# Anomalo > Anomalo is an AI-powered data quality and data observability platform. It connects to cloud data > warehouses and lakehouses, profiles the tables it monitors, and applies unsupervised machine learning > to detect anomalies without hand-authored rules — alongside declaratively configured validation > checks. It covers structured, semi-structured and unstructured data, performs root-cause analysis on > failures, tracks table lineage, and routes alerts to Slack, Microsoft Teams, Jira and ServiceNow. Generated by the API Evangelist enrichment pipeline on 2026-07-31. Anomalo does not publish an llms.txt of its own; docs.anomalo.com redirects to the WordPress marketing site, which returns a rendered HTML page for /llms.txt and for every /.well-known/* path. ## Key facts - Anomalo is deployed **per tenant**. There is no single shared API host — app.anomalo.com is the multi-tenant SaaS instance; enterprise customers get their own subdomain or self-host. - The REST surface is the **Anomalo Public API** at `https://{instance}/api/public/v1/`. - Authentication is an **API secret token** sent as the `X-Anomalo-Token` header (or as `Authorization: Bearer `). There are no OAuth scopes for the API. - Anomalo's **product and API documentation is gated to customers**. There is no public API reference, no public changelog, no status page and no published deprecation policy or SLA. - Anomalo publishes **no OpenAPI description**. The specs in this repository were derived by API Evangelist from Anomalo's own Apache-2.0 licensed client code; they are unofficial and not endorsed by Anomalo. ## APIs - [Anomalo Public API](https://www.anomalo.com/product-overview/): 92 operations covering warehouses, tables, checks, check runs, data profiles, labels, lineage, users, API keys, access groups and notification channels. - [Anomalo Unstructured Data API](https://github.com/datagravity-ai/anomalo-gemini-extension): 8 experimental operations for document collections, documents and content-analysis issues. ## Specs - [Anomalo Public API OpenAPI 3.1](openapi/anomalo-public-api-openapi.yml): derived from the first-party `anomalo` PyPI client 0.46.0. - [Anomalo Unstructured Data OpenAPI 3.1](openapi/anomalo-unstructured-openapi.yml): derived from `anomalo_api.py` in Anomalo's Gemini CLI extension. Experimental. - [API Evangelist overlay](overlays/anomalo-public-api-overlay.yaml): analysis layered on the Public API spec without mutating it. ## Agents and MCP - [Anomalo MCP Server](mcp/anomalo-mcp.yml): official, Apache-2.0, shipped as a Google Gemini CLI extension. A **local stdio** server — not a hosted endpoint. 9 stable tools, 2 experimental unstructured tools, 4 MCP prompts, 3 slash commands. - [Tool crosswalk](mcp/anomalo-tool-crosswalk.yml): binds every MCP tool to its backing REST operations. The MCP surface is a deliberate 17% projection of the REST surface — 10 of 11 tools are read-only, and the only write tool carries a client-side 15-minute per-table throttle. - [Agent skills](skills/_index.yml): packaged operating instructions for the marquee flows. - No A2A agent card is published at `/.well-known/agent-card.json` or `/.well-known/agent.json` on any Anomalo host. ## Conventions and semantics - [API conventions](conventions/anomalo-conventions.yml): read this before writing an integration. Three things commonly surprise people: - The **active organization is sticky server-side state**, set with `PUT /organization`, not passed per request. Concurrent clients sharing one API key interfere with each other. - **Idempotency is not supported.** No idempotency key, no deduplication, no conditional requests. - **Pagination is inconsistent** — limit/offset on administrative lists, absent on the primary data-plane listings. - [Error catalog](errors/anomalo-problem-types.yml): no problem+json, no error code registry. The first-party client raises on raw response text. 4xx is not retried; 5xx is retried 5 times with exponential jitter backoff. - [Data model](data-model/anomalo-data-model.yml): 17 entities. `Table` is the hub. Key integrations on `check_static_id`, the only durable user-controlled identifier — the numeric `check_id` does not survive delete-and-recreate. - [Authentication](authentication/anomalo-authentication.yml) - [Lifecycle](lifecycle/anomalo-lifecycle.yml): version discovery via unauthenticated `GET https://{instance}/version.txt`. ## Packages and tooling - [Packages](packages/anomalo-packages.yml): Python only. No npm, Maven, NuGet, Go, RubyGems, Packagist or crates.io client exists. - `pip install anomalo` — REST client and CLI, Apache-2.0. - `pip install apache-airflow-providers-anomalo` — Airflow operators and sensor. - [CLI](cli/anomalo-cli.yml): the `anomalo` binary. Built with python-fire over a class that subclasses the API client, so every client method is a subcommand. The purpose-built surface is configuration-as-code: `pull`, `examine`, `apply`, `destroy`, `save_config`, `load_config`. ## Security and compliance - [Conformance](conformance/anomalo-conformance.yml) - [Domain security](security/anomalo-domain-security.yml): TLS 1.3 and HSTS on both hosts; DMARC at `p=quarantine`; **no SPF, no DNSSEC, no CAA**. - [OIDC scopes](scopes/anomalo-scopes.yml): OAuth/OIDC covers **web app sign-on only**, not the API. - SOC 2 Type 2 (audited by Sensiba San Filippo) and ISO 27001, per badges on [the legal page](https://www.anomalo.com/legal/). - No security.txt, no published vulnerability disclosure policy, no bug bounty program, no trust center. ## Docs and links - [Website](https://www.anomalo.com/) - [Product overview](https://www.anomalo.com/product-overview/) - [Integrations](https://www.anomalo.com/integrations/) - [Blog](https://www.anomalo.com/blog/) - [Request support](https://www.anomalo.com/request-support/) - [Contact](https://www.anomalo.com/contact-us/) - [GitHub (anomalo-hq)](https://github.com/anomalo-hq) - [Subscription agreement](https://www.anomalo.com/legal/subscription/) - [Privacy policy](https://www.anomalo.com/legal/privacy/) - [Data processing addendum](https://www.anomalo.com/legal/dpa/)