Listing all anomalies of the organisation

Note

The anomalies feature must be enabled for the organisation. When it is disabled, the endpoint responds with the status code 403.

Note

SOC accounts cannot call this endpoint with a personal access token. Use the access via the web application (session authentication) instead.

Sends a GET request to the endpoint /anomalies.

Description

The List-Anomalies request allows you to request a paginated list of all historical anomalies of the organisation.

Requirements

Values of the request: none

Objects: none

Request

To request a list of all anomalies, no additional information needs to be added to the path of the request. To paginate, sort, and filter the list, you can append the following optional query parameters:

Attributes	Description	Values
page	The page to return.	integer, minimum 1, default 1
perPage	The number of anomalies per page.	integer, 1 to 100, default 10
orderBy	The attribute to sort by.	started_at, last_updated_at, ended_at, status, cidr, types, default started_at
orderDir	The sort direction.	asc, desc, default desc
search	The free-text search over the cidr, status, and types attributes.	string
status	Only returns anomalies with this status.	OPEN, UPDATE, CLOSED
type	Only returns anomalies that contain this type.	VOLUMETRIC, PROTOCOL, AMPLIFICATION

As a result, you get one or more objects AnomalyVO with the requested information.

The object provides the following information:

Attributes	Description	Values
id	The ID of the anomaly.	string
cidr	The network or single IP address affected by the anomaly, in CIDR notation.	string
types	The detected anomaly types. An anomaly can carry more than one type.	VOLUMETRIC, PROTOCOL, AMPLIFICATION
status	The status of the anomaly.	OPEN, UPDATE, CLOSED
started_at	The date and time when the anomaly started in ISO 8601 format.	string($date-time)
last_updated_at	The date and time when the anomaly was last updated in ISO 8601 format.	string($date-time)
ended_at	The date and time when the anomaly ended in ISO 8601 format. While the anomaly is ongoing, the value is null.	string($date-time)
metadata	Additional details about the anomaly, provided as a list of key-value entries.	array

Note

Metadata entries flagged as private by the detecting system are never returned. The metadata attribute only contains public entries.

Example

Example response:

{
  "data": [
    {
      "id": "aB3xY9",
      "cidr": "203.0.113.0/24",
      "types": [
        "VOLUMETRIC"
      ],
      "status": "OPEN",
      "started_at": "2026-01-01T00:00:00+00:00",
      "last_updated_at": "2026-01-01T00:15:00+00:00",
      "ended_at": null,
      "metadata": [
        {
          "key": "attack_vector",
          "value": "UDP_Reflection"
        }
      ]
    }
  ]
}

Responses

The following responses are available:

STATUS CODE	DESCRIPTION
200	The request has succeeded.
401	The request has not succeeded because the user authentication was incorrect.
403	The request has not succeeded because the user does not have the right permissions.
422	The request was unsuccessful because the submitted data could not be processed.