Resolve Anomaly
curl --request POST \
--url https://api.truthlocks.com/v1/agents/{agentId}/anomalies/{anomalyId}/resolve \
--header 'Content-Type: application/json' \
--header 'X-API-Key: <api-key>' \
--data '
{
"resolution": "<string>",
"notes": "<string>"
}
'import requests
url = "https://api.truthlocks.com/v1/agents/{agentId}/anomalies/{anomalyId}/resolve"
payload = {
"resolution": "<string>",
"notes": "<string>"
}
headers = {
"X-API-Key": "<api-key>",
"Content-Type": "application/json"
}
response = requests.post(url, json=payload, headers=headers)
print(response.text)const options = {
method: 'POST',
headers: {'X-API-Key': '<api-key>', 'Content-Type': 'application/json'},
body: JSON.stringify({resolution: '<string>', notes: '<string>'})
};
fetch('https://api.truthlocks.com/v1/agents/{agentId}/anomalies/{anomalyId}/resolve', options)
.then(res => res.json())
.then(res => console.log(res))
.catch(err => console.error(err));<?php
$curl = curl_init();
curl_setopt_array($curl, [
CURLOPT_URL => "https://api.truthlocks.com/v1/agents/{agentId}/anomalies/{anomalyId}/resolve",
CURLOPT_RETURNTRANSFER => true,
CURLOPT_ENCODING => "",
CURLOPT_MAXREDIRS => 10,
CURLOPT_TIMEOUT => 30,
CURLOPT_HTTP_VERSION => CURL_HTTP_VERSION_1_1,
CURLOPT_CUSTOMREQUEST => "POST",
CURLOPT_POSTFIELDS => json_encode([
'resolution' => '<string>',
'notes' => '<string>'
]),
CURLOPT_HTTPHEADER => [
"Content-Type: application/json",
"X-API-Key: <api-key>"
],
]);
$response = curl_exec($curl);
$err = curl_error($curl);
curl_close($curl);
if ($err) {
echo "cURL Error #:" . $err;
} else {
echo $response;
}package main
import (
"fmt"
"strings"
"net/http"
"io"
)
func main() {
url := "https://api.truthlocks.com/v1/agents/{agentId}/anomalies/{anomalyId}/resolve"
payload := strings.NewReader("{\n \"resolution\": \"<string>\",\n \"notes\": \"<string>\"\n}")
req, _ := http.NewRequest("POST", url, payload)
req.Header.Add("X-API-Key", "<api-key>")
req.Header.Add("Content-Type", "application/json")
res, _ := http.DefaultClient.Do(req)
defer res.Body.Close()
body, _ := io.ReadAll(res.Body)
fmt.Println(string(body))
}HttpResponse<String> response = Unirest.post("https://api.truthlocks.com/v1/agents/{agentId}/anomalies/{anomalyId}/resolve")
.header("X-API-Key", "<api-key>")
.header("Content-Type", "application/json")
.body("{\n \"resolution\": \"<string>\",\n \"notes\": \"<string>\"\n}")
.asString();require 'uri'
require 'net/http'
url = URI("https://api.truthlocks.com/v1/agents/{agentId}/anomalies/{anomalyId}/resolve")
http = Net::HTTP.new(url.host, url.port)
http.use_ssl = true
request = Net::HTTP::Post.new(url)
request["X-API-Key"] = '<api-key>'
request["Content-Type"] = 'application/json'
request.body = "{\n \"resolution\": \"<string>\",\n \"notes\": \"<string>\"\n}"
response = http.request(request)
puts response.read_body{
"anomaly_id": "3c90c3cc-0d44-4b50-8888-8dd25736052a",
"agent_id": "3c90c3cc-0d44-4b50-8888-8dd25736052a",
"anomaly_type": "<string>",
"severity": "low",
"details": {},
"status": "open",
"resolution": "<string>",
"resolved_by": "<string>",
"created_at": "2023-11-07T05:31:56Z",
"resolved_at": "2023-11-07T05:31:56Z"
}{
"code": "AUTH_REQUIRED",
"message": "Authentication required",
"http_status": 401
}{
"code": "AUTH_REQUIRED",
"message": "Authentication required",
"http_status": 401
}{
"code": "AUTH_REQUIRED",
"message": "Authentication required",
"http_status": 401
}{
"code": "AUTH_REQUIRED",
"message": "Authentication required",
"http_status": 401
}Compliance & Anomalies
Resolve Anomaly
Resolve an open anomaly with a resolution type and investigator notes.
POST
/
v1
/
agents
/
{agentId}
/
anomalies
/
{anomalyId}
/
resolve
Resolve Anomaly
curl --request POST \
--url https://api.truthlocks.com/v1/agents/{agentId}/anomalies/{anomalyId}/resolve \
--header 'Content-Type: application/json' \
--header 'X-API-Key: <api-key>' \
--data '
{
"resolution": "<string>",
"notes": "<string>"
}
'import requests
url = "https://api.truthlocks.com/v1/agents/{agentId}/anomalies/{anomalyId}/resolve"
payload = {
"resolution": "<string>",
"notes": "<string>"
}
headers = {
"X-API-Key": "<api-key>",
"Content-Type": "application/json"
}
response = requests.post(url, json=payload, headers=headers)
print(response.text)const options = {
method: 'POST',
headers: {'X-API-Key': '<api-key>', 'Content-Type': 'application/json'},
body: JSON.stringify({resolution: '<string>', notes: '<string>'})
};
fetch('https://api.truthlocks.com/v1/agents/{agentId}/anomalies/{anomalyId}/resolve', options)
.then(res => res.json())
.then(res => console.log(res))
.catch(err => console.error(err));<?php
$curl = curl_init();
curl_setopt_array($curl, [
CURLOPT_URL => "https://api.truthlocks.com/v1/agents/{agentId}/anomalies/{anomalyId}/resolve",
CURLOPT_RETURNTRANSFER => true,
CURLOPT_ENCODING => "",
CURLOPT_MAXREDIRS => 10,
CURLOPT_TIMEOUT => 30,
CURLOPT_HTTP_VERSION => CURL_HTTP_VERSION_1_1,
CURLOPT_CUSTOMREQUEST => "POST",
CURLOPT_POSTFIELDS => json_encode([
'resolution' => '<string>',
'notes' => '<string>'
]),
CURLOPT_HTTPHEADER => [
"Content-Type: application/json",
"X-API-Key: <api-key>"
],
]);
$response = curl_exec($curl);
$err = curl_error($curl);
curl_close($curl);
if ($err) {
echo "cURL Error #:" . $err;
} else {
echo $response;
}package main
import (
"fmt"
"strings"
"net/http"
"io"
)
func main() {
url := "https://api.truthlocks.com/v1/agents/{agentId}/anomalies/{anomalyId}/resolve"
payload := strings.NewReader("{\n \"resolution\": \"<string>\",\n \"notes\": \"<string>\"\n}")
req, _ := http.NewRequest("POST", url, payload)
req.Header.Add("X-API-Key", "<api-key>")
req.Header.Add("Content-Type", "application/json")
res, _ := http.DefaultClient.Do(req)
defer res.Body.Close()
body, _ := io.ReadAll(res.Body)
fmt.Println(string(body))
}HttpResponse<String> response = Unirest.post("https://api.truthlocks.com/v1/agents/{agentId}/anomalies/{anomalyId}/resolve")
.header("X-API-Key", "<api-key>")
.header("Content-Type", "application/json")
.body("{\n \"resolution\": \"<string>\",\n \"notes\": \"<string>\"\n}")
.asString();require 'uri'
require 'net/http'
url = URI("https://api.truthlocks.com/v1/agents/{agentId}/anomalies/{anomalyId}/resolve")
http = Net::HTTP.new(url.host, url.port)
http.use_ssl = true
request = Net::HTTP::Post.new(url)
request["X-API-Key"] = '<api-key>'
request["Content-Type"] = 'application/json'
request.body = "{\n \"resolution\": \"<string>\",\n \"notes\": \"<string>\"\n}"
response = http.request(request)
puts response.read_body{
"anomaly_id": "3c90c3cc-0d44-4b50-8888-8dd25736052a",
"agent_id": "3c90c3cc-0d44-4b50-8888-8dd25736052a",
"anomaly_type": "<string>",
"severity": "low",
"details": {},
"status": "open",
"resolution": "<string>",
"resolved_by": "<string>",
"created_at": "2023-11-07T05:31:56Z",
"resolved_at": "2023-11-07T05:31:56Z"
}{
"code": "AUTH_REQUIRED",
"message": "Authentication required",
"http_status": 401
}{
"code": "AUTH_REQUIRED",
"message": "Authentication required",
"http_status": 401
}{
"code": "AUTH_REQUIRED",
"message": "Authentication required",
"http_status": 401
}{
"code": "AUTH_REQUIRED",
"message": "Authentication required",
"http_status": 401
}Resolves an open behavioral anomaly. The resolution records the investigator’s determination — whether the anomaly was a false positive, was mitigated, represents an accepted risk, or resulted in the agent being revoked.
Resolution events are immutable once recorded. If an anomaly’s resolution needs to be revisited, a new anomaly should be created referencing the original.
Resolution Types
| Resolution | Description | Effect |
|---|---|---|
false_positive | Anomaly was not a genuine threat | Auto-response reversed (agent restored) |
mitigated | Anomaly was genuine and has been addressed | Auto-response remains; agent may be restored manually |
accepted_risk | Anomaly is genuine but accepted per policy | Auto-response reversed; risk documented |
agent_revoked | Anomaly led to permanent agent revocation | Agent remains revoked |
Authentication
string
required
API key with
anomalies:resolve scope. Alternatively, pass a Bearer JWT token
in the Authorization header.string
required
Tenant identifier for multi-tenant isolation.
Path Parameters
string
required
Anomaly identifier (
maip-anom:ULID). Must be in open status.Request
string
required
Resolution determination. Must be one of:
false_positive, mitigated,
accepted_risk, agent_revoked.string
Investigator notes explaining the resolution decision. Stored in the audit
trail.
Response
string
Anomaly identifier.
string
The agent associated with the anomaly.
string
Type of anomaly.
string
Severity level.
string
Updated status:
resolved.string
Resolution determination.
string
Investigator notes.
string
ISO 8601 timestamp of resolution.
string
Operator or API key identifier that resolved the anomaly.
string
ISO 8601 timestamp of original anomaly creation.
Authorizations
API key for machine-to-machine authentication
Path Parameters
Agent identifier
Anomaly identifier
Body
application/json
Response
Anomaly resolved
Available options:
low, medium, high, critical Available options:
open, investigating, resolved, dismissed 
