Skip to main content
POST
Resolve Anomaly
Resolves an open behavioral anomaly. The resolution records the investigator’s determination — whether the anomaly was a false positive, was mitigated, represents an accepted risk, or resulted in the agent being revoked. Resolution events are immutable once recorded. If an anomaly’s resolution needs to be revisited, a new anomaly should be created referencing the original.

Resolution Types

Authentication

string
required
API key with anomalies:resolve scope. Alternatively, pass a Bearer JWT token in the Authorization header.
string
required
Tenant identifier for multi-tenant isolation.

Path Parameters

string
required
Anomaly identifier (maip-anom:ULID). Must be in open status.

Request

string
required
Resolution determination. Must be one of: false_positive, mitigated, accepted_risk, agent_revoked.
string
Investigator notes explaining the resolution decision. Stored in the audit trail.

Response

string
Anomaly identifier.
string
The agent associated with the anomaly.
string
Type of anomaly.
string
Severity level.
string
Updated status: resolved.
string
Resolution determination.
string
Investigator notes.
string
ISO 8601 timestamp of resolution.
string
Operator or API key identifier that resolved the anomaly.
string
ISO 8601 timestamp of original anomaly creation.

Authorizations

X-API-Key
string
header
required

API key for machine-to-machine authentication

Path Parameters

agentId
string<uuid>
required

Agent identifier

anomalyId
string<uuid>
required

Anomaly identifier

Body

application/json
resolution
string
required

Resolution type (false_positive, mitigated, accepted_risk, agent_revoked)

notes
string

Investigator notes explaining the resolution decision

Response

Anomaly resolved

anomaly_id
string<uuid>
agent_id
string<uuid>
anomaly_type
string
severity
enum<string>
Available options:
low,
medium,
high,
critical
details
object
status
enum<string>
Available options:
open,
investigating,
resolved,
dismissed
resolution
string
resolved_by
string
created_at
string<date-time>
resolved_at
string<date-time>