---
title: "Detect anomalies in a table"
method: GET
path: "/v1/tables/{t}/anomalies"
tags: ["tables"]
---

# Detect anomalies in a table

`GET /v1/tables/{t}/anomalies`

## Request

- Base URL: `https://data.thinair.co`
- URL: `https://data.thinair.co/v1/tables/{t}/anomalies`
- Auth: API key in header `x-api-key`

Scan a table for unusual patterns: volume drops/spikes, data gaps, value concentration, high null rates, stale data. Severity-ranked. Tables > 100k rows use a sampled path (~5%) — alerts may carry `sampled: true`. Quota: 1 capability unit.

## Path parameters

- `t` string, required: Table name. Accepts `table`, `schema.table`, or `database.schema.table` forms — same wire shape the MCP `detect_anomalies` tool accepts. Use `?connection=` to override the tenant's default connection.

## Query parameters

- `connection` string: Connection name (display) or id (uuid). Resolved via name match first, then id match. Call /v1/connections to list available names.
- `column` string: Column to focus the scan on. Today maps to the date-trend column for volume / staleness anomalies; the post-migration spec broadens it to a per-column allowlist.
- `since_iso` string, date-time: ISO-8601 cutoff. Anomalies older than this are excluded. Today the underlying scan uses a fixed 14-day window; the value is reserved for the migrated implementation.
- `severity` 'low' | 'medium' | 'high': Minimum severity to include. `low` returns everything; `medium` drops `low`; `high` drops `low` and `medium`.

## Response `200`

Anomaly scan result.

- TablesAnomaliesResponse: Severity-ranked anomaly alerts for one table. Mirrors the MCP `detect_anomalies` envelope shape.
  - `alerts` object[], required
    - `severity` string, required
    - `type` string
    - `column` string, nullable
    - `message` string
    - `recommendation` string
    - `value` unknown
  - `summary` string
  - `insights` object[]
    - `severity` string, required
    - `message` string, required
    - `column` string
    - `value` unknown
  - `meta` object, required
    - `executionTimeMs` number, required
    - `connection` string, required
    - `dialect` 'postgres' | 'mysql' | 'mssql', required

## Other responses

- `400`: Invalid table name or query parameters.
- `401`: Authentication required or failed.
- `404`: Connection not found, no connections configured, or table missing from the connection's schema.
- `429`: Quota exceeded.

---

[API](https://skmtc.dev/thinair/apis/thinair-data-api.md) · [All operations](https://skmtc.dev/thinair/apis/thinair-data-api/llms.txt) · [OpenAPI document](https://skmtc.dev/thinair/apis/thinair-data-api/revisions/8a2a2d1b2400?raw)