---
title: "List cost anomalies"
method: GET
path: "/api/v2/cost/anomalies"
tags: ["Cloud Cost Management"]
---

# List cost anomalies

`GET /api/v2/cost/anomalies`

List detected Cloud Cost Management anomalies for the organization.

## Query parameters

- `start` integer
- `end` integer
- `filter` string
- `min_anomalous_threshold` string
- `min_cost_threshold` string
- `dismissal_cause` string
- `order_by` string
- `order` string
- `limit` integer
- `offset` integer
- `provider_ids` string[]

## Response `200`

OK

- CostAnomaliesResponse — Response object containing a list of detected Cloud Cost Management anomalies and aggregated totals.
  - `data` CostAnomaliesResponseData — Resource wrapper for the list of cost anomalies and aggregated totals.
    - `attributes` CostAnomaliesResponseDataAttributes, required — Cost anomaly results and aggregated totals for the queried window.
      - `anomalies` CostAnomaly[], required — The list of cost anomalies that match the request.
        - `actual_cost` number, double, required — Actual cost incurred during the anomaly window.
        - `anomalous_cost_change` number, double, required — Anomalous cost change relative to the expected baseline.
        - `anomaly_end` integer, required — Anomaly end timestamp in Unix milliseconds.
        - `anomaly_start` integer, required — Anomaly start timestamp in Unix milliseconds.
        - `correlated_tags` CostAnomalyCorrelatedTags, nullable, required — Map of correlated tag keys to the list of correlated tag values.
        - `dimensions` CostAnomalyDimensions, required — Map of cost dimension keys to their values for the anomaly grouping.
        - `dismissal` CostAnomalyDismissal — Resolution metadata for an anomaly that has been dismissed.
          - `cause` string, required — Reason the anomaly was dismissed.
          - `dismissal_id` string, required — Unique identifier of the dismissal record.
          - `message` string, required — Optional message explaining the dismissal.
          - `updated_at` integer, required — Timestamp of the last dismissal update in Unix milliseconds.
          - `updated_by` string, required — Identifier of the user that last updated the dismissal.
        - `max_cost` number, double, required — Maximum cost observed during the anomaly window.
        - `provider` string, required — Cloud or SaaS provider associated with the anomaly (for example `aws`, `gcp`, `azure`).
        - `query` string, required — The metrics query that detected the anomaly.
        - `uuid` string, required — The unique identifier of the anomaly.
      - `avg_daily_anomalous_cost` number, double, required — Average daily anomalous cost change across the queried window.
      - `total_actual_cost` number, double, required — Total actual cost spent across the queried window for the matching providers.
      - `total_anomalous_cost` number, double, required — Sum of the anomalous cost change across all returned anomalies.
      - `total_count` integer, required — Total number of anomalies that match the request.
    - `id` string, required — Static identifier of the cost anomalies collection resource.
    - `type` 'anomalies', required — Type of the cost anomalies collection resource. Must be `anomalies`.

## Other responses

- `400` — Bad Request
- `403` — Forbidden
- `429` — Too many requests

---

[API](https://skmtc.net/datadog/apis/api-v2.md) · [All operations](https://skmtc.net/datadog/apis/api-v2/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/datadog/api-v2/revisions/da68bf029e4c/schema)