---
title: "Anomalies"
method: GET
path: "/reporting/anomalies/v1"
tags: ["Endpoints", "Anomalies"]
---

# Anomalies

`GET /reporting/anomalies/v1`

This endpoint provides the same information that is available on the Anomalous Activity page.

## Query parameters

- `after_checkpoint` string
- `limit` integer

## Response `200`

Request was successfully processed

- object
  - `status` integer, required — The HTTP status of the response
  - `has_more` boolean, required — True if there are more anomalies that can be immediately retrieved.
  - `data` Anomaly[], required — Returns the collection of anomalies that have been identified by the system.
    - `id` string, uuid — A UUID identifying this anomaly. Each anomaly has a unqiue identifier.
    - `links` Links — Contains URLs that are associated with this event.
      - `portal_url` string, url, nullable — The address on the portal where further information related to this event can be viewed.
    - `address` string — The email address of the individual that triggered the anomalous activity detection.
    - `severity_label` 'moderate' | 'high' | 'very_high' — The severity classification for the anomalous activity.
    - `anomalous_period_start` string, date-time — The date and time of the start of the period of anomalous activity.
    - `anomalous_period_end` string, date-time — The date and time of the end of the period of anomalous activity.
    - `attachment_count` integer — The total number of attachments that were sent during the anomaly.
    - `trigger_ids` string[] — A trigger ID uniquely identifies an email associated with this anomaly. A list of all related emails is provided. The format of trigger_ids might change in the future. Also note that trigger_ids can be compared for equality but can't be used on their own to order triggers chronologically.
    - `checkpoint` string — Use this value in the 'after_checkpoint' parameter of your next API call, to get back only anomalies that have been created after this one. The format of checkpoints might change in the future. They should not be used for comparing or ordering anomalies.

## Other responses

- `400` — There was a problem with the request
- `401` — There was a problem with the request
- `403` — Invalid token or API is not enabled
- `429` — Rate limited - wait a few seconds and try again
- `500` — Server error
- `503` — Server error
- `504` — Server error

---

[API](https://skmtc.net/tessian/apis/tessian-api.md) · [All operations](https://skmtc.net/tessian/apis/tessian-api/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/tessian/tessian-api/revisions/08762fb51cf0/schema)