Resolve Anomaly
Compliance & Anomalies
Resolve Anomaly
Resolve an open anomaly with a resolution type and investigator notes.
POST
Resolve Anomaly
Resolves an open behavioral anomaly. The resolution records the investigator’s determination — whether the anomaly was a false positive, was mitigated, represents an accepted risk, or resulted in the agent being revoked.
Resolution events are immutable once recorded. If an anomaly’s resolution needs to be revisited, a new anomaly should be created referencing the original.
Resolution Types
Authentication
string
required
API key with
anomalies:resolve scope. Alternatively, pass a Bearer JWT token
in the Authorization header.string
required
Tenant identifier for multi-tenant isolation.
Path Parameters
string
required
Anomaly identifier (
maip-anom:ULID). Must be in open status.Request
string
required
Resolution determination. Must be one of:
false_positive, mitigated,
accepted_risk, agent_revoked.string
Investigator notes explaining the resolution decision. Stored in the audit
trail.
Response
string
Anomaly identifier.
string
The agent associated with the anomaly.
string
Type of anomaly.
string
Severity level.
string
Updated status:
resolved.string
Resolution determination.
string
Investigator notes.
string
ISO 8601 timestamp of resolution.
string
Operator or API key identifier that resolved the anomaly.
string
ISO 8601 timestamp of original anomaly creation.
Authorizations
API key for machine-to-machine authentication
Path Parameters
Agent identifier
Anomaly identifier
Body
application/json
Response
Anomaly resolved
Available options:
low, medium, high, critical Available options:
open, investigating, resolved, dismissed 
