---
title: "GET /orgs/{orgId}/anomaly-alerts"
method: GET
path: "/orgs/{orgId}/anomaly-alerts"
---

# GET /orgs/{orgId}/anomaly-alerts

`GET /orgs/{orgId}/anomaly-alerts`

## Request

- Base URL: `https://api.useanima.sh/v1`
- URL: `https://api.useanima.sh/v1/orgs/{orgId}/anomaly-alerts`
- Auth: one of:
  - HTTP bearer
  - API key in header `X-API-Key`

## Path parameters

- `orgId` string, required: Organization identifier

## Query parameters

- `agentId` string: Filter by agent identifier
- `metric` 'email_send_rate' | 'sms_send_rate' | 'vault_access_rate' | 'api_call_rate' | 'unique_recipients': Filter by metric type
- `severity` 'INFO' | 'WARNING' | 'CRITICAL': Filter by severity
- `status` 'TRIGGERED' | 'ACKNOWLEDGED' | 'RESOLVED' | 'FALSE_POSITIVE': Filter by status
- `cursor` string: Pagination cursor
- `limit` integer: Maximum number of alerts to return

## Response `200`

OK

- object: Paginated list of anomaly alerts
  - `items` object[], required: List of anomaly alerts
    - `id` string, required: Unique alert identifier
    - `orgId` string, required: Organization identifier
    - `agentId` string, required: Agent identifier
    - `metric` 'email_send_rate' | 'sms_send_rate' | 'vault_access_rate' | 'api_call_rate' | 'unique_recipients', required: Type of metric being tracked
    - `severity` 'INFO' | 'WARNING' | 'CRITICAL', required: Severity level of the anomaly alert
    - `status` 'TRIGGERED' | 'ACKNOWLEDGED' | 'RESOLVED' | 'FALSE_POSITIVE', required: Current status of the anomaly alert
    - `baselineValue` number, required: Expected baseline value
    - `actualValue` number, required: Observed actual value
    - `zScore` number, required: Z-score of the deviation
    - `ruleId` string, nullable, required: Identifier of the rule that triggered this alert
    - `details` object, required: Additional details about the anomaly
    - `acknowledgedBy` string, nullable, required: User who acknowledged the alert
    - `acknowledgedAt` string, nullable, required: ISO 8601 timestamp when acknowledged
    - `resolvedBy` string, nullable, required: User who resolved the alert
    - `resolvedAt` string, nullable, required: ISO 8601 timestamp when resolved
    - `createdAt` string, required: ISO 8601 timestamp when alert was created
    - `updatedAt` string, required: ISO 8601 timestamp when alert was last updated
  - `nextCursor` string, nullable, required: Cursor for the next page, null if no more results

---

[API](https://skmtc.dev/useanima/apis/anima-api.md) · [All operations](https://skmtc.dev/useanima/apis/anima-api/llms.txt) · [OpenAPI document](https://skmtc.dev/useanima/apis/anima-api/revisions/aaa148188980?raw)