> ## Documentation Index
> Fetch the complete documentation index at: https://docs.truthlocks.com/llms.txt
> Use this file to discover all available pages before exploring further.
# Resolve Anomaly
> Resolve an open anomaly with a resolution type and investigator notes.
Resolves an open behavioral anomaly. The resolution records the investigator's determination -- whether the anomaly was a false positive, was mitigated, represents an accepted risk, or resulted in the agent being revoked.
Resolution events are immutable once recorded. If an anomaly's resolution needs to be revisited, a new anomaly should be created referencing the original.
### Resolution Types
| Resolution | Description | Effect |
| :--------------- | :----------------------------------------- | :---------------------------------------------------- |
| `false_positive` | Anomaly was not a genuine threat | Auto-response reversed (agent restored) |
| `mitigated` | Anomaly was genuine and has been addressed | Auto-response remains; agent may be restored manually |
| `accepted_risk` | Anomaly is genuine but accepted per policy | Auto-response reversed; risk documented |
| `agent_revoked` | Anomaly led to permanent agent revocation | Agent remains revoked |
### Authentication
API key with `anomalies:resolve` scope. Alternatively, pass a Bearer JWT token
in the `Authorization` header.
Tenant identifier for multi-tenant isolation.
### Path Parameters
Anomaly identifier (`maip-anom:ULID`). Must be in `open` status.
### Request
Resolution determination. Must be one of: `false_positive`, `mitigated`,
`accepted_risk`, `agent_revoked`.
Investigator notes explaining the resolution decision. Stored in the audit
trail.
### Response
Anomaly identifier.
The agent associated with the anomaly.
Type of anomaly.
Severity level.
Updated status: `resolved`.
Resolution determination.
Investigator notes.
ISO 8601 timestamp of resolution.
Operator or API key identifier that resolved the anomaly.
ISO 8601 timestamp of original anomaly creation.
## OpenAPI
````yaml mint-openapi.yaml POST /v1/agents/{agentId}/anomalies/{anomalyId}/resolve
openapi: 3.0.3
info:
title: Truthlocks API
description: >
Truthlocks is a universal verification infrastructure for documents,
credentials, and digital assets.
This specification defines the canonical API for interacting with Truthlocks
services.
## Base URLs
- **Production**: `https://api.truthlocks.com`
- **Sandbox**: `https://sandbox-api.truthlocks.com`
## Authentication
- **API Keys**: Use `X-API-Key` header for machine-to-machine operations
- **Bearer Tokens**: Use `Authorization: Bearer ` for user-initiated
operations
## Tenant Identity
In production, tenant identity is derived from the authenticated context
(API key or JWT).
The `X-Tenant-ID` header is ignored in production to prevent spoofing.
version: 1.0.0
contact:
name: Truthlocks Support
url: https://truthlocks.com/support
email: support@truthlocks.com
servers:
- url: https://api.truthlocks.com
description: Production API
- url: https://sandbox-api.truthlocks.com
description: Sandbox Environment
security:
- APIKey: []
tags:
- name: Authentication
description: API key and token management
- name: Issuers
description: Issuer registration and trust management
- name: Keys
description: Cryptographic key management for issuers
- name: Attestations
description: Attestation lifecycle (mint, revoke, supersede)
- name: Verification
description: Attestation verification and proof bundles
- name: Governance
description: Issuer governance workflows (admin only)
- name: Identity
description: Organization, user, and role management
- name: Audit
description: Audit event queries
- name: Platform
description: Platform administration (super admin only)
- name: Platform Review
description: Staff review workflows for issuer applications
- name: Tenant Console
description: Tenant profile and lifecycle endpoints
- name: Health
description: Service health and readiness endpoints
- name: Risk
description: Risk signal ingestion and fraud detection
- name: Risk Enforcement
description: Risk enforcement actions — block, challenge, quarantine, and configuration
- name: Billing
description: Billing, subscription, and addon management
- name: Machine Identity
description: >-
Machine Agent Identity Protocol (MAIP) — agent registration, sessions,
trust, witness, compliance, orchestration, and observability
externalDocs:
description: Transparency read-only API (separate service spec)
url: >-
https://github.com/truthlocks/truthlock/blob/main/docs/transparency/openapi.yaml
paths:
/v1/agents/{agentId}/anomalies/{anomalyId}/resolve:
post:
tags:
- Machine Identity
summary: Resolve Anomaly
description: Marks an anomaly as resolved with a resolution description.
operationId: maip.anomalies.resolve
parameters:
- name: agentId
in: path
required: true
schema:
type: string
format: uuid
description: Agent identifier
- name: anomalyId
in: path
required: true
schema:
type: string
format: uuid
description: Anomaly identifier
requestBody:
required: true
content:
application/json:
schema:
type: object
required:
- resolution
properties:
resolution:
type: string
description: >-
Resolution type (false_positive, mitigated, accepted_risk,
agent_revoked)
notes:
type: string
description: Investigator notes explaining the resolution decision
responses:
'200':
description: Anomaly resolved
content:
application/json:
schema:
$ref: '#/components/schemas/MaipAnomaly'
'400':
description: Validation error
content:
application/json:
schema:
$ref: '#/components/schemas/ErrorEnvelope'
'401':
description: Authentication required
content:
application/json:
schema:
$ref: '#/components/schemas/ErrorEnvelope'
'404':
description: Anomaly not found
content:
application/json:
schema:
$ref: '#/components/schemas/ErrorEnvelope'
'429':
description: Rate limit exceeded
content:
application/json:
schema:
$ref: '#/components/schemas/ErrorEnvelope'
security:
- APIKey: []
components:
schemas:
MaipAnomaly:
type: object
properties:
anomaly_id:
type: string
format: uuid
agent_id:
type: string
format: uuid
anomaly_type:
type: string
severity:
type: string
enum:
- low
- medium
- high
- critical
details:
type: object
additionalProperties: true
status:
type: string
enum:
- open
- investigating
- resolved
- dismissed
resolution:
type: string
resolved_by:
type: string
created_at:
type: string
format: date-time
resolved_at:
type: string
format: date-time
ErrorEnvelope:
type: object
required:
- code
- message
- http_status
properties:
code:
type: string
description: Machine-readable error code
enum:
- AUTH_REQUIRED
- AUTH_INVALID
- PERMISSION_DENIED
- TENANT_IDENTITY_UNVERIFIED
- NOT_FOUND
- VALIDATION_ERROR
- CONFLICT
- PAYLOAD_TOO_LARGE
- RATE_LIMIT_EXCEEDED
- QUOTA_EXCEEDED
- SERVICE_UNAVAILABLE
- INTERNAL_ERROR
message:
type: string
description: Human-readable error message
http_status:
type: integer
description: HTTP status code
retry_after_ms:
type: integer
description: Milliseconds to wait before retrying (for rate limits)
details:
type: object
description: Additional error context
example:
code: AUTH_REQUIRED
message: Authentication required
http_status: 401
securitySchemes:
APIKey:
type: apiKey
in: header
name: X-API-Key
description: API key for machine-to-machine authentication
````