> ## Documentation Index
> Fetch the complete documentation index at: https://docs.infraudit.com/llms.txt
> Use this file to discover all available pages before exploring further.

# REST API endpoints for cost and performance anomalies

> List and dismiss cost anomalies detected by InfraAudit. Each record includes the provider, date, actual spend, and statistical deviation from expected spend.

Anomalies are days where your actual cloud spend or resource performance deviates significantly from the expected range. InfraAudit uses statistical analysis to detect these deviations and surfaces the top contributing services for each anomaly.

Base path: `/api/v1/anomalies`

***

## GET /anomalies — list anomalies

Returns a list of detected anomalies within the specified time window.

```http theme={null}
GET /api/v1/anomalies
Authorization: Bearer <token>
```

### Query parameters

<ParamField query="provider_id" type="integer">
  Filter by provider.
</ParamField>

<ParamField query="type" type="string">
  Filter by anomaly type: `cost` or `performance`.
</ParamField>

<ParamField query="status" type="string">
  Filter by status: `active` or `dismissed`.
</ParamField>

<ParamField query="days" type="integer" default="30">
  Look-back window in days.
</ParamField>

### Response

```json theme={null}
{
  "data": [
    {
      "id": 1,
      "type": "cost",
      "provider_id": 1,
      "date": "2024-01-14",
      "actual_amount": 452.30,
      "expected_amount": 290.00,
      "expected_upper": 377.00,
      "deviation_percent": 56.0,
      "top_services": [
        {
          "service": "EC2",
          "amount": 380.00,
          "vs_expected": 180.00
        }
      ],
      "status": "active",
      "detected_at": "2024-01-15T03:30:00Z"
    }
  ]
}
```

<ResponseField name="expected_amount" type="number">
  The expected daily spend based on historical patterns.
</ResponseField>

<ResponseField name="expected_upper" type="number">
  The upper bound of the expected range. Spend above this value triggers anomaly detection.
</ResponseField>

<ResponseField name="deviation_percent" type="number">
  How far the actual spend exceeded the expected amount, as a percentage.
</ResponseField>

<ResponseField name="top_services" type="array">
  The cloud services that contributed most to the anomaly, with their actual spend and variance from expected.
</ResponseField>

***

## GET /anomalies/{id} — get anomaly details

Returns full details for a single anomaly.

```http theme={null}
GET /api/v1/anomalies/{id}
Authorization: Bearer <token>
```

***

## POST /anomalies/{id}/dismiss — dismiss an anomaly

Dismisses an anomaly with an optional reason.

```http theme={null}
POST /api/v1/anomalies/{id}/dismiss
Authorization: Bearer <token>
Content-Type: application/json
```

### Request body

<ParamField body="reason" type="string">
  Explanation for dismissing this anomaly.
</ParamField>

```json theme={null}
{
  "reason": "Planned deployment caused spend increase"
}
```