GET /v1/anomalies — the precomputed anomalies table, ALL signals, biggest shift first by the UNIT-FREE magnitude (after − before) / (after + before), computed at read, raw |after − before| breaking zero-baseline ties. Unit-free so shifts of different signals are comparable — raw deltas would let a µs latency shift dwarf every percentage shift. Ranking, not a threshold — every detected shift is returned. Rows are written continuously by the scheduled anomaly pass (BOCPD changepoints over each entity's persisted series — no thresholds), so reading here costs one table scan, never a detection run. The same rows drive `is_anomalous` and the anomaly findings in /v1/investigate.

Precomputed anomalies: worsening regime shifts (BOCPD changepoints, threshold-free) detected continuously over persisted 5-minute series of every signal — error_rate and latency_p95 per operation, log_volume, error_log_rate and profile_cost (the service’s total profiled cost) per service (the operation field holds the entity) — and persisted to the sigiro_anomalies table. Ordered by the unit-free shift magnitude (after - before) / (after + before) descending (1.0 = appeared from a zero baseline, 1/3 = doubled), so the most significant shifts lead regardless of the signal’s units — nothing is filtered out; judge significance from before/after (raw signal units: %, µs, logs, profile cost). Optionally filter by service and a from_ts/to_ts window (microseconds since the Unix epoch) over the shift time. Each row carries a ready-to-run drill_down_sql for POST /v1/query. Rows whose shifts fall in the same or adjacent 5-minute detection bucket on the same service share an incident_id — one incident across signals, not N independent anomalies (the correlation window is the detection pass’s own bucket resolution, never a tuned threshold); incident_id is null for uncorrelated rows.

curl -X GET "/v1/anomalies" \
  -H "Authorization: Bearer YOUR_TOKEN"

const response = await fetch("/v1/anomalies", {
  method: "GET",
  headers: {
    "Authorization": "Bearer YOUR_TOKEN"
  }
});

import requests

response = requests.get(
    "/v1/anomalies",
    headers={
        "Authorization": "Bearer YOUR_TOKEN"
    },
)

{
  "anomalies": [
    {
      "after": 0,
      "before": 0,
      "detected_at": "string",
      "direction": "string",
      "drill_down_sql": "string",
      "incident_id": "string",
      "kind": "string",
      "operation": "string",
      "service_name": "string",
      "signal": "string",
      "ts_shift": "string",
      "ts_shift_us": 0
    }
  ]
}