Skip to main content
POST
Report Anomaly
Reports a behavioral anomaly detected in an AI agent’s activity. Anomalies are flagged observations that indicate an agent may be operating outside its expected behavioral envelope — such as sudden rate spikes, scope violations, trust score drops, or geographic access anomalies. Anomaly reports create actionable alerts for security teams and can trigger automated response policies (e.g., throttling, session revocation, or agent suspension) depending on severity and tenant configuration.

Anomaly Types

Severity Levels

Authentication

string
required
API key with anomalies:write scope. Alternatively, pass a Bearer JWT token in the Authorization header.
string
required
Tenant identifier for multi-tenant isolation.

Request

string
required
MAIP agent identifier exhibiting the anomalous behavior.
string
required
Type of anomaly detected. Must be one of: rate_spike, scope_violation, trust_drop, pattern_deviation, geographic_anomaly.
string
required
Severity level. Must be one of: low, medium, high, critical.
string
Human-readable description of the anomaly and its potential impact.
object
Structured evidence supporting the anomaly report. Contents vary by anomaly type: - For rate_spike: baseline_rps, observed_rps, window_seconds - For scope_violation: attempted_scope, granted_scopes, resource_id - For trust_drop: previous_score, current_score, threshold - For pattern_deviation: expected_pattern, observed_pattern, deviation_score
  • For geographic_anomaly: expected_regions, observed_ip, observed_country

Response

string
Unique anomaly identifier in MAIP format (maip-anom:ULID).
string
The agent associated with the anomaly.
string
Type of anomaly reported.
string
Severity level.
string
Anomaly status. Always open on creation.
string
Automated response action taken (if any), based on severity and tenant policy.
string
ISO 8601 timestamp of creation.

Authorizations

X-API-Key
string
header
required

API key for machine-to-machine authentication

Path Parameters

agentId
string<uuid>
required

Agent identifier

Body

application/json
anomaly_type
string
required

Classification (e.g. scope_escalation, unusual_volume, auth_failure_burst)

severity
enum<string>
required

Severity classification

Available options:
low,
medium,
high,
critical
description
string

Human-readable description of the anomaly

evidence
object

Structured evidence supporting the anomaly report

Response

Anomaly reported

anomaly_id
string<uuid>
agent_id
string<uuid>
anomaly_type
string
severity
enum<string>
Available options:
low,
medium,
high,
critical
details
object
status
enum<string>
Available options:
open,
investigating,
resolved,
dismissed
resolution
string
resolved_by
string
created_at
string<date-time>
resolved_at
string<date-time>