---
title: "POST /orgs/{orgId}/anomaly-rules"
method: POST
path: "/orgs/{orgId}/anomaly-rules"
---

# POST /orgs/{orgId}/anomaly-rules

`POST /orgs/{orgId}/anomaly-rules`

## Request

- Base URL: `https://api.useanima.sh/v1`
- URL: `https://api.useanima.sh/v1/orgs/{orgId}/anomaly-rules`
- Auth: one of:
  - HTTP bearer
  - API key in header `X-API-Key`

## Path parameters

- `orgId` string, required: Organization identifier

## Request body

- object: Input for creating an anomaly detection rule
  - `name` string, required: Human-readable rule name
  - `metric` 'email_send_rate' | 'sms_send_rate' | 'vault_access_rate' | 'api_call_rate' | 'unique_recipients', required: Type of metric being tracked
  - `condition` 'zscore_gt' | 'rate_multiplier_gt' | 'absolute_gt' | 'time_violation', required: Detection condition type
  - `threshold` number, required: Threshold value for the condition
  - `severity` 'INFO' | 'WARNING' | 'CRITICAL': Severity level of the anomaly alert
  - `quarantineAction` 'NONE' | 'SOFT' | 'HARD': Quarantine action to take when rule triggers
  - `cooldownMinutes` integer: Minutes between alerts
  - `enabled` boolean

## Response `200`

OK

- object: An anomaly detection rule
  - `id` string, required: Unique rule identifier
  - `orgId` string, required: Organization identifier
  - `name` string, required: Human-readable rule name
  - `metric` 'email_send_rate' | 'sms_send_rate' | 'vault_access_rate' | 'api_call_rate' | 'unique_recipients', required: Type of metric being tracked
  - `condition` 'zscore_gt' | 'rate_multiplier_gt' | 'absolute_gt' | 'time_violation', required: Detection condition type
  - `threshold` number, required: Threshold value for the condition
  - `severity` 'INFO' | 'WARNING' | 'CRITICAL', required: Severity level of the anomaly alert
  - `quarantineAction` 'NONE' | 'SOFT' | 'HARD', required: Quarantine action to take when rule triggers
  - `cooldownMinutes` integer, required: Minutes to wait between alerts for this rule
  - `enabled` boolean, required: Whether the rule is active
  - `createdAt` string, required: ISO 8601 creation timestamp
  - `updatedAt` string, required: ISO 8601 last update timestamp

---

[API](https://skmtc.dev/useanima/apis/anima-api.md) · [All operations](https://skmtc.dev/useanima/apis/anima-api/llms.txt) · [OpenAPI document](https://skmtc.dev/useanima/apis/anima-api/revisions/aaa148188980?raw)