Retrieve an anomaly

GET

/v1/insights/anomalies/{id}

const url = 'http://127.0.0.1:8080/v1/insights/anomalies/example';
const options = {
  method: 'GET',
  headers: {'Deedglass-Version': '2026-10-01', Authorization: 'Bearer <token>'}
};

try {
  const response = await fetch(url, options);
  const data = await response.json();
  console.log(data);
} catch (error) {
  console.error(error);
}

curl --request GET \
  --url http://127.0.0.1:8080/v1/insights/anomalies/example \
  --header 'Authorization: Bearer <token>' \
  --header 'Deedglass-Version: 2026-10-01'

One anomaly episode (S27) with its evidence: the hourly points (at most 48), the baseline it was compared with, and up to 10 action ids. active is what anomaly.active sees now (it ends anomaly_active_minutes after the last finding); status is the review inbox and only a person moves it, except that an episode with no new occurrence for 14 days resolves itself (resolved.by is system, no deed). An id that isn’t one of this org’s anomalies is 404 not_found. A Console session (viewer and up) or an org admin key (admin scope); agent keys get 403 insufficient_scope.

Authorizations

bearerAuth
sessionCookie

Parameters

Path Parameters

required

string

The anomaly id (anm_…).

Header Parameters

Deedglass-Version

string

/^[0-9]{4}-[0-9]{2}-[0-9]{2}$/

The API version (YYYY-MM-DD). Leave it out to use your org’s pinned version (public routes use the latest). An unknown version is 400 api_version_invalid.

Responses

200

The anomaly.

application/json

An anomaly episode (S27): the unresolved series of findings for one agent, kind and tool. A signal for a person to review, not a verdict. active (until active_until) is what anomaly.active sees; status is the review inbox.

object

object

required

string

Allowed value: anomaly

required

string

/^anm_[0-7][0-9a-hjkmnp-tv-z]{25}$/

agent

required

object

required

string

name

required

string

kind

required

string

Allowed values: new_tool volume_spike off_hours deny_spike mismatch_spike user_ref_burst

tool

required

new_tool only.

string | null

severity

required

string

Allowed values: info warn high

score

required

number

title

required

Numbers first

string

status

required

string

Allowed values: open acknowledged resolved

active

required

boolean

active_until

required

string format: date-time

window

required

When the episode’s findings happened (decision time).

object

start

required

string format: date-time

end

required

string format: date-time

occurrences

required

integer

>= 1

evidence

required

What the detector saw. Always hour, timezone, window_start, window_end, history_hours, points (at most 48 hourly points) and action_ids (at most 10). By kind: count, factor, writes, share, deny_rate, baseline_rate, mismatches, new_refs, baseline_mean, baseline_stddev, tool, side_effect.

object

hour

string

timezone

string

window_start

string format: date-time

window_end

string format: date-time

history_hours

integer

count

integer

points

Array<object>

<= 48 items

object

count

number

score

number

window_start

string format: date-time

window_end

string format: date-time

action_ids

Array<string>

<= 10 items

detector_version

required

string

acknowledged

required

object

required

usr_… or key_….

string

required

string format: date-time

resolved

required

object

required

usr_…, key_…, or system for the 14-day close.

string

required

string format: date-time

reason

required

string | null

deed

required

The anomaly.resolved admin deed; null for the 14-day close.

string | null

created_at

required

string format: date-time

updated_at

required

string format: date-time

Examples

new_tool

ops-agent's first github.merge_pr

{
  "object": "anomaly",
  "id": "anm_01m42vb270xzbzmgbgyantw49w",
  "agent": {
    "id": "agt_01m42v9q429q2mprzr6xakrx42",
    "name": "ops-agent"
  },
  "kind": "new_tool",
  "tool": "github.merge_pr",
  "severity": "warn",
  "score": 2,
  "title": "first github.merge_pr (write), 15:00 to 16:00 IST",
  "status": "open",
  "active": false,
  "active_until": "2026-10-01T11:30:00Z",
  "window": {
    "start": "2026-10-01T09:30:00Z",
    "end": "2026-10-01T10:30:00Z"
  },
  "occurrences": 1,
  "evidence": {
    "hour": "15:00",
    "tool": "github.merge_pr",
    "side_effect": "write",
    "count": 2,
    "timezone": "IST",
    "points": [
      {
        "count": 2,
        "score": 2,
        "window_start": "2026-10-01T09:30:00.000Z",
        "window_end": "2026-10-01T10:30:00.000Z"
      }
    ],
    "action_ids": [
      "act_01m42vadezkscmydd9pw910e3m",
      "act_01m42vadr0f89h5svfvms0pj10"
    ],
    "window_start": "2026-10-01T09:30:00Z",
    "window_end": "2026-10-01T10:30:00Z",
    "history_hours": 99
  },
  "detector_version": "1",
  "acknowledged": null,
  "resolved": null,
  "created_at": "2026-10-04T06:59:05.192752Z",
  "updated_at": "2026-10-04T06:59:05.192752Z"
}

Headers

Deedglass-Request-Id

string

/^req_[0-7][0-9a-hjkmnp-tv-z]{25}$/

This request’s id. Quote it to support; it matches error.request_id.

Deedglass-Version

string

The API version this response follows.

404

No such anomaly in this org.

application/json

object

error

required

object

type

required

string

Allowed values: invalid_request_error authentication_error permission_error policy_error rate_limit_error api_error

code

required

string

Allowed values: invalid_api_key api_key_revoked api_key_expired agent_suspended agent_stopped org_stopped insufficient_scope policy_denied approval_required approval_expired budget_exceeded intent_required intent_invalid intent_replay tool_unknown connector_unavailable upstream_error timeout rate_limited idempotency_conflict validation_failed not_found conflict internal_error authentication_required method_not_allowed request_too_large unsupported_media_type invalid_json api_version_invalid idempotency_key_invalid idempotency_key_in_use service_unavailable session_expired csrf_failed insufficient_role login_link_invalid login_code_invalid last_owner policy_unavailable policy_invalid credentials_missing destination_blocked vault_unavailable upstream_auth_failed upstream_not_found upstream_rate_limited response_too_large statement_refused row_limit_exceeded database_role_unsafe database_not_ready witness_not_configured approval_decided already_countersigned approver_not_eligible self_approval approval_needs_person context_changed approval_unsatisfiable approval_link_invalid approval_link_review_only approver_unmapped stripe_live_key_refused stripe_livemode_detected upstream_approval_pending schedule_needs_approval action_executing from_denied undo_unavailable undo_plan_stale already_undone undo_conflict replay_too_large replay_window_invalid suggestion_stale shadow_slot_taken suggestion_decided observe_not_enabled pro_required

message

required

One or more calm sentences with the next step.

string

param

required

The request field, query parameter or header the error is about.

string | null

request_id

required

string

/^req_[0-7][0-9a-hjkmnp-tv-z]{25}$/

doc_url

required

string format: uri

diagnostics

On policy_invalid only. Each problem with its line, code and hint.

Array<object>

One finding about a policy file, with its position and the next step. Codes are stable and listed in docs/POLICY_ERRORS.md. In the policy_invalid error envelope each diagnostic also carries object: policy_diagnostic. The full PolicyDiagnostic schema is in openapi.yaml.

object

action

One agent action. Its sections mirror the deed’s. status is the one field an agent needs; state is the exact lifecycle state (docs/GATE.md). The Gate’s own responses (POST /v1/actions and its result report) add execution.result and witness.reasons; lists leave both out. The full Action schema is in openapi.yaml.

object

checks

On undo_unavailable only. Every check of the undo, each with its fix. Additive (S23).

Array<object>

One of the twelve safety checks (S23 §3.3). Available means no check failed. The full UndoCheck schema is in openapi.yaml.

object

Example

{
  "error": {
    "type": "invalid_request_error",
    "code": "not_found",
    "message": "No anomaly anm_01m42vb27wzpyw0b2n6aycjxkx in this org. List them: GET /v1/insights/anomalies.",
    "param": null,
    "request_id": "req_01m42vkfgev8q669w3tnnvbf4p",
    "doc_url": "https://docs.deedglass.com/errors/not_found"
  }
}

Headers

Deedglass-Request-Id

string

/^req_[0-7][0-9a-hjkmnp-tv-z]{25}$/

This request’s id. Quote it to support; it matches error.request_id.

default

An error. Every error has this envelope; doc_url explains the code.

application/json

object

error

required

object

type

required

string

Allowed values: invalid_request_error authentication_error permission_error policy_error rate_limit_error api_error

code

required

string

message

required

One or more calm sentences with the next step.

string

param

required

The request field, query parameter or header the error is about.

string | null

request_id

required

string

/^req_[0-7][0-9a-hjkmnp-tv-z]{25}$/

doc_url

required

string format: uri

diagnostics

On policy_invalid only. Each problem with its line, code and hint.

Array<object>

object

action

object

checks

On undo_unavailable only. Every check of the undo, each with its fix. Additive (S23).

Array<object>

One of the twelve safety checks (S23 §3.3). Available means no check failed. The full UndoCheck schema is in openapi.yaml.

object

Example

{
  "error": {
    "type": "invalid_request_error",
    "code": "not_found",
    "message": "There's no endpoint at GET /v1/helth. Did you mean /v1/health?",
    "param": null,
    "request_id": "req_01j9zr3m5k8q2w7x4t6v0b1c9d",
    "doc_url": "https://docs.deedglass.com/errors/not_found"
  }
}

Headers

Deedglass-Request-Id

string

/^req_[0-7][0-9a-hjkmnp-tv-z]{25}$/

This request’s id. Quote it to support; it matches error.request_id.

Deedglass-Version

string

The API version this response follows.