Ranked shifts against each service's own baseline

Precomputed anomalies: worsening regime shifts (BOCPD changepoints, threshold-free) detected continuously over persisted 5-minute series of every signal — error_rate and latency_p95 per operation, log_volume, error_log_rate and profile_cost (the service's total profiled cost) per service (the operation field holds the entity) — and persisted to the sigiro_anomalies table. Ordered by the unit-free shift magnitude (after - before) / (after + before) descending (1.0 = appeared from a zero baseline, 1/3 = doubled), so the most significant shifts lead regardless of the signal's units — nothing is filtered out; judge significance from before/after (raw signal units: %, µs, logs, profile cost). Optionally filter by service and a from_ts/to_ts window (microseconds since the Unix epoch) over the shift time. Each row carries a ready-to-run drill_down_sql for POST /v1/query. Rows whose shifts fall in the same or adjacent 5-minute detection bucket on the same service share an incident_id — one incident across signals, not N independent anomalies (the correlation window is the detection pass's own bucket resolution, never a tuned threshold); incident_id is null for uncorrelated rows.

curl -X GET "https://api.sigiro.com/v1/anomalies" \
  -H "Authorization: Bearer $SIGIRO_KEY"

{
  "anomalies": [
    {
      "after": 0.1,
      "before": 0.1,
      "detected_at": "string",
      "direction": "string",
      "drill_down_sql": "string",
      "incident_id": "string",
      "kind": "string",
      "operation": "string",
      "service_name": "string",
      "signal": "string",
      "ts_shift": "string",
      "ts_shift_us": 0
    }
  ]
}