canonical: https://jentic.com/apis/azure.com/anomaly-finder-client

# Microsoft Azure Azure Anomaly Finder Client

Jentic publishes the only available OpenAPI specification for Azure Anomaly Finder Client, keeping it validated and agent-ready. The API runs unsupervised anomaly detection on numeric time series data. Two operations cover the common modes: batch detection over an entire series with a model trained on the supplied points, and last-point detection that scores only the most recent value against a model trained on the prior history. It is a building block for incident detection, fraud signals, and capacity-planning alerts.

## For AI agents

Score a numeric time series for anomalies in batch or detect whether the most recent point is an outlier given prior history.

## Scope

Does not store time series, train custom models, or trigger downstream alerts - use only to score supplied numeric series for anomalies.

## Capabilities

- Detect anomalies across an entire time series in a single batch call
- Score only the latest point in a series against a model trained on prior values
- Configure sensitivity and granularity (hourly, daily) per request
- Return upper, lower, and expected values alongside each anomaly flag
- Operate stateless: the model is trained from the points supplied per call

## Use cases

### Operational Metrics Outlier Detection

SRE teams stream KPIs (latency, error rate, throughput) and call /timeseries/last/detect to score the most recent point against the prior window. The API returns isAnomaly, expectedValue, and upper/lower bounds, so an alert pipeline can fire only on statistically significant deviations rather than threshold-based rules.

Example prompt: POST /timeseries/last/detect with the last 168 hourly latency points and granularity=hourly, then alert if isAnomaly is true

### Backfill Anomaly Scoring on Historical Series

Analytics teams reviewing a quarter of business KPIs use /timeseries/entire/detect to score the full series in one call. The response flags each point as anomaly or not, supporting offline incident review and cohort analysis without standing up a custom ML pipeline.

Example prompt: POST /timeseries/entire/detect with 90 daily revenue points and granularity=daily and return all indices flagged as anomalies

### Sensitivity Tuning for Noisy Signals

Some signals (consumer foot traffic, spiky API calls) are inherently bursty. The sensitivity parameter on both endpoints lets a caller widen or tighten the expected band so that genuine anomalies surface and routine spikes are ignored. This avoids alert fatigue without retraining a custom model.

Example prompt: Run /timeseries/entire/detect with sensitivity=85 and compare flagged points against the default sensitivity=99 result

### Agent-Driven Incident Triage

An AI agent reviewing an alert can pull the relevant metric series, call Anomaly Finder, and decide whether the spike is a true outlier before paging a human. Through Jentic, intent search returns the right detect endpoint with its input schema, the API key is held in the credential vault, and the agent gets back a clean isAnomaly verdict in one call.

Example prompt: Search Jentic for 'detect anomaly in time series', load /timeseries/last/detect, and execute against the most recent 24 points with granularity=hourly

## Key endpoints

| Method | Path | Description |
| --- | --- | --- |
| POST | /timeseries/entire/detect | Detect anomalies across an entire series |
| POST | /timeseries/last/detect | Detect whether the latest point is an anomaly |

## Key resources

- **Time Series Detect (Entire)** — Score every point in a supplied series for anomalies
- **Time Series Detect (Last)** — Score only the latest point against a model trained on prior values

## Why Jentic

- **Setup:** Wiring Azure Anomaly Finder by hand means learning its Cognitive Services subscription-key auth in the Ocp-Apim-Subscription-Key header, picking the right regional endpoint such as westus2.api.cognitive.microsoft.com, and shaping the point series and granularity for each detect call yourself. Through Jentic you install once, import Azure Anomaly Finder from the API Directory, store the subscription key once, and your agent calls it.
- **Permission scoping:** Anomaly Finder carries the time series and its granularity in the request body, not in the URL path, so scoping is by operation rather than by any resource id. Limit the agent to the operations it needs, such as batch detection over an entire series or last-point detection, and it can score numeric series without gaining any operation you did not grant.
- **Credential handling:** Your Cognitive Services subscription key is stored once, encrypted, by your own Jentic One instance and injected into the Ocp-Apim-Subscription-Key header at execution time. It never enters the agent's prompt, logs, or context.
- **Discovery method:** Agents search Jentic by intent such as 'detect anomaly in time series' or 'check whether the latest metric point is an outlier', and Jentic returns the matching detect operation with its input schema so the agent supplies the points and granularity without reading the Cognitive Services reference.

## Related APIs

- **Azure Cognitive Services Management Client** — Provisions and manages the Cognitive Services account whose key authenticates Anomaly Finder calls.
- **Azure Monitor Management Client** — Source of the metric series often passed to Anomaly Finder for scoring.
- **Azure Application Insights Management Client** — Collects custom telemetry that can be passed to Anomaly Finder as input.
- **Google Cloud Monitoring API** — GCP equivalent for metric storage and anomaly-style alert policies.

## FAQ

### Why is there no official OpenAPI spec for Azure Anomaly Finder Client?

Microsoft Azure does not publish an OpenAPI specification. Jentic generates and maintains this spec so that AI agents and developers can call Azure Anomaly Finder Client via structured tooling. It is validated against the live API and kept up to date. Get started with Jentic One, the self-hosted execution layer.

### What authentication does the Azure Anomaly Finder API use?

The API uses an Azure Cognitive Services subscription key passed in the Ocp-Apim-Subscription-Key header (apiKeyHeader scheme). Through Jentic, the key is stored encrypted in your Jentic One instance and injected at execution time, so agents never see the raw secret.

### Can I detect anomalies on streaming metrics with this API?

Yes. Use POST /timeseries/last/detect on each cycle with the recent window of points; the API trains on the supplied prior values and scores the last point. The call is stateless, so you control the window and granularity per request.

### What time series granularities are supported?

The endpoints accept the granularity field in the request body. Common values are hourly, daily, and minutely. The granularity must match the spacing of the supplied points; mixing densities produces unstable scores.

### What are the rate limits for the Azure Anomaly Finder API?

Limits are tied to the Cognitive Services pricing tier of the resource backing the subscription key. Free F0 tiers cap at low transactions per second; standard tiers go higher. Honour HTTP 429 Retry-After values and batch with /timeseries/entire/detect when scoring long histories.

### How do I run anomaly detection on a metric through Jentic?

Run pip install jentic, then search Jentic with 'detect anomaly in time series'. Jentic returns POST /timeseries/last/detect with its input schema. Load the schema, execute with your point series and granularity, and act on isAnomaly. The Cognitive Services key is resolved from the vault automatically.

### Can I limit what my agent is allowed to do with the Azure Anomaly Finder API?

Yes. Because you run Jentic One yourself, your own rules decide which operations and credentials the agent may use. This API carries the time series and its granularity in the request body rather than in the URL path, so you scope access by operation: grant only batch detection over an entire series (POST /timeseries/entire/detect), only last-point detection (POST /timeseries/last/detect), or both. The agent can score numeric series with exactly the operations you allow and nothing you did not grant.