---
title: "Retrieve an anomaly"
method: GET
path: "/anomalies/v1/{id}"
tags: ["Anomalies"]
---

# Retrieve an anomaly

`GET /anomalies/v1/{id}`

Returns the specified anomaly.

## Path parameters

- `id` string, required

## Response `200`

OK - Anomaly returned.

- object
  - `attribution` string, required — Attribution ID
  - `billingAccount` string, required — Billing account ID
  - `costOfAnomaly` number, double, required — The difference between the actual cost and the maximum cost in the normal range.
  - `platform` string, required — Cloud Provider name
  - `scope` string, required — Scope: Project or Account
  - `serviceName` string, required — Service name
  - `severityLevel` string, required — Severity level: Information, Warning or Critical
  - `startTime` integer, required — Usage start time of the anomaly
  - `endTime` integer, nullable — End of the anomaly
  - `timeFrame` string, required — Timeframe: Daily or Hourly
  - `top3SKUs` AnomalySKU[], required — Array of SKU entries contributing to an anomaly.
    - `cost` number, double
    - `name` string
  - `resourceData` AnomalyResource[] — Array of resources contributing to an anomaly.
    - `cost` number, double
    - `resourceId` string
    - `skuDescription` string
    - `operation` string — For anomalies related to AWS S3
    - `labels` AnomalyResourceLabel[] — Labels (also known as cost-allocation tags) present on this resource during the anomaly; each entry reports the label's key, its value, and the resource's cost tagged with that key/value pair. Cloud providers use different names for the same concept; GCP uses "labels", AWS uses "cost-allocation tags", and Azure uses "tags". We refer to all of these as labels.
      - `key` string — The label/tag key.
      - `value` string — The label/tag value.
      - `cost` number, double — The resource's cost tagged with this key/value pair; typically equal to the resource's cost, since labels/tags usually cover all of its spend.
  - `status` 'active' | 'inactive', nullable
  - `acknowledged` boolean — Has the anomaly been acknowledged
  - `acknowledgedAt` string, date-time, nullable — When the anomaly was first acknowledged
  - `acknowledgedBy` string, nullable — Email of the user who first acknowledged the anomaly
  - `notifications` NotificationEvent[], required — Chronologically ordered notification dispatch events.
    - `timestamp` string, date-time, required — Dispatch timestamp in RFC3339 UTC.
    - `channel` 'email' | 'slack' | 'msteams', required — Dispatch channel.

## Other responses

- `400` — Bad Request - The server cannot process the request, often due to a malformed request.
- `401` — Unauthorized - Invalid API key.
- `403` — Forbidden - The client is not authorized to perform the request.
- `404` — Not Found - The requested resource does not exist.

---

[API](https://skmtc.dev/doit/apis/doit-cloud-intelligence.md) · [All operations](https://skmtc.dev/doit/apis/doit-cloud-intelligence/llms.txt) · [OpenAPI document](https://skmtc-service-production.skmtc.workers.dev/v1/apis/doit/doit-cloud-intelligence/revisions/9416402fc119/schema)