---
title: "List cost anomalies"
method: GET
path: "/api/v2/cost/anomalies"
tags: ["Cloud Cost Management"]
---

# List cost anomalies

`GET /api/v2/cost/anomalies`

## Request

- Base URL: `https://api.datadoghq.com`
- URL: `https://api.datadoghq.com/api/v2/cost/anomalies`
- Auth: one of:
  - API key in header `DD-API-KEY` and API key in header `DD-APPLICATION-KEY`
  - OAuth 2
    - Authorization code: `/oauth2/v1/authorize`
    - Token URL: `/oauth2/v1/token` scopes: `cloud_cost_management_read`

List detected Cloud Cost Management anomalies for the organization.

## Query parameters

- `start` integer
- `end` integer
- `filter` string
- `min_anomalous_threshold` string
- `min_cost_threshold` string
- `dismissal_cause` string
- `order_by` string
- `order` string
- `limit` integer
- `offset` integer
- `provider_ids` string[]

## Response `200`

OK

- CostAnomaliesResponse: Response object containing a list of detected Cloud Cost Management anomalies and aggregated totals.
  - `data` CostAnomaliesResponseData: Resource wrapper for the list of cost anomalies and aggregated totals.
    - `attributes` CostAnomaliesResponseDataAttributes, required: Cost anomaly results and aggregated totals for the queried window.
      - `anomalies` CostAnomaly[], required: The list of cost anomalies that match the request.
        - `actual_cost` number, double, required: Actual cost incurred during the anomaly window.
        - `anomalous_cost_change` number, double, required: Anomalous cost change relative to the expected baseline.
        - `anomaly_end` integer, required: Anomaly end timestamp in Unix milliseconds.
        - `anomaly_start` integer, required: Anomaly start timestamp in Unix milliseconds.
        - `correlated_tags` CostAnomalyCorrelatedTags, nullable, required: Map of correlated tag keys to the list of correlated tag values.
        - `dimensions` CostAnomalyDimensions, required: Map of cost dimension keys to their values for the anomaly grouping.
        - `dismissal` CostAnomalyDismissal: Resolution metadata for an anomaly that has been dismissed.
          - `cause` string, required: Reason the anomaly was dismissed.
          - `dismissal_id` string, required: Unique identifier of the dismissal record.
          - `message` string, required: Optional message explaining the dismissal.
          - `updated_at` integer, required: Timestamp of the last dismissal update in Unix milliseconds.
          - `updated_by` string, required: Identifier of the user that last updated the dismissal.
        - `max_cost` number, double, required: Maximum cost observed during the anomaly window.
        - `provider` string, required: Cloud or SaaS provider associated with the anomaly (for example `aws`, `gcp`, `azure`).
        - `query` string, required: The metrics query that detected the anomaly.
        - `uuid` string, required: The unique identifier of the anomaly.
      - `avg_daily_anomalous_cost` number, double, required: Average daily anomalous cost change across the queried window.
      - `total_actual_cost` number, double, required: Total actual cost spent across the queried window for the matching providers.
      - `total_anomalous_cost` number, double, required: Sum of the anomalous cost change across all returned anomalies.
      - `total_count` integer, required: Total number of anomalies that match the request.
    - `id` string, required: Static identifier of the cost anomalies collection resource.
    - `type` 'anomalies', required: Type of the cost anomalies collection resource. Must be `anomalies`.

## Other responses

- `400`: Bad Request
- `403`: Forbidden
- `429`: Too many requests

---

[API](https://skmtc.dev/datadog/apis/datadog-api-v2-collection.md) - [All operations](https://skmtc.dev/datadog/apis/datadog-api-v2-collection/llms.txt) - [OpenAPI document](https://skmtc.dev/datadog/apis/datadog-api-v2-collection/revisions/da68bf029e4c?raw)