Skip to main content

Overview

The anomalies sub-client provides automated anomaly detection for agent activity. It identifies unusual patterns such as rate spikes, high failure rates, new principals, and off-hours activity.

anomalies.detect()

Run anomaly detection across all agents and return any newly detected anomalies.

Response: DetectAnomaliesResponse

detectedAt
string
ISO 8601 timestamp when detection was run.
total
number
Number of anomalies detected.
anomalies
Anomaly[]
Array of detected anomalies.

Anomaly types

Anomaly severity levels


anomalies.list()

List stored anomalies. Optionally filter to only unacknowledged anomalies.

Parameters

unacknowledged
boolean
When true, only return anomalies that have not been acknowledged.

Response: ListAnomaliesResponse

anomalies
Anomaly[]
Array of anomaly objects.
total
number
Total number of anomalies matching the filter.

anomalies.acknowledge()

Acknowledge an anomaly by ID. This marks it as reviewed so it no longer appears in the unacknowledged list.

Parameters

anomalyId
string
required
The anomaly ID to acknowledge.

Response: Anomaly

Returns the updated anomaly object with the acknowledgedAt timestamp set.

Anomaly object

id
string
Unique anomaly identifier.
type
AnomalyType
The anomaly type: 'rate_spike', 'high_failure_rate', 'new_principal', or 'off_hours_activity'.
severity
AnomalySeverity
Severity level: 'low', 'medium', or 'high'.
agentId
string | null
The agent associated with the anomaly, if applicable.
principalId
string | null
The user associated with the anomaly, if applicable.
description
string
Human-readable description of the anomaly.
metadata
Record<string, unknown>
Additional context about the anomaly (e.g. request rates, thresholds).
detectedAt
string
ISO 8601 timestamp when the anomaly was detected.
acknowledgedAt
string | null
ISO 8601 timestamp when the anomaly was acknowledged, or null.
Last modified on February 28, 2026