[Index]
Configuration for anomaly detection on a ReporterResource. Admin defines what to detect; system generates the execution plan.
Model ref.: data/AnomalyDetectionConfig
The full URL would include the host-proxy name: https://[host-proxy].
Variables are enclosed in square brackets.
{
"$schema": "http://json-schema.org/draft-03/schema",
"type": "object",
"properties": {
"name": {
"title": "Name",
"description": "Unique name for this anomaly detection configuration",
"type": "string",
"required": true,
"maxLength": 1024
},
"detection_question": {
"title": "Detection Question",
"description": "What the admin wants to detect",
"type": "string",
"required": true,
"maxLength": 1024
},
"resource": {
"title": "Resource",
"description": "ReporterResource to monitor for anomalies",
"type": "string",
"format": "uri",
"required": true,
"target": "/api/data/ReporterResource/choices/?field=name&format=json&hierarchy=[hierarchy]&auth_token=[authtoken],
"target_attr": "name",
"maxLength": 1024,
"target_model_type": "data/ReporterResource",
"choices": []
},
"datasource_override": {
"title": "Data Source Override",
"description": "Override the default data source for this configuration (business key reference)",
"type": "string",
"format": "uri",
"target": "/api/data/DashboardDatasource/choices/?format=json&hierarchy=[hierarchy]&auth_token=[authtoken],
"maxLength": 1024,
"target_model_type": "data/DashboardDatasource",
"choices": []
},
"features": {
"title": "Features",
"description": "Optional Postgres column names to analyze. When empty, the LLM derives optimal features from the resource schema and detection question.",
"type": "array",
"required": false,
"items": {
"type": "string",
"choices": [],
"maxLength": 1024
}
},
"allow_playbook_edit": {
"title": "Allow Playbook Edit",
"description": "Enable expert mode to manually edit the execution plan. When enabled, operational fields (tool, parameters, exit on failure) become editable. Changes may be overwritten when the plan is regenerated.",
"type": "boolean",
"required": false,
"default": false
},
"playbook_config": {
"title": "Playbook Configuration",
"description": "Structured execution plan generated by the generate_execution_plan operation. Contains required datasources, ordered detection steps, and LLM reasoning. Cleared automatically when resource or features change.",
"type": "object",
"required": false,
"properties": {
"required_datasources": {
"title": "Required Datasources",
"description": "List of datasource types needed by this plan (e.g. 'automate-postgres'). Empty array when datasource_override is set.",
"type": "array",
"required": false,
"items": {
"type": "string",
"maxLength": 1024
}
},
"reasoning": {
"title": "Reasoning",
"description": "LLM-generated explanation of why this detection approach was chosen.",
"type": "string",
"required": false,
"maxLength": 1024
},
"steps": {
"title": "Steps",
"description": "Ordered list of detection steps to execute. Each step invokes a tool with specific parameters.",
"type": "array",
"required": false,
"items": {
"type": "object",
"properties": {
"tool": {
"title": "Tool",
"description": "Name of the detection tool to execute in this step.",
"type": "string",
"required": true,
"choices": [
{
"value": "query_snapshot_data",
"title": "Query Snapshot Data"
},
{
"value": "detect_config_drift",
"title": "Detect Config Drift"
},
{
"value": "ml_detect_outliers",
"title": "ML Detect Outliers"
},
{
"value": "query_reporter_metrics",
"title": "Query Reporter Metrics"
},
{
"value": "ml_time_series_analysis",
"title": "ML Time Series Analysis"
},
{
"value": "create_anomaly",
"title": "Create Anomaly"
},
{
"value": "summarize_detection_results",
"title": "Summarize Detection Results"
}
],
"maxLength": 1024
},
"params": {
"title": "Parameters",
"description": "Tool-specific parameters as a JSON object. Structure varies per tool.",
"type": "string",
"required": false,
"maxLength": 1024
},
"goal": {
"title": "Goal",
"description": "Human-readable description of what this step accomplishes.",
"type": "string",
"required": true,
"maxLength": 1024
},
"rationale": {
"title": "Rationale",
"description": "Explanation of why this step is needed in the detection plan.",
"type": "string",
"required": false,
"maxLength": 1024
},
"exit_on_failure": {
"title": "Exit on Failure",
"description": "If true, abort the entire detection run when this step fails. If false, log the error and continue to the next step.",
"type": "boolean",
"required": false
}
}
}
},
"presentation_schema": {
"title": "Presentation Schema",
"description": "Defines the sections and structure for the LLM-generated run summary. The summary is written for non-ML-expert admins. Customize sections to control what appears in the report.",
"type": "object",
"required": false,
"properties": {
"type": {
"title": "Type",
"description": "The type of presentation format",
"type": "string",
"required": true,
"choices": [
{
"value": "narrative",
"title": "Narrative - Structured narrative format with sections"
},
{
"value": "structured_json",
"title": "Structured JSON - Machine-readable output format"
}
],
"maxLength": 1024
},
"sections": {
"title": "Sections",
"description": "List of sections in the presentation",
"type": "array",
"required": true,
"items": {
"type": "object",
"properties": {
"header": {
"title": "Header",
"description": "Section header/title",
"type": "string",
"required": true,
"maxLength": 1024
},
"description": {
"title": "Description",
"description": "Description of what this section contains",
"type": "string",
"required": false,
"maxLength": 1024
}
}
}
},
"note": {
"title": "Note",
"description": "Additional notes about the presentation format",
"type": "string",
"required": false,
"maxLength": 1024
}
}
}
}
},
"detection_filter": {
"title": "Detection Filter",
"description": "Array of filter groups (OR'd) to scope detection to a subset of rows. Each group contains a filter_options array of filter items (AND'd within the group).",
"type": "array",
"required": false,
"items": {
"type": "object",
"properties": {
"name": {
"title": "Name",
"description": "Optional label for this filter group.",
"type": "string",
"required": false,
"readonly": false,
"maxLength": 1024
},
"description": {
"title": "Description",
"description": "Optional description explaining the purpose of this filter group.",
"type": "string",
"required": false,
"readonly": false,
"maxLength": 1024
},
"filter_options": {
"title": "Filter Options",
"type": "array",
"required": true,
"items": {
"type": "object",
"properties": {
"filter_by": {
"title": "Filter By",
"type": "string",
"required": false,
"readonly": false,
"maxLength": 1024
},
"filter_type": {
"title": "Filter Type",
"type": "string",
"required": false,
"readonly": false,
"choices": [
{
"value": "contains",
"title": "Contains"
},
{
"value": "notcontain",
"title": "Does Not Contain"
},
{
"value": "startswith",
"title": "Starts With"
},
{
"value": "endswith",
"title": "Ends With"
},
{
"value": "equals",
"title": "Equals"
},
{
"value": "notequal",
"title": "Not Equal"
}
],
"maxLength": 1024
},
"filter_string": {
"title": "Filter String",
"type": "string",
"required": false,
"readonly": false,
"maxLength": 1024
},
"ignore_case": {
"title": "Ignore Case",
"type": "boolean",
"required": false,
"readonly": false
}
}
}
}
}
}
},
"desired_state_search": {
"title": "Desired State Search",
"description": "Ephemeral search filters to find a source instance from the resource's base table. Results populate desired_state. Not persisted on save.",
"type": "array",
"required": false,
"items": {
"type": "object",
"properties": {
"filter_options": {
"title": "Filter Options",
"type": "array",
"required": true,
"items": {
"type": "object",
"properties": {
"filter_by": {
"title": "Filter By",
"type": "string",
"required": false,
"readonly": false,
"maxLength": 1024
},
"filter_type": {
"title": "Filter Type",
"type": "string",
"required": false,
"readonly": false,
"choices": [
{
"value": "contains",
"title": "Contains"
},
{
"value": "notcontain",
"title": "Does Not Contain"
},
{
"value": "startswith",
"title": "Starts With"
},
{
"value": "endswith",
"title": "Ends With"
},
{
"value": "equals",
"title": "Equals"
},
{
"value": "notequal",
"title": "Not Equal"
}
],
"maxLength": 1024
},
"filter_string": {
"title": "Filter String",
"type": "string",
"required": false,
"readonly": false,
"maxLength": 1024
},
"ignore_case": {
"title": "Ignore Case",
"type": "boolean",
"required": false,
"readonly": false
}
}
}
}
}
}
},
"desired_state_instance": {
"title": "Desired State Instance",
"description": "Ephemeral dropdown showing instances matching the search filters. Selecting an instance populates desired_state. Not persisted on save.",
"type": "string",
"required": false,
"maxLength": 1024
},
"desired_state": {
"title": "Desired State",
"description": "Locked-in key-value pairs representing the desired configuration state for drift detection",
"type": "array",
"required": false,
"items": {
"type": "object",
"properties": {
"field": {
"title": "Field",
"description": "Resource property name \u2014 column in the Postgres base table",
"type": "string",
"required": true,
"maxLength": 1024
},
"value": {
"title": "Value",
"description": "Desired value for this property",
"type": "string",
"required": true,
"maxLength": 1024
}
}
}
},
"run_summary_retention_days": {
"title": "Run Summary Retention (Days)",
"description": "Number of days to retain detection run summary records before automatic purge. Applies to new runs only \u2014 changing this value does not affect existing run records.",
"type": "integer",
"required": false,
"default": 30,
"choices": [
{
"value": 7,
"title": "7 Days"
},
{
"value": 14,
"title": "14 Days"
},
{
"value": 30,
"title": "30 Days"
},
{
"value": 60,
"title": "60 Days"
},
{
"value": 90,
"title": "90 Days"
},
{
"value": 180,
"title": "180 Days"
},
{
"value": 365,
"title": "365 Days"
}
]
}
},
"schema_version": "1.24.1"
}
| Task | Call | URL | Parameters | Response |
|---|---|---|---|---|
| Get the GUI Add form. | GET | /api/data/AnomalyDetectionConfig/add/ |
|
The GUI Add form of data/AnomalyDetectionConfig as JSON |
The API call to the /add/ URL can only be made from a hierarchy that allows the model type to be added. The actions in the response shows the url for the POST API call to create an instance.
| Task | Call | URL | Parameters | Payload |
|---|---|---|---|---|
| Create | POST | /api/data/AnomalyDetectionConfig | hierarchy=[hierarchy] |
|
tool/Transaction/[trans pkid]to inspect the created resource and its instance pkid.
| Task | Call | URL | Parameters | Payload |
|---|---|---|---|---|
| Bulk delete [pkid1],[pkid2]... | DELETE | /api/data/AnomalyDetectionConfig/ | hierarchy=[hierarchy] | {"hrefs":["/api/data/AnomalyDetectionConfig/[pkid1]", "/api/data/AnomalyDetectionConfig/[pkid2]", ...]} |
GET http://[host-proxy]/api/data/AnomalyDetectionConfig/?hierarchy=[hierarchy]&format=json
| Task | Call | URL | Parameters | Payload |
|---|---|---|---|---|
| Get a selected [export_format] of the schema and instances [pkid1], [pkid2],... of data/AnomalyDetectionConfig; optionally with tag_version at [version] and Configuration Template as [configtemplate]. | POST | /api/data/AnomalyDetectionConfig/export/ |
|
{ "hrefs":["/api/data/AnomalyDetectionConfig/[pkid1]", "/api/data/AnomalyDetectionConfig/[pkid2]",...]}} |
For export_format=json, the response is a time stamped zip file of data in JSON as in the system database. Item properties such as strings that are empty or Boolean values that are not set, are not included. The filename in the response is of the format as the example:
Content-Disposition: attachment; filename=export_2013-05-17_14:20:19.186444.json.zip
Content-Language:en
Content-Type:application/x-zip
For export_format=raw_xlsx, the response is a MS Excel spreadsheet with columns corresponding to the JSON format export and a response filename format:
Content-Disposition: attachment; filename=<resource_type>_<resource_name>_exportedsheet_CCYY-MM-DD_HH-MM-SS.xlsx
Content-Language:en
Content-Type:application/vnd.openxmlformats-officedocument.spreadsheetml.sheet
For export_format=xlsx, the response is a MS Excel spreadsheet, arranged by any Field Display Policies that apply. The columns correspond with those of a Bulk Load Template export sheet. The response filename format is:
Content-Disposition: attachment; filename=<resource_type>_<resource_name>_exportedsheet_formatted_CCYY-MM-DD_HH-MM-SS.xlsx
Content-Language:en
Content-Type:application/vnd.openxmlformats-officedocument.spreadsheetml.sheet
The XLSX format can be used to bulk load instances of data/AnomalyDetectionConfig and the JSON format can be used to import instances of data/AnomalyDetectionConfig.
GET http://[host-proxy]/api/data/AnomalyDetectionConfig/?hierarchy=[hierarchy]
| Task | Call | URL | Parameters | Response |
|---|---|---|---|---|
| Get a compressed format of the Bulk Load spreadsheet template for data/AnomalyDetectionConfig | POST | /api/data/AnomalyDetectionConfig/export_bulkload_template/ |
|
The response is an attachment of the format: filetype_bulkloadsheet.xlsx.gz |
| Task | Call | URL | Parameters | Response |
|---|---|---|---|---|
| Configuration Template | GET | /api/data/AnomalyDetectionConfig/configuration_template/ | hierarchy=[hierarchy] |
|
POST http://[host-proxy]/api/data/ConfigurationTemplate/?hierarchy=[hierarchy]
| Task | Call | URL | Parameters | Response |
|---|---|---|---|---|
| Field Display Policy | GET | /api/data/AnomalyDetectionConfig/field_display_policy/ | hierarchy=[hierarchy] |
|
POST http://[host-proxy]/api/data/FieldDisplayPolicy/?hierarchy=[hierarchy]
| Task | Call | URL | Parameters | Response |
|---|---|---|---|---|
| Migration Template | GET | /api/data/AnomalyDetectionConfig/migration/ |
|
| Task | Call | URL | Parameters | Response |
|---|---|---|---|---|
| List | GET | /api/data/AnomalyDetectionConfig/ |
|
The data/AnomalyDetectionConfig schema and all instances as JSON. |
(The list will return 0 to 3 data/AnomalyDetectionConfig instances)
{
"pagination": {
"skip": 0,
"limit": 3,
"maximum_limit": 2000,
"total": 0,
"total_limit": null,
"order_by": "name",
"direction": "asc",
"current": "/api/data/AnomalyDetectionConfig/?skip=0&limit=3&order_by=name&direction=asc&traversal=fulltree"
},
"operations": [
"add",
"bulk_update_form",
"list",
"update",
"transform",
"migration",
"remove",
"export",
"help",
"configuration_template",
"field_display_policy",
"get",
"export_bulkload_template"
],
"meta": {
"model_type": "data/AnomalyDetectionConfig",
"summary_attrs": [
{
"name": "name",
"title": "Name"
},
{
"name": "resource",
"title": "Resource"
},
{
"name": "detection_question",
"title": "Detection Question"
},
{
"name": "hierarchy_friendly_name",
"title": "Located At",
"allow_filtering": true
}
],
"tagged_versions": [],
"tags": [],
"title": "?",
"business_key": {
"unique": [
"name"
],
"hierarchy": true
},
"api_version": "21.2",
"cached": true,
"references": {
"children": [],
"parent": [
{
"href": "/api/data/HierarchyNode/6t0ggef2c0deab00hb595101",
"pkid": "6t0ggef2c0deab00hb595101"
}
],
"device": [
{
"href": "",
"pkid": ""
}
],
"foreign_key": []
},
"model_specific_actions": [
"add",
"get",
"list",
"update",
"remove",
"execute",
"export",
"export_bulkload_template",
"configuration_template",
"field_display_policy",
"migration",
"clone",
"generate_execution_plan"
],
"schema_version": "1.24.1",
"actions": [
{
"add": {
"method": "GET",
"class": "add",
"href": "/api/data/AnomalyDetectionConfig/add/?hierarchy=[hierarchy]",
"support_async": false,
"title": "Add"
}
},
{
"remove": {
"method": "DELETE",
"class": "delete",
"href": "/api/data/AnomalyDetectionConfig/?hierarchy=[hierarchy]",
"support_async": true,
"title": "Delete"
}
},
{
"export": {
"method": "POST",
"class": "export",
"href": "/api/data/AnomalyDetectionConfig/export/?hierarchy=[hierarchy]",
"support_async": false,
"title": "Export",
"view": "/api/view/ExportData/add/?auth_token=[authtoken],
"submit": "payload"
}
},
{
"export_bulkload_template": {
"method": "POST",
"class": "bulkload_template",
"href": "/api/data/AnomalyDetectionConfig/export_bulkload_template/?hierarchy=[hierarchy]",
"support_async": false,
"title": "Export Bulk Load Template"
}
},
{
"configuration_template": {
"method": "GET",
"class": "config",
"href": "/api/data/AnomalyDetectionConfig/configuration_template/?hierarchy=[hierarchy]",
"support_async": false,
"title": "Configuration Template"
}
},
{
"field_display_policy": {
"method": "GET",
"class": "display_policy",
"href": "/api/data/AnomalyDetectionConfig/field_display_policy/?hierarchy=[hierarchy]",
"support_async": false,
"title": "Field Display Policy"
}
},
{
"migration": {
"method": "GET",
"class": "migration",
"href": "/api/data/AnomalyDetectionConfig/migration/?hierarchy=[hierarchy]",
"support_async": false,
"title": "Migration Template"
}
},
{
"list": {
"method": "GET",
"class": "list",
"href": "/api/data/AnomalyDetectionConfig/?hierarchy=[hierarchy]",
"support_async": false,
"title": "List"
}
}
]
},
"resources": []
}
| Task | Call | URL | Parameters | Payload |
|---|---|---|---|---|
| Modify | PUT | /api/data/AnomalyDetectionConfig/[pkid] | hierarchy=[hierarchy] | (For payload specification) |
For Bulk modification, refer to the Bulk Modify section.
| Task | Call | URL | Parameters | Response |
|---|---|---|---|---|
| Delete | DELETE | /api/data/AnomalyDetectionConfig/[pkid] | hierarchy=[hierarchy] |
| Task | Call | URL | Parameters | Response |
|---|---|---|---|---|
| Clone instance with [pkid]. The schema rules are applied. | GET | /api/data/AnomalyDetectionConfig/[pkid]/clone/?schema=&schema_rules=true |
|
A JSON payload with:
|
GET http://[host-proxy]/api/data/AnomalyDetectionConfig/?hierarchy=[hierarchy]&format=json
| Task | Call | URL | Parameters | Response |
|---|---|---|---|---|
| Get a selected [export_format] of the schema and a single instance with [pkid] of data/AnomalyDetectionConfig; optionally with tag_version at [version] and Configuration Template as [configtemplate]. | GET | /api/data/AnomalyDetectionConfig/[pkid]/export |
|
The response is an attachment. Refer to the list below. |
For export_format=raw_xlsx, the response is a "raw" MS Excel spreadsheet with columns corresponding to the JSON format export and a response format:
Content-Disposition: attachment; filename=<resource_type>_<resource_name>_exportedsheet_CCYY-MM-DD_HH-MM-SS.xlsx
Content-Language:en
Content-Type:application/vnd.openxmlformats-officedocument.spreadsheetml.sheet
For export_format=xlsx, the response is a MS Excel spreadsheet, formatted to show all columns and a response format:
Content-Disposition: attachment; filename=<resource_type>_<resource_name>_exportedsheet_formatted_CCYY-MM-DD_HH-MM-SS.xlsx
Content-Language:en
Content-Type:application/vnd.openxmlformats-officedocument.spreadsheetml.sheet
For export_format=json, the response is a time stamped zip file of data in JSON and a response format:
Content-Disposition: attachment; filename=export_2013-05-17_14:20:19.186444.json.zip
Content-Language:en
Content-Type:application/x-zip
The XLSX format can be used to bulk load instances of data/AnomalyDetectionConfig and the JSON format can be used to import instances of data/AnomalyDetectionConfig.
For Bulk Export, refer to the Bulk Export section.
| Task | Call | URL | Parameters | Payload |
|---|---|---|---|---|
| Execute | POST | /api/data/AnomalyDetectionConfig/[pkid]/execute | hierarchy=[hierarchy] | If payload required: |
| Task | Call | URL | Parameters | Response |
|---|---|---|---|---|
| Get | GET | /api/data/AnomalyDetectionConfig/[pkid] | hierarchy=[hierarchy] | The data/AnomalyDetectionConfig instance with [pkid]. |
| Task | Call | URL | Parameters | Payload |
|---|---|---|---|---|
| Generate Execution Plan | POST | /api/data/AnomalyDetectionConfig/[pkid]/+generate_execution_plan | hierarchy=[hierarchy] | If payload required: |