Listing all anomalies of the organisation¶

Note

Metadata entries flagged as private by the detecting system are never returned. The metadata attribute only contains public entries.

Note

SOC accounts cannot call this endpoint with a personal access token. Access anomalies through the web application (session authentication) instead.

Note

The anomalies feature must be enabled for the organisation. When it is disabled, the endpoint responds with 403 Unauthorized.

Sends a GET request to the endpoint /anomalies.

Description¶

The List-Anomalies request allows the user to request a paginated list of all historical anomalies of the organisation.

Requirements¶

Values of the request: none

Objects: none

Request¶

To request a list of all anomalies, no additional information is required in the path of the request.

The following query parameters are optional:

Attributes	Description	Values
`page`	The page to return.	Default: `1` Minimum value: `1`
`perPage`	The number of anomalies per page.	Default: `10` Available values: `1` to `100`
`orderBy`	The attribute to sort by.	Default: `started_at` Available values: `started_at` `last_updated_at` `ended_at` `status` `cidr` `types`
`orderDir`	The sort direction.	Default: `desc` Available values: `asc` `desc`
`search`	The free-text search over the `cidr`, `status`, and `types` attributes.	`string`
`status`	Only returns anomalies with this lifecycle status.	`OPEN` `UPDATE` `CLOSED`
`type`	Only returns anomalies that contain this type.	`VOLUMETRIC` `PROTOCOL` `AMPLIFICATION`

As a result, the user gets one or more objects AnomalyVO with the requested information.

The object provides the following information:

Attributes	Description	Values
`id`	The ID of the anomaly.	`string`
`cidr`	The network or single IP address affected by the anomaly, in CIDR notation.	`string`
`types`	The detected anomaly types. An anomaly can carry more than one type.	`VOLUMETRIC` `PROTOCOL` `AMPLIFICATION`
`status`	The lifecycle status of the anomaly.	`OPEN` `UPDATE` `CLOSED`
`started_at`	The date and time when the anomaly started in ISO 8601 format.	`string($date-time)`
`last_updated_at`	The date and time when the anomaly was last updated in ISO 8601 format.	`string($date-time)`
`ended_at`	The date and time when the anomaly ended in ISO 8601 format; `null` while the anomaly is ongoing.	`string($date-time)`
`metadata`	Additional details about the anomaly, provided as a list of key-value entries.	`array`

Example¶

Example response:

{
  "data": [
    {
      "id": "aB3xY9",
      "cidr": "XXX.XXX.XXX.XXX/24",
      "types": [
        "VOLUMETRIC"
      ],
      "status": "OPEN",
      "started_at": "2026-01-01T00:00:00+00:00",
      "last_updated_at": "2026-01-01T00:00:00+00:00",
      "ended_at": null,
      "metadata": [
        {
          "key": "attack_vector",
          "value": "UDP_Reflection"
        }
      ]
    }
  ],
  "links": {
    "first": "https://datahub-api.com/api/anomalies?page=1",
    "last": "https://datahub-api.com/api/anomalies?page=5",
    "prev": null,
    "next": "https://datahub-api.com/api/anomalies?page=2"
  },
  "meta": {
    "current_page": 1,
    "from": 1,
    "last_page": 5,
    "links": [
      {
        "url": "https://datahub-api.com/api/anomalies?page=2",
        "label": "Next »",
        "active": false
      }
    ],
    "path": "https://datahub-api.com/api/anomalies",
    "per_page": 10,
    "to": 10,
    "total": 64
  }
}

Responses¶

The following responses are available:

STATUS CODE	DESCRIPTION
200	The request has succeeded.
401	The request has not succeeded because the user authentication was incorrect.
403	The request has not succeeded because the user does not have the right permissions.
422	The request was unsuccessful because the submitted data could not be processed.