The Anomaly Detector API detects anomalies automatically in time series data. It supports both a stateless detection mode and a stateful detection mode. In stateless mode, there are three functionalities. Entire Detect is for detecting the whole series, with the model trained by the time series. Last Detect is for detecting the last point, with the model trained by points before. ChangePoint Detect is for detecting trend changes in the time series.
swagger: '2.0'
info:
title: Microsoft Azure Anomaly Detector
version: v1.1
description: >-
The Anomaly Detector API detects anomalies automatically in time series
data.
It supports both a stateless detection mode and a
stateful detection mode. In stateless mode, there are three functionalities.
Entire
Detect is for detecting the whole series, with the model trained by the time
series.
Last Detect is for detecting the last point, with the model trained by
points before.
ChangePoint Detect is for detecting trend changes in the time series. In
stateful
mode, the user can store time series. The stored time series will be used
for
detection anomalies. In this mode, the user can still use the preceding
three
functionalities by only giving a time range without preparing time series on
the
client side. Besides the preceding three functionalities, the stateful model
provides group-based detection and labeling services. By using the labeling
service, the user can provide labels for each detection result. These labels
will be
used for retuning or regenerating detection models. Inconsistency detection
is
a kind of group-based detection that finds inconsistencies in
a set of time series. By using the anomaly detector service, business
customers can
discover incidents and establish a logic flow for root cause analysis.
x-typespec-generated:
- emitter: '@azure-tools/typespec-autorest'
schemes:
- https
x-ms-parameterized-host:
hostTemplate: '{Endpoint}/anomalydetector/{ApiVersion}'
useSchemePrefix: false
parameters:
- name: Endpoint
in: path
description: >-
Supported Azure Cognitive Services endpoints (protocol and host name,
such as
https://westus2.api.cognitive.microsoft.com).
required: true
type: string
- name: ApiVersion
in: path
description: Api Version
required: true
type: string
enum:
- v1.1
x-ms-enum:
name: APIVersion
modelAsString: true
values:
- name: v1_1
value: v1.1
produces:
- application/json
consumes:
- application/json
security:
- AnomalyDetectorApiKeyAuth: []
securityDefinitions:
AnomalyDetectorApiKeyAuth:
type: apiKey
description: The secret key for your Azure Cognitive Services subscription.
name: Ocp-Apim-Subscription-Key
in: header
tags:
- name: Multivariate
- name: Timeseries
paths:
/multivariate/detect-batch/{resultId}:
get:
operationId: microsoftAzureMultivariateGetmultivariatebatchdetectionresult
summary: Microsoft Azure Get Multivariate Anomaly Detection Result
description: >-
For asynchronous inference, get a multivariate anomaly detection result
based on the<br>resultId value that the BatchDetectAnomaly API returns.
parameters:
- name: resultId
in: path
description: ID of a batch detection result.
required: true
type: string
format: uuid
responses:
'200':
description: The request has succeeded.
schema:
$ref: '#/definitions/Multivariate.MultivariateDetectionResult'
default:
description: An unexpected error response.
schema:
$ref: '#/definitions/Multivariate.ResponseError'
headers:
x-ms-error-code:
type: string
description: Error code.
x-ms-examples:
Get multivariate batch detection result:
$ref: ./examples/GetResult.json
tags:
- Multivariate
/multivariate/models:
get:
operationId: microsoftAzureMultivariateListmultivariatemodels
summary: Microsoft Azure List Multivariate Models
description: List models of a resource.
parameters:
- $ref: '#/parameters/Azure.Core.SkipQueryParameter'
- $ref: '#/parameters/Azure.Core.TopQueryParameter'
responses:
'200':
description: The request has succeeded.
schema:
$ref: '#/definitions/Multivariate.ModelList'
default:
description: An unexpected error response.
schema:
$ref: '#/definitions/Multivariate.ResponseError'
headers:
x-ms-error-code:
type: string
description: Error code.
x-ms-examples:
List multivariate models:
$ref: ./examples/ListModel.json
x-ms-pageable:
nextLinkName: nextLink
tags:
- Multivariate
post:
operationId: microsoftAzureMultivariateTrainmultivariatemodel
summary: Microsoft Azure Train A Multivariate Anomaly Detection Model
description: >-
Create and train a multivariate anomaly detection model. The request
must<br>include a source parameter to indicate an Azure Blob<br>Storage
URI that's accessible to the service. There are two types of data input.
The Blob Storage URI can point to an Azure Blob<br>Storage folder that
contains multiple CSV files, where each CSV file has<br>two columns,
time stamp and variable. Or the Blob Storage URI can point to a single
blob that contains a CSV file that has all the variables and a<br>time
stamp column.<br>The model object will be created and returned in the
response, but the<br>training process happens asynchronously. To check
the training status, call<br>GetMultivariateModel with the modelId value
and check the status field in the<br>modelInfo object.
parameters:
- name: modelInfo
in: body
description: Model information.
required: true
schema:
$ref: '#/definitions/Multivariate.ModelInfo'
responses:
'201':
description: >-
The request has succeeded and a new resource has been created as a
result.
schema:
$ref: '#/definitions/Multivariate.AnomalyDetectionModel'
headers:
location:
type: string
description: Location and ID of the model.
default:
description: An unexpected error response.
schema:
$ref: '#/definitions/Multivariate.ResponseError'
headers:
x-ms-error-code:
type: string
description: Error code.
x-ms-examples:
Create and train multivariate model:
$ref: ./examples/TrainModel.json
tags:
- Multivariate
/multivariate/models/{modelId}:
get:
operationId: microsoftAzureMultivariateGetmultivariatemodel
summary: Microsoft Azure Get Multivariate Model
description: >-
Get detailed information about the multivariate model, including the
training status<br>and variables used in the model.
parameters:
- name: modelId
in: path
description: Model identifier.
required: true
type: string
responses:
'200':
description: The request has succeeded.
schema:
$ref: '#/definitions/Multivariate.AnomalyDetectionModel'
default:
description: An unexpected error response.
schema:
$ref: '#/definitions/Multivariate.ResponseError'
headers:
x-ms-error-code:
type: string
description: Error code.
x-ms-examples:
Get a multivariate model:
$ref: ./examples/GetModel.json
tags:
- Multivariate
delete:
operationId: microsoftAzureMultivariateDeletemultivariatemodel
summary: Microsoft Azure Delete Multivariate Model
description: Delete an existing multivariate model according to the modelId value.
parameters:
- name: modelId
in: path
description: Model identifier.
required: true
type: string
responses:
'204':
description: >-
There is no content to send for this request, but the headers may be
useful.
default:
description: An unexpected error response.
schema:
$ref: '#/definitions/Multivariate.ResponseError'
headers:
x-ms-error-code:
type: string
description: Error code.
x-ms-examples:
Delete multivariate model:
$ref: ./examples/DeleteModel.json
tags:
- Multivariate
/multivariate/models/{modelId}:detect-batch:
post:
operationId: microsoftAzureMultivariateDetectmultivariatebatchanomaly
summary: Microsoft Azure Detect Multivariate Anomaly
description: >-
Submit a multivariate anomaly detection task with the modelId value of a
trained model<br>and inference data. The input schema should be the same
with the training<br>request. The request will finish asynchronously and
return a resultId value to<br>query the detection result. The request
should be a source link to indicate an<br>externally accessible Azure
Storage URI that either points to an Azure Blob<br>Storage folder or
points to a CSV file in Azure Blob Storage.
parameters:
- name: modelId
in: path
description: Model identifier.
required: true
type: string
- name: options
in: body
description: Request of multivariate anomaly detection.
required: true
schema:
$ref: '#/definitions/Multivariate.MultivariateBatchDetectionOptions'
responses:
'202':
description: >-
The request has been accepted for processing, but processing has not
yet completed.
schema:
$ref: '#/definitions/Multivariate.MultivariateDetectionResult'
headers:
Operation-Id:
type: string
description: ID of the detection result.
Operation-Location:
type: string
description: Location of the detection result.
default:
description: An unexpected error response.
schema:
$ref: '#/definitions/Multivariate.ResponseError'
headers:
x-ms-error-code:
type: string
description: Error code.
x-ms-examples:
Detect multivariate batch anomaly:
$ref: ./examples/DetectAnomaly.json
tags:
- Multivariate
/multivariate/models/{modelId}:detect-last:
post:
operationId: microsoftAzureMultivariateDetectmultivariatelastanomaly
summary: Microsoft Azure Detect Anomalies In The Last Point Of The Request Body
description: >-
Submit a multivariate anomaly detection task with the modelId value of a
trained model<br>and inference data. The inference data should be put
into the request body in<br>JSON format. The request will finish
synchronously and return the detection<br>immediately in the response
body.
parameters:
- name: modelId
in: path
description: Model identifier.
required: true
type: string
- name: options
in: body
description: Request of the last detection.
required: true
schema:
$ref: '#/definitions/Multivariate.MultivariateLastDetectionOptions'
responses:
'200':
description: The request has succeeded.
schema:
$ref: '#/definitions/Multivariate.MultivariateLastDetectionResult'
default:
description: An unexpected error response.
schema:
$ref: '#/definitions/Multivariate.ResponseError'
headers:
x-ms-error-code:
type: string
description: Error code.
x-ms-examples:
Detect multivariate last anomaly:
$ref: ./examples/LastDetectAnomaly.json
tags:
- Multivariate
/timeseries/changepoint/detect:
post:
operationId: microsoftAzureUnivariateDetectunivariatechangepoint
summary: Microsoft Azure Detect Change Point For The Entire Series
description: Evaluate the change point score of every series point.
parameters:
- name: options
in: body
description: Method of univariate anomaly detection.
required: true
schema:
$ref: '#/definitions/Univariate.UnivariateChangePointDetectionOptions'
responses:
'200':
description: The request has succeeded.
schema:
$ref: '#/definitions/Univariate.UnivariateChangePointDetectionResult'
default:
description: An unexpected error response.
schema:
$ref: '#/definitions/Univariate.AnomalyDetectorError'
headers:
x-ms-error-code:
type: string
description: Error code.
x-ms-examples:
Univariate detection of a change point:
$ref: ./examples/ChangePointDetect.json
tags:
- Timeseries
/timeseries/entire/detect:
post:
operationId: microsoftAzureUnivariateDetectunivariateentireseries
summary: 'Microsoft Azure Detect Anomalies For The Entire Series In Batch'
description: >-
This operation generates a model with an entire series. Each point is
detected<br>with the same model. With this method, points before and
after a certain point<br>are used to determine whether it's an anomaly.
The entire detection can give the<br>user an overall status of the time
series.
parameters:
- name: options
in: body
description: Method of univariate anomaly detection.
required: true
schema:
$ref: '#/definitions/Univariate.UnivariateDetectionOptions'
responses:
'200':
description: The request has succeeded.
schema:
$ref: '#/definitions/Univariate.UnivariateEntireDetectionResult'
default:
description: An unexpected error response.
schema:
$ref: '#/definitions/Univariate.AnomalyDetectorError'
headers:
x-ms-error-code:
type: string
description: Error code.
x-ms-examples:
Univariate detect entire series:
$ref: ./examples/EntireDetect.json
tags:
- Timeseries
/timeseries/last/detect:
post:
operationId: microsoftAzureUnivariateDetectunivariatelastpoint
summary: 'Microsoft Azure Detect Anomaly Status Of The Latest Point In Time Series'
description: >-
This operation generates a model by using the points that you sent in to
the API<br>and based on all data to determine whether the last point is
anomalous.
parameters:
- name: options
in: body
description: Method of univariate anomaly detection.
required: true
schema:
$ref: '#/definitions/Univariate.UnivariateDetectionOptions'
responses:
'200':
description: The request has succeeded.
schema:
$ref: '#/definitions/Univariate.UnivariateLastDetectionResult'
default:
description: An unexpected error response.
schema:
$ref: '#/definitions/Univariate.AnomalyDetectorError'
headers:
x-ms-error-code:
type: string
description: Error code.
x-ms-examples:
Detect univariate last point:
$ref: ./examples/LastDetect.json
tags:
- Timeseries
definitions:
Azure.Core.uuid:
type: string
format: uuid
description: Universally Unique Identifier
Multivariate.AlignMode:
type: string
enum:
- Inner
- Outer
x-ms-enum:
name: AlignMode
modelAsString: true
Multivariate.AlignPolicy:
type: object
description: Manner of aligning multiple variables.
properties:
alignMode:
$ref: '#/definitions/Multivariate.AlignMode'
description: |-
Field that indicates how to align different variables to the same
time range.
fillNAMethod:
$ref: '#/definitions/Multivariate.FillNAMethod'
description: Field that indicates how missing values will be filled.
paddingValue:
type: number
format: float
description: Field that's required when fillNAMethod is Fixed.
Multivariate.AnomalyDetectionModel:
type: object
description: Response of getting a model.
properties:
modelId:
$ref: '#/definitions/Azure.Core.uuid'
description: Model identifier.
createdTime:
type: string
format: date-time
description: Date and time (UTC) when the model was created.
lastUpdatedTime:
type: string
format: date-time
description: Date and time (UTC) when the model was last updated.
modelInfo:
$ref: '#/definitions/Multivariate.ModelInfo'
description: >-
Training result of a model, including its status, errors, and
diagnostics
information.
required:
- modelId
- createdTime
- lastUpdatedTime
Multivariate.AnomalyInterpretation:
type: object
description: Interpretation of the anomalous time stamp.
properties:
variable:
type: string
description: Variable.
contributionScore:
type: number
format: float
description: >-
This score shows the percentage that contributes to the anomalous time
stamp. It's a
number between 0 and 1.
correlationChanges:
$ref: '#/definitions/Multivariate.CorrelationChanges'
description: Correlation changes among the anomalous variables.
Multivariate.AnomalyState:
type: object
description: Anomaly status and information.
properties:
timestamp:
type: string
format: date-time
description: Time stamp for this anomaly.
value:
$ref: '#/definitions/Multivariate.AnomalyValue'
description: Detailed value of this anomalous time stamp.
errors:
type: array
description: Error message for the current time stamp.
items:
$ref: '#/definitions/Multivariate.ErrorResponse'
x-ms-identifiers: []
required:
- timestamp
Multivariate.AnomalyValue:
type: object
description: Detailed information of the anomalous time stamp.
properties:
isAnomaly:
type: boolean
description: True if an anomaly is detected at the current time stamp.
severity:
type: number
format: float
description: >-
Indicates the significance of the anomaly. The higher the severity,
the more
significant the anomaly is.
minimum: 0
maximum: 1
score:
type: number
format: float
description: >-
Raw anomaly score of severity, to help indicate the degree of
abnormality.
minimum: 0
maximum: 2
interpretation:
type: array
description: Interpretation of this anomalous time stamp.
items:
$ref: '#/definitions/Multivariate.AnomalyInterpretation'
x-ms-identifiers: []
required:
- isAnomaly
- severity
- score
Multivariate.CorrelationChanges:
type: object
description: Correlation changes among the anomalous variables.
properties:
changedVariables:
type: array
description: Correlated variables that have correlation changes under an anomaly.
items:
type: string
Multivariate.DataSchema:
type: string
description: Data schema of the input data source. The default is OneTable.
enum:
- OneTable
- MultiTable
x-ms-enum:
name: DataSchema
modelAsString: true
values:
- name: OneTable
value: OneTable
description: >-
OneTable means that your input data is in one CSV file, which
contains one time stamp column and several variable columns. The
default DataSchema value is OneTable.
- name: MultiTable
value: MultiTable
description: >-
MultiTable means that your input data is separated in multiple CSV
files. Each file contains one time stamp column and one variable
column, and the CSV file name should indicate the name of the
variable. The default DataSchema value is OneTable.
Multivariate.DiagnosticsInfo:
type: object
description: Diagnostics information to help inspect the states of a model or variable.
properties:
modelState:
$ref: '#/definitions/Multivariate.ModelState'
description: Model status.
variableStates:
type: array
description: Variable status.
items:
$ref: '#/definitions/Multivariate.VariableState'
x-ms-identifiers: []
Multivariate.ErrorResponse:
type: object
description: Error information that the API returned.
properties:
code:
type: string
description: Error code.
message:
type: string
description: Message that explains the error that the service reported.
required:
- code
- message
Multivariate.FillNAMethod:
type: string
description: Field that indicates how missing values will be filled.
enum:
- Previous
- Subsequent
- Linear
- Zero
- Fixed
x-ms-enum:
name: FillNAMethod
modelAsString: true
Multivariate.ModelInfo:
type: object
description: |-
Training result of a model, including its status, errors, and diagnostics
information.
properties:
dataSource:
type: string
format: uri
description: >-
Source link to the input data to indicate an accessible Azure Storage
URI.
It either points to an Azure Blob Storage folder or points to a CSV
file in
Azure Blob Storage, based on your data schema selection.
dataSchema:
$ref: '#/definitions/Multivariate.DataSchema'
description: |-
Data schema of the input data source. The default
is OneTable.
startTime:
type: string
format: date-time
description: |-
Start date/time of training data, which should be
in ISO 8601 format.
endTime:
type: string
format: date-time
description: |-
End date/time of training data, which should be
in ISO 8601 format.
displayName:
type: string
description: |-
Display name of the model. Maximum length is 24
characters.
maxLength: 24
slidingWindow:
type: integer
format: int32
description: |-
Number of previous time stamps that will be used to
detect whether the time stamp is an anomaly or not.
alignPolicy:
$ref: '#/definitions/Multivariate.AlignPolicy'
description: Manner of aligning multiple variables.
status:
$ref: '#/definitions/Multivariate.ModelStatus'
description: Model status.
readOnly: true
errors:
type: array
description: Error messages after failure to create a model.
items:
$ref: '#/definitions/Multivariate.ErrorResponse'
readOnly: true
x-ms-identifiers: []
diagnosticsInfo:
$ref: '#/definitions/Multivariate.DiagnosticsInfo'
description: >-
Diagnostics information to help inspect the states of a model or
variable.
readOnly: true
required:
- dataSource
- startTime
- endTime
Multivariate.ModelList:
type: object
description: Response of listing models.
properties:
models:
type: array
description: List of models.
items:
$ref: '#/definitions/Multivariate.AnomalyDetectionModel'
x-ms-identifiers: []
currentCount:
type: integer
format: int32
description: Number of trained multivariate models.
maxCount:
type: integer
format: int32
description: >-
Maximum number of models that can be trained for this Anomaly Detector
resource.
nextLink:
type: string
description: Link to fetch more models.
required:
- models
- currentCount
- maxCount
Multivariate.ModelState:
type: object
description: Model status.
properties:
epochIds:
type: array
description: |-
Number of passes of the entire training dataset that the
algorithm has completed.
items:
type: integer
format: int32
trainLosses:
type: array
description: >-
List of metrics used to assess how the model fits the training data
for each
epoch.
items:
type: number
format: float
validationLosses:
type: array
description: >-
List of metrics used to assess how the model fits the validation set
for each
epoch.
items:
type: number
format: float
latenciesInSeconds:
type: array
description: Latency for each epoch.
items:
type: number
format: float
Multivariate.ModelStatus:
type: string
enum:
- CREATED
- RUNNING
- READY
- FAILED
x-ms-enum:
name: ModelStatus
modelAsString: true
values:
- name: Created
value: CREATED
description: >-
The model has been created. Training has been scheduled but not yet
started.
- name: Running
value: RUNNING
description: The model is being trained.
- name: Ready
value: READY
description: >-
The model has been trained and is ready to be used for anomaly
detection.
- name: Failed
value: FAILED
description: The model training failed.
Multivariate.MultivariateBatchDetectionOptions:
type: object
description: >-
Detection request for batch inference. This is an asynchronous inference
that
will need another API to get detection results.
properties:
dataSource:
type: string
format: uri
description: >-
Source link to the input data to indicate an accessible Azure Storage
URI.
It either points to an Azure Blob Storage folder or points to a CSV
file in
Azure Blob Storage, based on your data schema selection. The data
schema should
be exactly the same as those used in the training phase. The input
data must
contain at least slidingWindow entries preceding the start time of the
data
to be detected.
topContributorCount:
type: integer
format: int32
description: >-
Number of top contributed variables for one anomalous time stamp in
the response.
default: 10
startTime:
type: string
format: date-time
description: |-
Start date/time of data for detection, which should
be in ISO 8601 format.
endTime:
type: string
format: date-time
description: |-
End date/time of data for detection, which should
be in ISO 8601 format.
required:
- dataSource
- startTime
- endTime
Multivariate.MultivariateBatchDetectionResultSummary:
type: object
description: Multivariate anomaly detection status.
properties:
status:
$ref: '#/definitions/Multivariate.MultivariateBatchDetectionStatus'
description: Status of detection results.
errors:
type: array
description: Error message when detection fails.
items:
$ref: '#/definitions/Multivariate.ErrorResponse'
x-ms-identifiers: []
variableStates:
type: array
description: Variable status.
items:
$ref: '#/definitions/Multivariate.VariableState'
x-ms-identifiers: []
setupInfo:
$ref: '#/definitions/Multivariate.MultivariateBatchDetectionOptions'
description: >-
Detection request for batch inference. This is an asynchronous
inference that
will need another API to get detection results.
required:
- status
- setupInfo
Multivariate.MultivariateBatchDetectionStatus:
type: string
enum:
- CREATED
- RUNNING
- READY
- FAILED
x-ms-enum:
name: MultivariateBatchDetectionStatus
modelAsString: true
values:
- name: Created
value: CREATED
- name: Running
value: RUNNING
- name: Ready
value: READY
- name: Failed
value: FAILED
Multivariate.MultivariateDetectionResult:
type: object
description: Detection results for the resultId value.
properties:
resultId:
$ref: '#/definitions/Azure.Core.uuid'
description: >-
Result identifier that's used to fetch the results of an inference
call.
summary:
$ref: '#/definitions/Multivariate.MultivariateBatchDetectionResultSummary'
description: Multivariate anomaly detection status.
results:
type: array
description: Detection result for each time stamp.
items:
$ref: '#/definitions/Multivariate.AnomalyState'
x-ms-identifiers: []
required:
- resultId
- summary
- results
Multivariate.MultivariateLastDetectionOptions:
type: object
description: Request of the last detection.
properties:
variables:
type: array
description: >-
Contains the inference data, including the name, time stamps (ISO
8601), and
values of variables.
items:
$ref: '#/definitions/Multivariate.VariableValues'
x-ms-identifiers: []
topContributorCount:
type: integer
format: int32
description: |-
Number of top contributed
variables for one anomalous time stamp in the response. The default is
10.
default: 10
required:
- variables
Multivariate.MultivariateLastDetectionResult:
type: object
description: Results of the last detection.
properties:
variableStates:
type: array
description: Variable status.
items:
$ref: '#/definitions/Multivariate.VariableState'
x-ms-identifiers: []
results:
type: array
description: Anomaly status and information.
items:
$ref: '#/definitions/Multivariate.AnomalyState'
x-ms-identifiers: []
Multivariate.ResponseError:
type: object
description: Error response.
properties:
code:
type: string
description: Error code.
message:
type: string
description: Message that explains the error that the service reported.
required:
- code
- message
Multivariate.VariableState:
type: object
description: Variable status.
properties:
variable:
type: string
description: Variable name in variable states.
filledNARatio:
type: number
format: float
description: Proportion of missing values that need to be filled by fillNAMethod.
minimum: 0
maximum: 1
effectiveCount:
type: integer
format: int32
description: Number of effective data points before fillNAMethod is applied.
firstTimestamp:
type: string
format: date-time
description: First valid time stamp with a value of input data.
lastTimestamp:
type: string
format: date-time
description: Last valid time stamp with a value of input data.
Multivariate.VariableValues:
type: object
description: Variable values.
properties:
variable:
type: string
description: Varia
# --- truncated at 32 KB (46 KB total) ---
# Full source: https://raw.githubusercontent.com/api-evangelist/microsoft-azure/refs/heads/main/openapi/anomaly-detector-openapi-original.yml