get-anomaly

dci get-anomaly id

Returns the specified anomaly.

Output

OK - Anomaly returned.

By default dci renders the result as a table. Use --output json to get the full structure described below — see Output formats.

Field	Type	Description
attribution	string	Attribution ID
billingAccount	string	Billing account ID
costOfAnomaly	number (double)	The difference between the actual cost and the maximum cost in the normal range.
actualCost	number (double)	Observed (actual) cost of the anomaly.
expectedMaxCost	number (double)	Maximum cost within the expected normal range.
platform	string	Cloud Provider name
scope	string	Scope: Project or Account
serviceName	string	Service name
severityLevel	string	Severity level: information, warning, or critical.
startTime	integer (int64)	Usage start time of the anomaly
endTime	integer	End of the anomaly
deactivationReason	string	Why the anomaly stopped being active. reverted means the cost returned inside the expected normal range; expired means the anomaly was deactivated without the cost returning inside that range; unknown means the reason could not be determined. Null while the anomaly is still active. One of: "reverted", "expired", "unknown".
timeFrame	string	Timeframe: Daily or Hourly
top3SKUs	array of object	Array of SKU entries contributing to an anomaly.
top3SKUs[].cost	number (double)
top3SKUs[].name	string
resourceData	array of object	Array of resources contributing to an anomaly.
resourceData[].cost	number (double)
resourceData[].resourceId	string
resourceData[].skuDescription	string
resourceData[].operation	string	For anomalies related to AWS S3
resourceData[].labels	array of object	Labels (also known as cost-allocation tags) present on this resource during the anomaly; each entry reports the label's key, its value, and the resource's cost tagged with that key/value pair. Cloud providers use different names for the same concept; GCP uses "labels", AWS uses "cost-allocation tags", and Azure uses "tags". We refer to all of these as labels.
resourceData[].labels[].key	string	The label/tag key.
resourceData[].labels[].value	string	The label/tag value.
resourceData[].labels[].cost	number (double)	The resource's cost tagged with this key/value pair; typically equal to the resource's cost, since labels/tags usually cover all of its spend.
status	string	One of: "active", "inactive".
acknowledged	boolean	Has the anomaly been acknowledged
acknowledgedAt	string (date-time)	When the anomaly was first acknowledged
acknowledgedBy	string	Email of the user who first acknowledged the anomaly
notifications	array of object	Chronologically ordered notification dispatch events.
notifications[].timestamp	string (date-time)	Dispatch timestamp in RFC3339 UTC.
notifications[].channel	string	Dispatch channel. One of: "email", "slack", "msteams".

Raw JSON schema

{
  "required": [
    "attribution",
    "billingAccount",
    "costOfAnomaly",
    "platform",
    "scope",
    "serviceName",
    "severityLevel",
    "startTime",
    "timeFrame",
    "top3SKUs",
    "notifications"
  ],
  "type": "object",
  "properties": {
    "attribution": {
      "type": "string",
      "description": "Attribution ID"
    },
    "billingAccount": {
      "type": "string",
      "description": "Billing account ID"
    },
    "costOfAnomaly": {
      "type": "number",
      "description": "The difference between the actual cost and the maximum cost in the normal range.",
      "format": "double"
    },
    "actualCost": {
      "type": "number",
      "format": "double",
      "nullable": true,
      "description": "Observed (actual) cost of the anomaly."
    },
    "expectedMaxCost": {
      "type": "number",
      "format": "double",
      "nullable": true,
      "description": "Maximum cost within the expected normal range."
    },
    "platform": {
      "type": "string",
      "description": "Cloud Provider name"
    },
    "scope": {
      "type": "string",
      "description": "Scope: Project or Account"
    },
    "serviceName": {
      "type": "string",
      "description": "Service name"
    },
    "severityLevel": {
      "type": "string",
      "description": "Severity level: `information`, `warning`, or `critical`."
    },
    "startTime": {
      "type": "integer",
      "description": "Usage start time of the anomaly",
      "format": "int64"
    },
    "endTime": {
      "type": "integer",
      "nullable": true,
      "description": "End of the anomaly"
    },
    "deactivationReason": {
      "type": "string",
      "nullable": true,
      "description": "Why the anomaly stopped being active. `reverted` means the cost returned inside the expected normal range; `expired` means the anomaly was deactivated without the cost returning inside that range; `unknown` means the reason could not be determined. Null while the anomaly is still active.",
      "enum": [
        "reverted",
        "expired",
        "unknown"
      ]
    },
    "timeFrame": {
      "type": "string",
      "description": "Timeframe: Daily or Hourly"
    },
    "top3SKUs": {
      "type": "array",
      "description": "Array of SKU entries contributing to an anomaly.",
      "items": {
        "type": "object",
        "description": "SKU-level information contributing to an anomaly.",
        "properties": {
          "cost": {
            "type": "number",
            "format": "double"
          },
          "name": {
            "type": "string"
          }
        }
      }
    },
    "resourceData": {
      "type": "array",
      "description": "Array of resources contributing to an anomaly.",
      "items": {
        "type": "object",
        "description": "Resource-specific contribution to an anomaly.",
        "properties": {
          "cost": {
            "type": "number",
            "format": "double"
          },
          "resourceId": {
            "type": "string"
          },
          "skuDescription": {
            "type": "string"
          },
          "operation": {
            "description": "For anomalies related to AWS S3",
            "type": "string"
          },
          "labels": {
            "type": "array",
            "description": "Labels (also known as cost-allocation tags) present on this resource during the anomaly; each entry reports the label's key, its value, and the resource's cost tagged with that key/value pair.\nCloud providers use different names for the same concept; GCP uses \"labels\", AWS uses \"cost-allocation tags\", and Azure uses \"tags\". We refer to all of these as labels.",
            "items": {
              "type": "object",
              "description": "A single label (a.k.a. cost-allocation tag) on the resource, paired with the resource's cost tagged with this key/value pair.",
              "properties": {
                "key": {
                  "type": "string",
                  "description": "The label/tag key."
                },
                "value": {
                  "type": "string",
                  "description": "The label/tag value."
                },
                "cost": {
                  "type": "number",
                  "format": "double",
                  "description": "The resource's cost tagged with this key/value pair; typically equal to the resource's cost, since labels/tags usually cover all of its spend."
                }
              }
            }
          }
        }
      }
    },
    "status": {
      "type": "string",
      "nullable": true,
      "enum": [
        "active",
        "inactive"
      ]
    },
    "acknowledged": {
      "description": "Has the anomaly been acknowledged",
      "type": "boolean"
    },
    "acknowledgedAt": {
      "description": "When the anomaly was first acknowledged",
      "type": "string",
      "format": "date-time",
      "nullable": true
    },
    "acknowledgedBy": {
      "description": "Email of the user who first acknowledged the anomaly",
      "type": "string",
      "nullable": true
    },
    "notifications": {
      "type": "array",
      "description": "Chronologically ordered notification dispatch events.",
      "items": {
        "type": "object",
        "description": "A successful notification dispatch for an anomaly.\nThis records that the API/worker sent the notification, not that delivery was confirmed.",
        "required": [
          "timestamp",
          "channel"
        ],
        "properties": {
          "timestamp": {
            "type": "string",
            "format": "date-time",
            "description": "Dispatch timestamp in RFC3339 UTC."
          },
          "channel": {
            "type": "string",
            "description": "Dispatch channel.",
            "enum": [
              "email",
              "slack",
              "msteams"
            ]
          }
        }
      }
    }
  }
}

Errors

On failure, dci prints a single error message — with a hint when one is available — and exits with a typed code your scripts can branch on. See Errors and exit codes for the full contract.

HTTP status	Exit code	Error code	Meaning
400	30	VALIDATION_ERROR	The arguments or request body were rejected. Review the command's flags and payload.
401	10	AUTHENTICATION_FAILED	Not signed in, or the API token is invalid. Run dci login or check DCI_API_KEY.
403	11	PERMISSION_DENIED	The DoiT user or the active customer context does not have access.
404	20	RESOURCE_NOT_FOUND	The requested resource does not exist. Check the identifier argument.

Aliases: getanomaly