Resolve Anomaly

Resolve an open anomaly with a resolution type and investigator notes.

Resolves an open behavioral anomaly. The resolution records the investigator’s determination — whether the anomaly was a false positive, was mitigated, represents an accepted risk, or resulted in the agent being revoked.

Resolution events are immutable once recorded. If an anomaly’s resolution needs to be revisited, a new anomaly should be created referencing the original.

Resolution Types

Resolution	Description	Effect
false_positive	Anomaly was not a genuine threat	Auto-response reversed (agent restored)
mitigated	Anomaly was genuine and has been addressed	Auto-response remains; agent may be restored manually
accepted_risk	Anomaly is genuine but accepted per policy	Auto-response reversed; risk documented
agent_revoked	Anomaly led to permanent agent revocation	Agent remains revoked

Authentication

X-API-Key · string · required

API key with anomalies:resolve scope. Alternatively, pass a Bearer JWT token in the Authorization header.

X-Tenant-ID · string · required

Tenant identifier for multi-tenant isolation.

Path Parameters

id · string · required

Anomaly identifier (maip-anom:ULID). Must be in open status.

Request

resolution · string · required

Resolution determination. Must be one of: false_positive, mitigated, accepted_risk, agent_revoked.

notes · string

Investigator notes explaining the resolution decision. Stored in the audit trail.

Response

id · string

Anomaly identifier.

agent_id · string

The agent associated with the anomaly.

anomaly_type · string

Type of anomaly.

severity · string

Severity level.

status · string

Updated status: resolved.

resolution · string

Resolution determination.

notes · string

Investigator notes.

resolved_at · string

ISO 8601 timestamp of resolution.

resolved_by · string

Operator or API key identifier that resolved the anomaly.

created_at · string

ISO 8601 timestamp of original anomaly creation.