get-anomaly

dci get-anomaly id

Returns the specified anomaly.

Output

OK - Anomaly returned.

By default dci renders the result as a table. Use --output json to get the full structure described below — see Output formats.

Field	Type	Description
`attribution`	string	Attribution ID
`billingAccount`	string	Billing account ID
`costOfAnomaly`	number (double)	The difference between the actual cost and the maximum cost in the normal range.
`actualCost`	number (double)	Observed (actual) cost of the anomaly.
`expectedMaxCost`	number (double)	Maximum cost within the expected normal range.
`platform`	string	Cloud Provider name
`scope`	string	The anomaly's project or account identifier as reported by the provider. For providers whose billing grain is not a cloud project — a user or an organization, for example — this is that identifier, so treat it as an opaque id and use `entityLabel`/`entityName` for presentation.
`entityLabel`	string	Connector-declared name for what `scope` identifies, for example "Project", "Account" or "User". Absent when the provider publishes no display profile.
`entityName`	string	Human-readable value for `scope` when the provider publishes one — for example a user's email address where `scope` is an opaque user id. Absent when unavailable.
`providerDisplayName`	string	Connector-declared display name for the provider, for example "Anthropic (Analytics API)". Absent when the provider publishes no display profile.
`serviceName`	string	Service name
`severityLevel`	string	Severity level: `information`, `warning`, or `critical`.
`startTime`	integer (int64)	Usage start time of the anomaly
`endTime`	integer	End of the anomaly
`deactivationReason`	string	Why the anomaly stopped being active. `reverted` means the cost returned inside the expected normal range; `expired` means the anomaly was deactivated without the cost returning inside that range; `unknown` means the reason could not be determined. Null while the anomaly is still active. One of: `"reverted"`, `"expired"`, `"unknown"`.
`timeFrame`	string	Timeframe: Daily or Hourly
`top3SKUs`	array of object	Array of SKU entries contributing to an anomaly.
`top3SKUs[].cost`	number (double)
`top3SKUs[].name`	string
`monitorLevel`	string	Whether the anomaly was detected on a single SKU (`sku`) or at the level of a whole service (`service`). One of: `"service"`, `"sku"`.
`resourceData`	array of object	Array of resources contributing to an anomaly.
`resourceData[].cost`	number (double)
`resourceData[].resourceId`	string
`resourceData[].skuDescription`	string
`resourceData[].operation`	string	For anomalies related to AWS S3
`resourceData[].labels`	array of object	Labels (also known as cost-allocation tags) present on this resource during the anomaly; each entry reports the label's key, its value, and the resource's cost tagged with that key/value pair. Cloud providers use different names for the same concept; GCP uses "labels", AWS uses "cost-allocation tags", and Azure uses "tags". We refer to all of these as labels.
`resourceData[].labels[].key`	string	The label/tag key.
`resourceData[].labels[].value`	string	The label/tag value.
`resourceData[].labels[].cost`	number (double)	The resource's cost tagged with this key/value pair; typically equal to the resource's cost, since labels/tags usually cover all of its spend.
`status`	string	One of: `"active"`, `"inactive"`.
`acknowledged`	boolean	Has the anomaly been acknowledged
`acknowledgedAt`	string (date-time)	When the anomaly was first acknowledged
`acknowledgedBy`	string	Email of the user who first acknowledged the anomaly
`notifications`	array of object	Chronologically ordered notification dispatch events.
`notifications[].timestamp`	string (date-time)	Dispatch timestamp in RFC3339 UTC.
`notifications[].channel`	string	Dispatch channel. One of: `"email"`, `"slack"`, `"msteams"`.
`linkedAnomalies`	array of string	IDs of the other related anomalies in the same service around same time. Always the complete group: the filters, time window, and pagination of the request that returned this anomaly do not narrow it, so an ID here may not appear among the anomalies of that same response.

Raw JSON schema

{
  "required": [
    "attribution",
    "billingAccount",
    "costOfAnomaly",
    "platform",
    "scope",
    "serviceName",
    "severityLevel",
    "startTime",
    "timeFrame",
    "top3SKUs",
    "monitorLevel",
    "notifications"
  ],
  "type": "object",
  "properties": {
    "attribution": {
      "type": "string",
      "description": "Attribution ID"
    },
    "billingAccount": {
      "type": "string",
      "description": "Billing account ID"
    },
    "costOfAnomaly": {
      "type": "number",
      "description": "The difference between the actual cost and the maximum cost in the normal range.",
      "format": "double"
    },
    "actualCost": {
      "type": "number",
      "format": "double",
      "nullable": true,
      "description": "Observed (actual) cost of the anomaly."
    },
    "expectedMaxCost": {
      "type": "number",
      "format": "double",
      "nullable": true,
      "description": "Maximum cost within the expected normal range."
    },
    "platform": {
      "type": "string",
      "description": "Cloud Provider name"
    },
    "scope": {
      "type": "string",
      "description": "The anomaly's project or account identifier as reported by the provider. For providers whose billing grain is not a cloud project — a user or an organization, for example — this is that identifier, so treat it as an opaque id and use `entityLabel`/`entityName` for presentation."
    },
    "entityLabel": {
      "type": "string",
      "description": "Connector-declared name for what `scope` identifies, for example \"Project\", \"Account\" or \"User\". Absent when the provider publishes no display profile."
    },
    "entityName": {
      "type": "string",
      "description": "Human-readable value for `scope` when the provider publishes one — for example a user's email address where `scope` is an opaque user id. Absent when unavailable."
    },
    "providerDisplayName": {
      "type": "string",
      "description": "Connector-declared display name for the provider, for example \"Anthropic (Analytics API)\". Absent when the provider publishes no display profile."
    },
    "serviceName": {
      "type": "string",
      "description": "Service name"
    },
    "severityLevel": {
      "type": "string",
      "description": "Severity level: `information`, `warning`, or `critical`."
    },
    "startTime": {
      "type": "integer",
      "description": "Usage start time of the anomaly",
      "format": "int64"
    },
    "endTime": {
      "type": "integer",
      "nullable": true,
      "description": "End of the anomaly"
    },
    "deactivationReason": {
      "type": "string",
      "nullable": true,
      "description": "Why the anomaly stopped being active. `reverted` means the cost returned inside the expected normal range; `expired` means the anomaly was deactivated without the cost returning inside that range; `unknown` means the reason could not be determined. Null while the anomaly is still active.",
      "enum": [
        "reverted",
        "expired",
        "unknown"
      ]
    },
    "timeFrame": {
      "type": "string",
      "description": "Timeframe: Daily or Hourly"
    },
    "top3SKUs": {
      "type": "array",
      "description": "Array of SKU entries contributing to an anomaly.",
      "items": {
        "type": "object",
        "description": "SKU-level information contributing to an anomaly.",
        "properties": {
          "cost": {
            "type": "number",
            "format": "double"
          },
          "name": {
            "type": "string"
          }
        }
      }
    },
    "monitorLevel": {
      "type": "string",
      "description": "Whether the anomaly was detected on a single SKU (`sku`) or at the level of a whole service (`service`).",
      "enum": [
        "service",
        "sku"
      ]
    },
    "resourceData": {
      "type": "array",
      "description": "Array of resources contributing to an anomaly.",
      "items": {
        "type": "object",
        "description": "Resource-specific contribution to an anomaly.",
        "properties": {
          "cost": {
            "type": "number",
            "format": "double"
          },
          "resourceId": {
            "type": "string"
          },
          "skuDescription": {
            "type": "string"
          },
          "operation": {
            "description": "For anomalies related to AWS S3",
            "type": "string"
          },
          "labels": {
            "type": "array",
            "description": "Labels (also known as cost-allocation tags) present on this resource during the anomaly; each entry reports the label's key, its value, and the resource's cost tagged with that key/value pair.\nCloud providers use different names for the same concept; GCP uses \"labels\", AWS uses \"cost-allocation tags\", and Azure uses \"tags\". We refer to all of these as labels.",
            "items": {
              "type": "object",
              "description": "A single label (a.k.a. cost-allocation tag) on the resource, paired with the resource's cost tagged with this key/value pair.",
              "properties": {
                "key": {
                  "type": "string",
                  "description": "The label/tag key."
                },
                "value": {
                  "type": "string",
                  "description": "The label/tag value."
                },
                "cost": {
                  "type": "number",
                  "format": "double",
                  "description": "The resource's cost tagged with this key/value pair; typically equal to the resource's cost, since labels/tags usually cover all of its spend."
                }
              }
            }
          }
        }
      }
    },
    "status": {
      "type": "string",
      "nullable": true,
      "enum": [
        "active",
        "inactive"
      ]
    },
    "acknowledged": {
      "description": "Has the anomaly been acknowledged",
      "type": "boolean"
    },
    "acknowledgedAt": {
      "description": "When the anomaly was first acknowledged",
      "type": "string",
      "format": "date-time",
      "nullable": true
    },
    "acknowledgedBy": {
      "description": "Email of the user who first acknowledged the anomaly",
      "type": "string",
      "nullable": true
    },
    "notifications": {
      "type": "array",
      "description": "Chronologically ordered notification dispatch events.",
      "items": {
        "type": "object",
        "description": "A successful notification dispatch for an anomaly.\nThis records that the API/worker sent the notification, not that delivery was confirmed.",
        "required": [
          "timestamp",
          "channel"
        ],
        "properties": {
          "timestamp": {
            "type": "string",
            "format": "date-time",
            "description": "Dispatch timestamp in RFC3339 UTC."
          },
          "channel": {
            "type": "string",
            "description": "Dispatch channel.",
            "enum": [
              "email",
              "slack",
              "msteams"
            ]
          }
        }
      }
    },
    "linkedAnomalies": {
      "type": "array",
      "description": "IDs of the other related anomalies in the same service around same time. Always the complete group: the filters, time window, and pagination of the request that returned this anomaly do not narrow it, so an ID here may not appear among the anomalies of that same response.",
      "items": {
        "type": "string"
      }
    }
  }
}

Errors

On failure, dci prints a single error message — with a hint when one is available — and exits with a typed code your scripts can branch on. See Errors and exit codes for the full contract.

HTTP status	Exit code	Error code	Meaning
400	30	`VALIDATION_ERROR`	The arguments or request body were rejected. Review the command's flags and payload.
401	10	`AUTHENTICATION_FAILED`	Not signed in, or the API token is invalid. Run `dci login` or check `DCI_API_KEY`.
403	11	`PERMISSION_DENIED`	The DoiT user or the active customer context does not have access.
404	20	`RESOURCE_NOT_FOUND`	The requested resource does not exist. Check the identifier argument.

Aliases: getanomaly

Output​

Errors​

Output

Errors