---
title: "List anomalies"
method: GET
path: "/anomalies/v1"
tags: ["Anomalies"]
---

# List anomalies

`GET /anomalies/v1`

Returns a list of detected anomalies.
Anomalies are returned in reverse chronological order by default.
The `notifications` array is always present on each anomaly item; it is empty unless `includeNotifications=true` is supplied.

## Query parameters

- `minCreationTime` string
- `maxCreationTime` string
- `filter` string
- `maxResults` integer
- `pageToken` string
- `includeNotifications` boolean

## Response `200`

OK - The request succeeded.

- AnomaliesResponse — List of detected cloud cost anomalies.
  - `anomalies` AnomalyItem[]
    - `attribution` string, required — Attribution ID.
    - `billingAccount` string, required — Billing account ID.
    - `costOfAnomaly` number, double, required — Excess cost over and above the expected normal cost.
    - `id` string
    - `platform` string, required — Cloud Provider name.
    - `scope` string, required — Scope: Project or Account
    - `serviceName` string, required — Service name.
    - `severityLevel` string, required — Severity level: Information, Warning or Critical
    - `startTime` integer, required — Usage start time of the anomaly.
    - `endTime` integer, nullable — End of the anomaly.
    - `timeFrame` string, required — Timeframe: Daily or Hourly
    - `top3SKUs` AnomalySKU[], required — Array of SKU entries contributing to an anomaly.
      - `cost` number, double
      - `name` string
    - `resourceData` AnomalyResource[] — Array of resources contributing to an anomaly.
      - `cost` number, double
      - `resourceId` string
      - `skuDescription` string
      - `operation` string — For anomalies related to AWS S3
      - `labels` AnomalyResourceLabel[] — Labels (also known as cost-allocation tags) present on this resource during the anomaly; each entry reports the label's key, its value, and the resource's cost tagged with that key/value pair. Cloud providers use different names for the same concept; GCP uses "labels", AWS uses "cost-allocation tags", and Azure uses "tags". We refer to all of these as labels.
        - `key` string — The label/tag key.
        - `value` string — The label/tag value.
        - `cost` number, double — The resource's cost tagged with this key/value pair; typically equal to the resource's cost, since labels/tags usually cover all of its spend.
    - `status` 'active' | 'inactive', nullable
    - `acknowledged` boolean — Has the anomaly been acknowledged
    - `acknowledgedAt` string, date-time, nullable — When the anomaly was first acknowledged
    - `acknowledgedBy` string, nullable — Email of the user who first acknowledged the anomaly
    - `notifications` NotificationEvent[], required — Chronologically ordered notification dispatch events.
      - `timestamp` string, date-time, required — Dispatch timestamp in RFC3339 UTC.
      - `channel` 'email' | 'slack' | 'msteams', required — Dispatch channel.
  - `pageToken` string
  - `rowCount` integer

## Other responses

- `400` — Bad Request - The server cannot process the request, often due to a malformed request.
- `401` — Unauthorized - Invalid API key.
- `403` — Forbidden - The client is not authorized to perform the request.
- `404` — Not Found - The requested resource does not exist.

---

[API](https://skmtc.dev/doit/apis/doit-cloud-intelligence.md) · [All operations](https://skmtc.dev/doit/apis/doit-cloud-intelligence/llms.txt) · [OpenAPI document](https://skmtc-service-production.skmtc.workers.dev/v1/apis/doit/doit-cloud-intelligence/revisions/9416402fc119/schema)