approval_required approval_expired budget_exceeded intent_required intent_invalid intent_replay tool_unknown connector_unavailable upstream_error timeout rate_limited idempotency_conflict validation_failed not_found conflict internal_error authentication_required method_not_allowed request_too_large unsupported_media_type invalid_json api_version_invalid idempotency_key_invalid idempotency_key_in_use service_unavailable session_expired csrf_failed insufficient_role login_link_invalid login_code_invalid last_owner policy_unavailable policy_invalid credentials_missing destination_blocked vault_unavailable upstream_auth_failed upstream_not_found upstream_rate_limited response_too_large statement_refused row_limit_exceeded database_role_unsafe database_not_ready witness_not_configured approval_decided already_countersigned approver_not_eligible self_approval approval_needs_person context_changed approval_unsatisfiable approval_link_invalid approval_link_review_only approver_unmapped stripe_live_key_refused stripe_livemode_detected upstream_approval_pending schedule_needs_approval action_executing from_denied undo_unavailable undo_plan_stale already_undone undo_conflict replay_too_large replay_window_invalid suggestion_stale shadow_slot_taken suggestion_decided observe_not_enabled pro_required
message
required

One or more calm sentences with the next step.

string
param
required

The request field, query parameter or header the error is about.

string | null
request_id
required
string
/^req_[0-7][0-9a-hjkmnp-tv-z]{25}$/
doc_url
required
string format: uri
diagnostics

On policy_invalid only. Each problem with its line, code and hint.

Array<object>

One finding about a policy file, with its position and the next step. Codes are stable and listed in docs/POLICY_ERRORS.md. In the policy_invalid error envelope each diagnostic also carries object: policy_diagnostic. The full PolicyDiagnostic schema is in openapi.yaml.

object
action

One agent action. Its sections mirror the deed’s. status is the one field an agent needs; state is the exact lifecycle state (docs/GATE.md). The Gate’s own responses (POST /v1/actions and its result report) add execution.result and witness.reasons; lists leave both out. The full Action schema is in openapi.yaml.

object
checks

On undo_unavailable only. Every check of the undo, each with its fix. Additive (S23).

Array<object>

One of the twelve safety checks (S23 §3.3). Available means no check failed. The full UndoCheck schema is in openapi.yaml.

object
Example
{
  "error": {
    "type": "invalid_request_error",
    "code": "conflict",
    "message": "This anomaly is already resolved. Resolved anomalies stay in the history; a new finding opens a new one.",
    "param": null,
    "request_id": "req_01m42vmd4e6g8j0m2p4r6t8v0x",
    "doc_url": "https://docs.deedglass.com/errors/conflict"
  }
}

Headers

Section titled “Headers”
Deedglass-Request-Id
string
/^req_[0-7][0-9a-hjkmnp-tv-z]{25}$/

This request’s id. Quote it to support; it matches error.request_id.

default

Section titled “default”

An error. Every error has this envelope; doc_url explains the code.

Media typeapplication/json
object
error
required
object
type
required
string
Allowed values: invalid_request_error authentication_error permission_error policy_error rate_limit_error api_error
code
required
string
Allowed values: invalid_api_key api_key_revoked api_key_expired agent_suspended agent_stopped org_stopped insufficient_scope policy_denied approval_required approval_expired budget_exceeded intent_required intent_invalid intent_replay tool_unknown connector_unavailable upstream_error timeout rate_limited idempotency_conflict validation_failed not_found conflict internal_error authentication_required method_not_allowed request_too_large unsupported_media_type invalid_json api_version_invalid idempotency_key_invalid idempotency_key_in_use service_unavailable session_expired csrf_failed insufficient_role login_link_invalid login_code_invalid last_owner policy_unavailable policy_invalid credentials_missing destination_blocked vault_unavailable upstream_auth_failed upstream_not_found upstream_rate_limited response_too_large statement_refused row_limit_exceeded database_role_unsafe database_not_ready witness_not_configured approval_decided already_countersigned approver_not_eligible self_approval approval_needs_person context_changed approval_unsatisfiable approval_link_invalid approval_link_review_only approver_unmapped stripe_live_key_refused stripe_livemode_detected upstream_approval_pending schedule_needs_approval action_executing from_denied undo_unavailable undo_plan_stale already_undone undo_conflict replay_too_large replay_window_invalid suggestion_stale shadow_slot_taken suggestion_decided observe_not_enabled pro_required
message
required

One or more calm sentences with the next step.

string
param
required

The request field, query parameter or header the error is about.

string | null
request_id
required
string
/^req_[0-7][0-9a-hjkmnp-tv-z]{25}$/
doc_url
required
string format: uri
diagnostics

On policy_invalid only. Each problem with its line, code and hint.

Array<object>

One finding about a policy file, with its position and the next step. Codes are stable and listed in docs/POLICY_ERRORS.md. In the policy_invalid error envelope each diagnostic also carries object: policy_diagnostic. The full PolicyDiagnostic schema is in openapi.yaml.

object
action

One agent action. Its sections mirror the deed’s. status is the one field an agent needs; state is the exact lifecycle state (docs/GATE.md). The Gate’s own responses (POST /v1/actions and its result report) add execution.result and witness.reasons; lists leave both out. The full Action schema is in openapi.yaml.

object
checks

On undo_unavailable only. Every check of the undo, each with its fix. Additive (S23).

Array<object>

One of the twelve safety checks (S23 §3.3). Available means no check failed. The full UndoCheck schema is in openapi.yaml.

object
Example
{
  "error": {
    "type": "invalid_request_error",
    "code": "not_found",
    "message": "There's no endpoint at GET /v1/helth. Did you mean /v1/health?",
    "param": null,
    "request_id": "req_01j9zr3m5k8q2w7x4t6v0b1c9d",
    "doc_url": "https://docs.deedglass.com/errors/not_found"
  }
}

Headers

Section titled “Headers”
Deedglass-Request-Id
string
/^req_[0-7][0-9a-hjkmnp-tv-z]{25}$/

This request’s id. Quote it to support; it matches error.request_id.

Deedglass-Version
string

The API version this response follows.