Anomalies API

Cloud cost anomaly detection provides seamless end-to-end monitoring of spikes in your cloud billing across all your projects and services. See cost anomalies for more information.

The Anomalies API enables you to programmatically retrieve cloud cost or usage anomalies for Google Cloud, Amazon Web Services, and Microsoft Azure.

📘
Required Permissions
Cloud Analytics User

Anomalies API has the following methods:

anomalies.list

The anomalies.list method provides a list of all anomalies available for your cloud platforms.

You can filter the list by using one or more of the following parameters:

Parameter Description

minCreationTime string
Min value for a time of an anomaly, in milliseconds since the POSIX epoch. If set, only anomalies happened after or at this timestamp are returned.

maxCreationTime string
Max value for a time of an anomaly time, in milliseconds since the POSIX epoch. If set, only anomalies happened before or at this timestamp are returned.

Parameter	Description
`minCreationTime`	`string` Min value for a time of an anomaly, in milliseconds since the POSIX epoch. If set, only anomalies happened after or at this timestamp are returned.
`maxCreationTime`	`string` Max value for a time of an anomaly time, in milliseconds since the POSIX epoch. If set, only anomalies happened before or at this timestamp are returned.
`filter`	`string` An expression for filtering the results of the request. The syntax is `key:[<value>]`. For example, the `platforms:google-cloud` will filter the list to only Google Cloud anomalies. Supported filter keys: `platform` - `google-cloud`, `amazon-web-services`, or `platform:microsoft-azure` Learn more about how to use filter *.list requests

filter

string
An expression for filtering the results of the request. The syntax is key:[<value>]. For example, the platforms:google-cloud will filter the list to only Google Cloud anomalies.

Supported filter keys:

platform - google-cloud, amazon-web-services, or platform:microsoft-azure Learn more about how to use filter *.list requests

Sample anomalies.list Request using both minCreationTime and filter parameters:

curl --location --request GET 'https://api.doit.com/anomalies/v1/?filter=serviceName:BigQuery&minCreationTime=1599436800000' \
--header 'Authorization: Bearer your-api-key'

📘
YOUR_API_KEY
Replace "YOUR_API_KEY" with your actual API key as explained at Get Started

Sample anomalies.list Response:

{
  "anomalies": [
    {
      "id": "5c981868-e44a-4e57-93ad-8d5c1cff91fe",
      "billingAccount": "12345",
      "attribution": "",
      "costOfAnomaly": 446.41187273569216,
      "platform": "amazon-web-services",
      "scope": "123412341234",
      "serviceName": "Amazon Simple Notification Service",
      "top3SKUs": [
        {
          "name": "Requests-Tier1",
          "cost": 120
        },
        {
          "name": "USW2-Requests-Tier1",
          "cost": 50
        },
        {
          "name": "USW1-Requests-Tier1",
          "cost": 50
        },
        {
          "name": "Other",
          "cost": 700
        }
      ],
      "severityLevel": "warning",
      "timeFrame": "daily",
      "startTime": 1648508400000,
      "status": null,
      "endTime": null,
      "acknowledged": true,
			"acknowledgedAt": "2026-04-30T13:20:05.594Z",
      "acknowledgedBy": "example-user"
    },
    {
      "id": "ef017423-c4fa-4b04-abac-1bf8d09412dc",
      "billingAccount": "12345",
      "attribution": "",
      "costOfAnomaly": 431.72334855641634,
      "platform": "amazon-web-services",
      "scope": "123412341234",
      "serviceName": "AWS Key Management Service",
      "top3SKUs": [
        {
          "name": "us-west-2-KMS-Requests",
          "cost": 50
        },
        {
          "name": "us-west-1-KMS-Requests",
          "cost": 50
        },
        {
          "name": "us-east-2-KMS-Requests",
          "cost": 50
        },
        {
          "name": "Other",
          "cost": 700
        }
      ],
      "severityLevel": "warning",
      "timeFrame": "daily",
      "startTime": 1648501200000,
      "status": null,
      "endTime": null,
      "acknowledged": true,
			"acknowledgedAt": "2026-04-30T13:20:05.594Z",
      "acknowledgedBy": "example-user"
    }
  ],
	"pageToken": "string",
	"rowCount": 2,
}

anomalies.get

Get the full details of the individual anomaly using the anomaly id.

Sample anomalies.get Request

curl --location --request GET 'https://api.doit.com/anomalies/v1/e34ddb53-514f-4f75-ad1f-6d3089b3c572' \
--header 'Authorization: Bearer {YOUR_API_KEY}'

Sample anomalies.get Response:

{
  "anomalyChartUrl": "https://example.com/cost-anomalies/1111111",
  "billingAccount": "AAAAAA-BBBBBB-CCCCCC",
  "attribution": "Example Customer",
  "costOfAnomaly": 27.5,
  "platform": "google-cloud",
  "scope": "example-project",
  "serviceName": "BigQuery",
  "top3SKUs": [
    {
      "name": "Analysis",
      "cost": 27.5
    }
  ],
  "severityLevel": "warning",
  "timeFrame": "DAILY",
  "startTime": 1776729600000,
  "status": "active",
  "endTime": null,
  "acknowledged": false,
	"acknowledgedAt": null,
  "acknowledgedBy": null,
  "resourceData": [
    {
      "cost": 0.065673,
      "resource_id": "//bigquery.googleapis.com/projects/example-project/jobs/scheduled_query_JOB_ID_001",
      "sku_description": "Analysis",
      "labels": [
        {
          "key": "data_source_id",
          "value": "scheduled_query",
          "cost": 0.065673
        },
        {
          "key": "dts_config_id",
          "value": "CONFIG_ID_001",
          "cost": 0.065673
        },
        {
          "key": "dts_run_id",
          "value": "RUN_ID_001",
          "cost": 0.065673
        }
      ]
    },
    {
      "cost": 0.065673,
      "resource_id": "//bigquery.googleapis.com/projects/example-project/jobs/scheduled_query_JOB_ID_002",
      "sku_description": "Analysis",
      "labels": [
        {
          "key": "data_source_id",
          "value": "scheduled_query",
          "cost": 0.065673
        },
        {
          "key": "dts_config_id",
          "value": "CONFIG_ID_001",
          "cost": 0.065673
        },
        {
          "key": "dts_run_id",
          "value": "RUN_ID_002",
          "cost": 0.065673
        }
      ]
    },
    {
      "cost": 0.06568,
      "resource_id": "//bigquery.googleapis.com/projects/example-project/jobs/scheduled_query_JOB_ID_003",
      "sku_description": "Analysis",
      "labels": [
        {
          "key": "data_source_id",
          "value": "scheduled_query",
          "cost": 0.06568
        },
        {
          "key": "dts_config_id",
          "value": "CONFIG_ID_001",
          "cost": 0.06568
        },
        {
          "key": "dts_run_id",
          "value": "RUN_ID_003",
          "cost": 0.06568
        }
      ]
    },
	... ...
  ]
}

Response Body Fields

Field	Description
`billingAccount`	`string` Unique anomaly identifier
`platform`	`string` The cloud platform for the anomaly. Can be `google-cloud`, `amazon-web-services`, or `microsoft-azure`
`scope`	`string` The Google Cloud project ID, AWS account ID, or Azure resource group name for the given anomaly
`serviceName`	`string` The name of the service causing the anomaly. Examples are EC2, BigQuery, SQS, etc.
`severityLevel`	`string` All anomalies are classified as "info", "warning" or "critical"
`timeFrame`	`string` Anomalies can be DAILY (when a certain day is abnormally large compared to other days) or HOURLY (a certain hour is abnormally large compared to other hours of the same day).
`startTime`	`number` The time when this anomaly was detected, in milliseconds since the epoch.`
`acknowledged`	`boolean` Indicates whether the anomaly has been acknowledged.
`acknowledgedAt`	`string` When the anomaly was first acknowledged.
`acknowledgedBy`	`string` Email of the user who first acknowledged the anomaly.
`resourceData`	Array of `objects` Resources that contribute to the anomaly.