get-anomaly-explanation

dci get-anomaly-explanation <id>

Returns a likely-cause explanation for the specified anomaly, alongside the deterministic facts and evidence references it was generated from. The explanation itself is AI-generated; it is always returned separately from the deterministic facts, and is marked as such in the explanation object. Generation is ephemeral: no conversation is persisted on your behalf.

• id — A unique identifier of the anomaly.

Output

OK - Anomaly explanation returned.

By default dci renders the result as a table. Use --output json to get the full structure described below — see Output formats.

Field	Type	Description
facts	object	Deterministic facts about the anomaly, not AI-generated.
facts.serviceName	string	Service name
facts.platform	string	Cloud Provider name
facts.scope	string	Scope: Project or Account
facts.severityLevel	string	Severity level: information, warning, or critical.
facts.costOfAnomaly	number (double)	The difference between the actual cost and the maximum cost in the normal range.
facts.actualCost	number (double)	Observed (actual) cost of the anomaly.
facts.expectedMaxCost	number (double)	Maximum cost within the expected normal range.
facts.top3SKUs	array of object	Array of SKU entries contributing to an anomaly.
facts.top3SKUs[].cost	number (double)
facts.top3SKUs[].name	string
evidence	array of object	Customer-scoped identifiers the explanation was grounded in.
evidence[].type	string	The kind of evidence this reference points to.
evidence[].id	string	Identifier of the referenced evidence.
explanation	object	The AI-generated portion of the response.
explanation.text	string	Concise, likely-cause explanation of the anomaly.
explanation.generatedBy	string	Identifies the system that generated the explanation.
explanation.aiGenerated	boolean	Always true; present so consumers can identify AI-generated content explicitly.

Raw JSON schema

{
  "required": [
    "facts",
    "evidence",
    "explanation"
  ],
  "type": "object",
  "properties": {
    "facts": {
      "type": "object",
      "description": "Deterministic facts about the anomaly, not AI-generated.",
      "required": [
        "serviceName",
        "platform",
        "scope",
        "severityLevel",
        "costOfAnomaly",
        "top3SKUs"
      ],
      "properties": {
        "serviceName": {
          "type": "string",
          "description": "Service name"
        },
        "platform": {
          "type": "string",
          "description": "Cloud Provider name"
        },
        "scope": {
          "type": "string",
          "description": "Scope: Project or Account"
        },
        "severityLevel": {
          "type": "string",
          "description": "Severity level: `information`, `warning`, or `critical`."
        },
        "costOfAnomaly": {
          "type": "number",
          "format": "double",
          "description": "The difference between the actual cost and the maximum cost in the normal range."
        },
        "actualCost": {
          "type": "number",
          "format": "double",
          "nullable": true,
          "description": "Observed (actual) cost of the anomaly."
        },
        "expectedMaxCost": {
          "type": "number",
          "format": "double",
          "nullable": true,
          "description": "Maximum cost within the expected normal range."
        },
        "top3SKUs": {
          "type": "array",
          "description": "Array of SKU entries contributing to an anomaly.",
          "items": {
            "type": "object",
            "description": "SKU-level information contributing to an anomaly.",
            "properties": {
              "cost": {
                "type": "number",
                "format": "double"
              },
              "name": {
                "type": "string"
              }
            }
          }
        }
      }
    },
    "evidence": {
      "type": "array",
      "description": "Customer-scoped identifiers the explanation was grounded in.",
      "items": {
        "type": "object",
        "required": [
          "type",
          "id"
        ],
        "properties": {
          "type": {
            "type": "string",
            "description": "The kind of evidence this reference points to."
          },
          "id": {
            "type": "string",
            "description": "Identifier of the referenced evidence."
          }
        }
      }
    },
    "explanation": {
      "type": "object",
      "description": "The AI-generated portion of the response.",
      "required": [
        "text",
        "generatedBy",
        "aiGenerated"
      ],
      "properties": {
        "text": {
          "type": "string",
          "description": "Concise, likely-cause explanation of the anomaly."
        },
        "generatedBy": {
          "type": "string",
          "description": "Identifies the system that generated the explanation."
        },
        "aiGenerated": {
          "type": "boolean",
          "description": "Always true; present so consumers can identify AI-generated content explicitly."
        }
      }
    }
  }
}

Errors

On failure, dci prints a single error message — with a hint when one is available — and exits with a typed code your scripts can branch on. See Errors and exit codes for the full contract.

HTTP status to exit code mapping

HTTP status	Exit code	Error code	Meaning
400	30	VALIDATION_ERROR	The arguments or request body were rejected. Review the command's flags and payload.
401	10	AUTHENTICATION_FAILED	Not signed in, or the API token is invalid. Run dci login or check DCI_API_KEY.
403	11	PERMISSION_DENIED	The DoiT user or the active customer context does not have access.
404	20	RESOURCE_NOT_FOUND	The requested resource does not exist. Check the identifier argument.
429	50	RATE_LIMITED	Too many requests. Retryable — the CLI reports the server-provided delay.
500, 503	40	API_SERVER_ERROR	The API failed to process the request. Retryable; contact DoiT support if it persists.

Related

• get-anomaly — Retrieve an anomaly
• list-anomalies — List anomalies
• patch-anomaly — Update an anomaly's review status
• API reference: GET /anomalies/v1/{id}/explanation

Aliases: getanomalyexplanation