> ## Documentation Index
> Fetch the complete documentation index at: https://docs.airctrl.dev/llms.txt
> Use this file to discover all available pages before exploring further.

# List record anomalies

> Returns unusual record events for the caller or one project. Project scope requires audit:read.



## OpenAPI

````yaml /api-reference/openapi.json get /audit/record-anomalies
openapi: 3.0.0
info:
  title: AIRCTRL API
  description: >-
    Programmatic access to AIRCTRL. Record values are encrypted by the client,
    so the API stores ciphertext and encrypted keys instead of plaintext record
    values.
  version: '1'
  contact: {}
servers:
  - url: https://api.airctrl.dev/v1
    description: Production
security: []
tags:
  - name: Context
    description: Find the accounts available to the caller.
  - name: Projects
    description: Create and manage projects.
  - name: Records
    description: Store and use client-encrypted records.
  - name: Audit
    description: Read record activity and access history.
  - name: Providers
    description: Discover supported AI providers.
  - name: Provider Credentials
    description: Manage encrypted provider credentials.
  - name: Gateways
    description: Create and operate AI gateways.
  - name: Usage
    description: Read gateway usage and spend data.
  - name: Service Accounts
    description: Read Service Account metadata and grant records.
paths:
  /audit/record-anomalies:
    get:
      tags:
        - Audit
      summary: List record anomalies
      description: >-
        Returns unusual record events for the caller or one project. Project
        scope requires audit:read.
      operationId: AuditController_recordAnomalies
      parameters:
        - name: x-account-id
          required: true
          in: header
          schema:
            type: string
        - name: scopeType
          required: false
          in: query
          schema:
            type: string
        - name: scopeId
          required: false
          in: query
          schema:
            type: string
      responses:
        '200':
          description: Record anomaly events.
          content:
            application/json:
              schema:
                type: object
                properties:
                  ok:
                    type: boolean
                    enum:
                      - true
                  data:
                    type: array
                    items:
                      $ref: '#/components/schemas/RecordAnomaly'
                required:
                  - ok
                  - data
                additionalProperties: false
        '401':
          $ref: '#/components/responses/Unauthorized'
        '403':
          $ref: '#/components/responses/Forbidden'
        '429':
          $ref: '#/components/responses/RateLimited'
        '500':
          $ref: '#/components/responses/InternalError'
      security:
        - personal-access-token: []
components:
  schemas:
    RecordAnomaly:
      type: object
      properties:
        event_id:
          type: string
          format: uuid
        action:
          type: string
        created_at:
          type: string
          format: date-time
        entity_id:
          type: string
          format: uuid
          nullable: true
      additionalProperties: false
      required:
        - event_id
        - action
        - created_at
        - entity_id
    ErrorEnvelope:
      type: object
      properties:
        ok:
          type: boolean
          enum:
            - false
        error:
          type: object
          properties:
            code:
              type: string
              description: Stable error category.
            message:
              type: string
              description: Plain-language reason for the failure.
            details:
              description: Optional validation or error details.
          additionalProperties: false
          required:
            - code
            - message
        requestId:
          type: string
          description: Request identifier to include when contacting support.
      additionalProperties: false
      required:
        - ok
        - error
      description: Standard AIRCTRL error response.
  responses:
    Unauthorized:
      description: >-
        The token is missing, invalid, expired or cannot authenticate this
        request.
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/ErrorEnvelope'
          example:
            ok: false
            error:
              code: unauthorized
              message: Authentication is required
            requestId: req_example
    Forbidden:
      description: >-
        The authenticated principal does not have the required permission or
        resource access.
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/ErrorEnvelope'
          example:
            ok: false
            error:
              code: forbidden
              message: not_authorized
            requestId: req_example
    RateLimited:
      description: The caller exceeded the API request limit. Wait before retrying.
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/ErrorEnvelope'
          example:
            ok: false
            error:
              code: rate_limited
              message: Too many requests
            requestId: req_example
    InternalError:
      description: >-
        AIRCTRL could not complete the request. Retry later and keep the request
        ID for support.
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/ErrorEnvelope'
          example:
            ok: false
            error:
              code: internal_error
              message: Internal server error
            requestId: req_example
  securitySchemes:
    personal-access-token:
      scheme: bearer
      bearerFormat: JWT
      type: http
      description: Human personal access token (`sk-actrl-pat-...`).

````