Report Anomaly
Compliance & Anomalies
Report Anomaly
Report a behavioral anomaly detected in an AI agent’s activity.
POST
Report Anomaly
Reports a behavioral anomaly detected in an AI agent’s activity. Anomalies are flagged observations that indicate an agent may be operating outside its expected behavioral envelope — such as sudden rate spikes, scope violations, trust score drops, or geographic access anomalies.
Anomaly reports create actionable alerts for security teams and can trigger automated response policies (e.g., throttling, session revocation, or agent suspension) depending on severity and tenant configuration.
Anomaly Types
Severity Levels
Authentication
string
required
API key with
anomalies:write scope. Alternatively, pass a Bearer JWT token
in the Authorization header.string
required
Tenant identifier for multi-tenant isolation.
Request
string
required
MAIP agent identifier exhibiting the anomalous behavior.
string
required
Type of anomaly detected. Must be one of:
rate_spike, scope_violation,
trust_drop, pattern_deviation, geographic_anomaly.string
required
Severity level. Must be one of:
low, medium, high, critical.string
Human-readable description of the anomaly and its potential impact.
object
Structured evidence supporting the anomaly report. Contents vary by anomaly
type: - For
rate_spike: baseline_rps, observed_rps, window_seconds -
For scope_violation: attempted_scope, granted_scopes, resource_id -
For trust_drop: previous_score, current_score, threshold - For
pattern_deviation: expected_pattern, observed_pattern, deviation_score- For
geographic_anomaly:expected_regions,observed_ip,observed_country
Response
string
Unique anomaly identifier in MAIP format (
maip-anom:ULID).string
The agent associated with the anomaly.
string
Type of anomaly reported.
string
Severity level.
string
Anomaly status. Always
open on creation.string
Automated response action taken (if any), based on severity and tenant policy.
string
ISO 8601 timestamp of creation.
Authorizations
API key for machine-to-machine authentication
Path Parameters
Agent identifier
Body
application/json
Classification (e.g. scope_escalation, unusual_volume, auth_failure_burst)
Severity classification
Available options:
low, medium, high, critical Human-readable description of the anomaly
Structured evidence supporting the anomaly report
Response
Anomaly reported
Available options:
low, medium, high, critical Available options:
open, investigating, resolved, dismissed 
