Report Anomaly
curl --request POST \
--url https://api.truthlocks.com/v1/agents/{agentId}/anomalies \
--header 'Content-Type: application/json' \
--header 'X-API-Key: <api-key>' \
--data '
{
"anomaly_type": "<string>",
"description": "<string>",
"evidence": {}
}
'import requests
url = "https://api.truthlocks.com/v1/agents/{agentId}/anomalies"
payload = {
"anomaly_type": "<string>",
"description": "<string>",
"evidence": {}
}
headers = {
"X-API-Key": "<api-key>",
"Content-Type": "application/json"
}
response = requests.post(url, json=payload, headers=headers)
print(response.text)const options = {
method: 'POST',
headers: {'X-API-Key': '<api-key>', 'Content-Type': 'application/json'},
body: JSON.stringify({anomaly_type: '<string>', description: '<string>', evidence: {}})
};
fetch('https://api.truthlocks.com/v1/agents/{agentId}/anomalies', options)
.then(res => res.json())
.then(res => console.log(res))
.catch(err => console.error(err));<?php
$curl = curl_init();
curl_setopt_array($curl, [
CURLOPT_URL => "https://api.truthlocks.com/v1/agents/{agentId}/anomalies",
CURLOPT_RETURNTRANSFER => true,
CURLOPT_ENCODING => "",
CURLOPT_MAXREDIRS => 10,
CURLOPT_TIMEOUT => 30,
CURLOPT_HTTP_VERSION => CURL_HTTP_VERSION_1_1,
CURLOPT_CUSTOMREQUEST => "POST",
CURLOPT_POSTFIELDS => json_encode([
'anomaly_type' => '<string>',
'description' => '<string>',
'evidence' => [
]
]),
CURLOPT_HTTPHEADER => [
"Content-Type: application/json",
"X-API-Key: <api-key>"
],
]);
$response = curl_exec($curl);
$err = curl_error($curl);
curl_close($curl);
if ($err) {
echo "cURL Error #:" . $err;
} else {
echo $response;
}package main
import (
"fmt"
"strings"
"net/http"
"io"
)
func main() {
url := "https://api.truthlocks.com/v1/agents/{agentId}/anomalies"
payload := strings.NewReader("{\n \"anomaly_type\": \"<string>\",\n \"description\": \"<string>\",\n \"evidence\": {}\n}")
req, _ := http.NewRequest("POST", url, payload)
req.Header.Add("X-API-Key", "<api-key>")
req.Header.Add("Content-Type", "application/json")
res, _ := http.DefaultClient.Do(req)
defer res.Body.Close()
body, _ := io.ReadAll(res.Body)
fmt.Println(string(body))
}HttpResponse<String> response = Unirest.post("https://api.truthlocks.com/v1/agents/{agentId}/anomalies")
.header("X-API-Key", "<api-key>")
.header("Content-Type", "application/json")
.body("{\n \"anomaly_type\": \"<string>\",\n \"description\": \"<string>\",\n \"evidence\": {}\n}")
.asString();require 'uri'
require 'net/http'
url = URI("https://api.truthlocks.com/v1/agents/{agentId}/anomalies")
http = Net::HTTP.new(url.host, url.port)
http.use_ssl = true
request = Net::HTTP::Post.new(url)
request["X-API-Key"] = '<api-key>'
request["Content-Type"] = 'application/json'
request.body = "{\n \"anomaly_type\": \"<string>\",\n \"description\": \"<string>\",\n \"evidence\": {}\n}"
response = http.request(request)
puts response.read_body{
"anomaly_id": "3c90c3cc-0d44-4b50-8888-8dd25736052a",
"agent_id": "3c90c3cc-0d44-4b50-8888-8dd25736052a",
"anomaly_type": "<string>",
"severity": "low",
"details": {},
"status": "open",
"resolution": "<string>",
"resolved_by": "<string>",
"created_at": "2023-11-07T05:31:56Z",
"resolved_at": "2023-11-07T05:31:56Z"
}{
"code": "AUTH_REQUIRED",
"message": "Authentication required",
"http_status": 401
}{
"code": "AUTH_REQUIRED",
"message": "Authentication required",
"http_status": 401
}{
"code": "AUTH_REQUIRED",
"message": "Authentication required",
"http_status": 401
}{
"code": "AUTH_REQUIRED",
"message": "Authentication required",
"http_status": 401
}Compliance & Anomalies
Report Anomaly
Report a behavioral anomaly detected in an AI agent’s activity.
POST
/
v1
/
agents
/
{agentId}
/
anomalies
Report Anomaly
curl --request POST \
--url https://api.truthlocks.com/v1/agents/{agentId}/anomalies \
--header 'Content-Type: application/json' \
--header 'X-API-Key: <api-key>' \
--data '
{
"anomaly_type": "<string>",
"description": "<string>",
"evidence": {}
}
'import requests
url = "https://api.truthlocks.com/v1/agents/{agentId}/anomalies"
payload = {
"anomaly_type": "<string>",
"description": "<string>",
"evidence": {}
}
headers = {
"X-API-Key": "<api-key>",
"Content-Type": "application/json"
}
response = requests.post(url, json=payload, headers=headers)
print(response.text)const options = {
method: 'POST',
headers: {'X-API-Key': '<api-key>', 'Content-Type': 'application/json'},
body: JSON.stringify({anomaly_type: '<string>', description: '<string>', evidence: {}})
};
fetch('https://api.truthlocks.com/v1/agents/{agentId}/anomalies', options)
.then(res => res.json())
.then(res => console.log(res))
.catch(err => console.error(err));<?php
$curl = curl_init();
curl_setopt_array($curl, [
CURLOPT_URL => "https://api.truthlocks.com/v1/agents/{agentId}/anomalies",
CURLOPT_RETURNTRANSFER => true,
CURLOPT_ENCODING => "",
CURLOPT_MAXREDIRS => 10,
CURLOPT_TIMEOUT => 30,
CURLOPT_HTTP_VERSION => CURL_HTTP_VERSION_1_1,
CURLOPT_CUSTOMREQUEST => "POST",
CURLOPT_POSTFIELDS => json_encode([
'anomaly_type' => '<string>',
'description' => '<string>',
'evidence' => [
]
]),
CURLOPT_HTTPHEADER => [
"Content-Type: application/json",
"X-API-Key: <api-key>"
],
]);
$response = curl_exec($curl);
$err = curl_error($curl);
curl_close($curl);
if ($err) {
echo "cURL Error #:" . $err;
} else {
echo $response;
}package main
import (
"fmt"
"strings"
"net/http"
"io"
)
func main() {
url := "https://api.truthlocks.com/v1/agents/{agentId}/anomalies"
payload := strings.NewReader("{\n \"anomaly_type\": \"<string>\",\n \"description\": \"<string>\",\n \"evidence\": {}\n}")
req, _ := http.NewRequest("POST", url, payload)
req.Header.Add("X-API-Key", "<api-key>")
req.Header.Add("Content-Type", "application/json")
res, _ := http.DefaultClient.Do(req)
defer res.Body.Close()
body, _ := io.ReadAll(res.Body)
fmt.Println(string(body))
}HttpResponse<String> response = Unirest.post("https://api.truthlocks.com/v1/agents/{agentId}/anomalies")
.header("X-API-Key", "<api-key>")
.header("Content-Type", "application/json")
.body("{\n \"anomaly_type\": \"<string>\",\n \"description\": \"<string>\",\n \"evidence\": {}\n}")
.asString();require 'uri'
require 'net/http'
url = URI("https://api.truthlocks.com/v1/agents/{agentId}/anomalies")
http = Net::HTTP.new(url.host, url.port)
http.use_ssl = true
request = Net::HTTP::Post.new(url)
request["X-API-Key"] = '<api-key>'
request["Content-Type"] = 'application/json'
request.body = "{\n \"anomaly_type\": \"<string>\",\n \"description\": \"<string>\",\n \"evidence\": {}\n}"
response = http.request(request)
puts response.read_body{
"anomaly_id": "3c90c3cc-0d44-4b50-8888-8dd25736052a",
"agent_id": "3c90c3cc-0d44-4b50-8888-8dd25736052a",
"anomaly_type": "<string>",
"severity": "low",
"details": {},
"status": "open",
"resolution": "<string>",
"resolved_by": "<string>",
"created_at": "2023-11-07T05:31:56Z",
"resolved_at": "2023-11-07T05:31:56Z"
}{
"code": "AUTH_REQUIRED",
"message": "Authentication required",
"http_status": 401
}{
"code": "AUTH_REQUIRED",
"message": "Authentication required",
"http_status": 401
}{
"code": "AUTH_REQUIRED",
"message": "Authentication required",
"http_status": 401
}{
"code": "AUTH_REQUIRED",
"message": "Authentication required",
"http_status": 401
}Reports a behavioral anomaly detected in an AI agent’s activity. Anomalies are flagged observations that indicate an agent may be operating outside its expected behavioral envelope — such as sudden rate spikes, scope violations, trust score drops, or geographic access anomalies.
Anomaly reports create actionable alerts for security teams and can trigger automated response policies (e.g., throttling, session revocation, or agent suspension) depending on severity and tenant configuration.
Anomaly Types
| Type | Description |
|---|---|
rate_spike | Agent’s request rate significantly exceeds historical baseline |
scope_violation | Agent attempted to access a resource outside its granted scopes |
trust_drop | Agent’s computed trust score dropped below threshold |
pattern_deviation | Agent’s behavioral pattern deviates from its trained baseline |
geographic_anomaly | Agent accessed from an unexpected geographic location or IP range |
Severity Levels
| Severity | SLA | Auto-Response |
|---|---|---|
low | 24h review | Logged only |
medium | 4h review | Agent throttled |
high | 1h review | Sessions suspended |
critical | 15min review | Agent revoked pending investigation |
Authentication
string
required
API key with
anomalies:write scope. Alternatively, pass a Bearer JWT token
in the Authorization header.string
required
Tenant identifier for multi-tenant isolation.
Request
string
required
MAIP agent identifier exhibiting the anomalous behavior.
string
required
Type of anomaly detected. Must be one of:
rate_spike, scope_violation,
trust_drop, pattern_deviation, geographic_anomaly.string
required
Severity level. Must be one of:
low, medium, high, critical.string
Human-readable description of the anomaly and its potential impact.
object
Structured evidence supporting the anomaly report. Contents vary by anomaly
type: - For
rate_spike: baseline_rps, observed_rps, window_seconds -
For scope_violation: attempted_scope, granted_scopes, resource_id -
For trust_drop: previous_score, current_score, threshold - For
pattern_deviation: expected_pattern, observed_pattern, deviation_score- For
geographic_anomaly:expected_regions,observed_ip,observed_country
Response
string
Unique anomaly identifier in MAIP format (
maip-anom:ULID).string
The agent associated with the anomaly.
string
Type of anomaly reported.
string
Severity level.
string
Anomaly status. Always
open on creation.string
Automated response action taken (if any), based on severity and tenant policy.
string
ISO 8601 timestamp of creation.
Authorizations
API key for machine-to-machine authentication
Path Parameters
Agent identifier
Body
application/json
Classification (e.g. scope_escalation, unusual_volume, auth_failure_burst)
Severity classification
Available options:
low, medium, high, critical Human-readable description of the anomaly
Structured evidence supporting the anomaly report
Response
Anomaly reported
Available options:
low, medium, high, critical Available options:
open, investigating, resolved, dismissed 
