# Get anomaly detail

Source: https://docs.levelfour.ai/api-reference/anomalies/get-anomalies-by-id


## GET /api/v1/anomalies/{anomaly_id}

### Authentication

Send `Authorization: Bearer <token>`.

### Parameters

- `anomaly_id` (path, string, required)

### Responses

#### 200: Successful Response

- `success` (boolean, default `true`)
- `timestamp` (date-time string)
- `data` (object, required)
  - `id` (string, required)
  - `severity` (one of `critical`, `warning`, required)
  - `status` (one of `active`, `resolved`, `dismissed`, required)
  - `status_elapsed` (string, required)
  - `title` (string, required)
  - `subtitle` (string, required)
  - `stats` (array of object, required)
    - `id` (string, required)
    - `label` (string, required)
    - `value` (string, required)
    - `sub` (string, required)
    - `value_color` (one of `default`, `success`, `warning`, `destructive`, nullable)
  - `chart` (object, required)
    - `data` (array of object, required)
      - `index` (string, required)
      - `cost` (number, required)
    - `baseline_low` (number, required)
    - `baseline_high` (number, required)
    - `spike_index` (integer, required)
    - `spike_label` (string, required)
    - `deploy_index` (integer, nullable)
    - `deploy_label` (string, nullable)
  - `rca` (array of object, required)
    - `id` (string, required)
    - `rank` (string, required)
    - `service` (string, required): Service value from AWS CE GetAnomalies RootCauses[].Service.
    - `linked_account` (string, required): LinkedAccount value from AWS CE GetAnomalies RootCauses[].LinkedAccount.
    - `linked_account_name` (string, nullable): LinkedAccountName from AWS CE GetAnomalies RootCauses[].LinkedAccountName, present when AWS can resolve the member account name.
    - `region` (string, required): Region value from AWS CE GetAnomalies RootCauses[].Region.
    - `usage_type` (string, required): UsageType value from AWS CE GetAnomalies RootCauses[].UsageType.
    - `contribution` (number, nullable): Dollar amount this root cause contributed to the anomaly TotalImpact, from AWS CE GetAnomalies RootCauses[].Impact.Contribution.
    - `primary` (boolean, default `false`)
  - `resources` (array of object, required)
    - `id` (string, required)
    - `name` (string, required)
    - `cost` (number, required)
    - `delta_pct` (number, required)
  - `peak_impact_usd` (number, nullable): Single-day peak cost impact in USD, from AWS Cost Explorer Impact.MaxImpact.
  - `total_impact_usd` (number, nullable): Total accumulated cost impact in USD, from AWS Cost Explorer Impact.TotalImpact.
  - `actual_spend_usd` (number, nullable): Cumulative actual spend over the anomaly window, from AWS Cost Explorer Impact.TotalActualSpend.
  - `expected_spend_usd` (number, nullable): Cumulative expected (baseline) spend the model predicted, from AWS Cost Explorer Impact.TotalExpectedSpend.
  - `spike_pct` (number, nullable): Spike size as a percentage, from AWS Cost Explorer Impact.TotalImpactPercentage.
  - `anomaly_score` (number, nullable): AWS Cost Explorer AnomalyScore.CurrentScore (0.00-1.00), the model's latest confidence in the anomaly.
  - `max_score` (number, nullable): AWS Cost Explorer AnomalyScore.MaxScore (0.00-1.00), the peak confidence observed over the anomaly window.
  - `feedback` (one of `YES`, `NO`, `PLANNED_ACTIVITY`, nullable): Latest feedback recorded for this anomaly (YES confirmed, NO not an anomaly, PLANNED_ACTIVITY expected), mirrored to AWS Cost Explorer.
  - `anomaly_start_date` (string, nullable): ISO date string for when the anomaly window opened, from AWS Cost Explorer.
  - `anomaly_end_date` (string, nullable): ISO date string for when the anomaly window closed, from AWS Cost Explorer. Null while the anomaly is still ongoing.

#### Errors

- `400`: Bad Request
- `401`: Authentication Error
- `403`: Authorization Error
- `404`: Not Found
- `409`: Conflict
- `422`: Validation Error
- `429`: Rate Limit Exceeded
- `500`: Internal Server Error

Body of `400`, `401`, `403`, `404`, `409`, `422`, `429`, `500`:

- `success` (`false`, required)
- `error` (object, required)
  - `code` (string, required)
  - `message` (string, required)
  - `details` (any)
- `timestamp` (date-time string, required)