Anomaly detection
Anoman watches your traffic for unusual behavior and raises anomalies — using a statistical rolling detector and a per-customer ML model — without ever blocking a request.
Never blocks
Detection is fire-and-forget
Anomaly detection runs alongside every request but never blocks it — scoring is fire-and-forget, so it adds no latency to the completion and can't fail a call. Anomalies are surfaced for you to review, acknowledge, or investigate after the fact.
Two engines
Statistical + ML, running together
Two detectors score every request in parallel and raise an anomaly when either flags:
Z-score / Welford (rolling window)
A rolling-window statistical detector that flags values far from your recent baseline, across four rules:
token_spike— a sudden jump in token consumption.request_burst— an unusual burst of requests.guardrail_storm— a spike in guardrail blocks.cost_outlier— a cost far above your norm.
Isolation Forest (per-customer ML)
A per-customer machine-learning model trained nightly from your history, scoring each request against an 8-dimensional feature vector inline — catching multi-signal anomalies the single-rule detector can miss.
Both run per customer, so "normal" is learned from your own traffic, not a global average.
Anomalies API
List and acknowledge
Use GET /anoman/v1/anomalies to list anomalies with their severity and status, and POST /anoman/v1/anomalies/{id}/ack to acknowledge one. Anomalies can also fan out as email ops alerts.
# List detected anomalies (with severity + status)
curl "https://api.anoman.io/anoman/v1/anomalies?severity=high&status=open" \
-H "Authorization: Bearer anm-sk-..."Catch the unusual
Open the Anomalies view to review, acknowledge, and investigate.