Skip to content

Anomalies FAQ

Answers to common questions about anomalies in Qualytics. Sections are grouped by topic; pick the heading closest to what you are working on.

General

What is an anomaly?

An anomaly is a data point that deviates from the expectations a quality check defines. A check that requires customer_id to be non-null produces an anomaly for every row where that field is null in a given scan. Anomalies are how Qualytics surfaces what needs human attention.

How are anomalies created?

Anomalies are created automatically by Scan operations. When a scan runs, every Active quality check is evaluated against the scoped data; rows or schema observations that fail the check produce anomalies. See Detection for the full pipeline.

What's the AI badge on an anomaly?

The AI badge (purple pill with a four-point star) marks an anomaly whose failed checks are all AI Managed. Hovering reveals "Identified by AI managed checks." See Overview for the criteria.

Types

What is the difference between Record and Shape anomalies?

A Record anomaly flags a single row that fails a value-level check (missing value, out-of-range, pattern mismatch). A Shape anomaly flags a structural problem (missing column, schema drift, unexpected type). See Deep Dive · Types for examples and trade-offs.

Can a single anomaly mix both types?

No. Each anomaly is either record or shape. The two share the same status, history, and notification surface, but their failed_checks semantics differ: record anomalies link to row-level checks, shape anomalies to structural checks.

Status and lifecycle

What is the difference between Active, Acknowledged, and Archived?

Active means the anomaly was detected and nobody has triaged it. Acknowledged means someone reviewed it and decided it needs follow-up but is not yet resolved; it remains in the open queue. Archived is a terminal state with one of four resolutions: Resolved, Duplicate, Invalid, or Discarded. See Deep Dive · Status for what each resolution means.

Can an Acknowledged anomaly go back to Active?

Yes. While an anomaly stays in the open queue you can switch freely between Active and Acknowledged from the status picker. Acknowledgement is a soft label, not a one-way gate. The only direction that is blocked is Archived → Active: to bring an archived anomaly back, restore it (which lands it in Acknowledged, not Active).

How do I restore an archived anomaly?

Open the anomaly and click Restore, or call PUT /api/anomalies/{id} with "status": "Acknowledged". The anomaly returns to the Acknowledged state; it cannot go directly back to Active. See Restore Anomalies.

Fingerprints and duplicates

What is an anomaly fingerprint?

A fingerprint is a deterministic identifier the platform generates for each anomaly. Two anomalies that describe the same issue on the same data get the same fingerprint, so Qualytics can detect and archive duplicates automatically. See Deep Dive · Fingerprints.

Why are my truncate-and-reload tables generating duplicate anomalies every scan?

Because every reload creates fresh _qualytics_self_id values, which makes the record look new to the engine. Enable both Archive Duplicate Anomalies and the fingerprint-based handling described in Fingerprints · Truncate-and-reload tables so the platform recognises the recurring rows.

Should I archive an anomaly as Duplicate or as Discarded?

If you can identify the original anomaly the new one duplicates, set Duplicate and reference the original in the comment. If you can't (or the engine archived it on its own without a back-reference), prefer Discarded to keep fingerprinting accurate.

Tags

Can I tag many anomalies at once?

Yes. Use Bulk Edit Anomalies from the anomalies list, turn on the Tags toggle, pick the tags, and save. See Bulk-Edit Tags for the full flow. Bulk edit replaces the tag set on each selected anomaly; it does not merge with existing tags.

Are anomaly tags the same catalog as check tags?

Yes. Both anomalies and checks pull from the same platform-level tag catalog (see Tags), so a tag like HIPAA means the same thing wherever it appears.

Comments and tickets

Who can comment on an anomaly?

Anyone with at least the Viewer team permission on the datastore can post and read comments. Editing or deleting a comment is restricted to the comment author (admins can also delete others' comments). See History.

Can I mention a teammate in a comment?

Yes, use the @ token and pick from the autocomplete. Mentioned users receive an in-app Mention notification linking to the anomaly. See In-App Notifications · What Triggers a Notification.

Yes, once the corresponding Ticketing Integration is configured. From the anomaly details, click Add in the Tickets section to link an existing ticket or to create a new one. Linking requires the Manager role plus the Author team permission on the datastore.

Source records

Why doesn't my anomaly have source records?

Source records require a linked Enrichment Datastore on the source datastore. Without one, the platform has nowhere to store the failing rows, and the Source Records section on the anomaly stays empty. See Source Record.

How fresh are the source records I see?

Source records are cached locally for up to 8 hours to keep the UI responsive. Click the Refresh button in the Source Records toolbar to bypass the cache and re-fetch from the API.

How many source records can I download?

The CSV download includes every record that was captured during the scan, up to the maximum source records per anomaly configured in your Scan settings. The CSV is capped at 250 MB.

Can I see the raw value of a masked field?

Only if you have the Editor team permission on the container. The download/view request must include include_masked=true; the platform records an audit-log entry naming each masked field you read. See the Source records API.

Assignees

Why didn't a new anomaly auto-assign anyone?

Auto-assignment only happens when at least one of the quality checks that produced the anomaly has a Default Anomaly Assignee set. If every contributing check has the default empty, the anomaly is created with no assignees. See Inheritance from the originating check.

I changed the check's Default Anomaly Assignee. Why didn't existing anomalies pick it up?

Inheritance happens only at the moment the anomaly is created. Updating a check's default later does not retroactively change anomalies that already exist. To update them, edit the anomalies directly (individually via Add Anomaly Assignees or via Bulk-Assign Anomalies).

Two checks failed on the same row. Whose default assignee wins?

Both. When an anomaly is produced by multiple failed checks, the default assignees of every contributing check are combined into a single list with duplicates removed, then applied to the anomaly. So a row that fails check A (defaulting to Alice) and check B (defaulting to Bob) creates an anomaly with Alice and Bob as assignees.

Can a user with only the Viewer team permission be an assignee?

Yes. Viewer is the minimum requirement to be assigned. Viewers see the anomaly and receive notifications, but they cannot edit the assignee list themselves.

A user does not show up in the assignee picker. Why?

The picker only lists users that have at least the Viewer team permission on the datastore where the anomaly lives. If a teammate is missing, check their team membership in Team Permissions.

Do I get notified when I assign myself to an anomaly?

No. You do not receive notifications for changes you make yourself. Other assignees on the same anomaly do get notified.

What about the very first time an assignee is added? Do they get a notification?

Yes. A newly added user is part of the recipient set for the same update event, so the first thing they hear about the anomaly is the Assignment notification linking to it.

Can I edit assignees on an archived anomaly?

No. Archived anomalies are read-only with respect to assignees. Restore the anomaly to Acknowledged first; see Restore Anomalies.

How do I unassign everyone from an anomaly?

Open the anomaly, click the Edit button next to Assignees, and remove every selected user. Via the API, send "assignee_ids": []; see API · Manage assignees.

Can I filter for anomalies that have no assignees?

There is no first-class Unassigned filter today. The Assignees filter only accepts user IDs and returns anomalies where any selected user is an assignee. Workarounds: sort by Assignees so empty lists float to one end, or use the GET /anomalies endpoint and filter client-side on the assignees array length.

What is the difference between the Assignees filter and the Assigned subtab?

The Assignees filter lets you pick any users and shows anomalies assigned to any of them. The Assigned subtab (inside the Open tab) is a one-click shortcut to "open anomalies assigned to me," scoped to your own user.

Permissions

Who can view an anomaly?

Any user with at least the Viewer team permission on the datastore that produced the anomaly.

Who can edit an anomaly?

Users with the Author team permission (or higher) on the datastore can edit status, tags, and assignees. Description edits additionally require the Editor team permission. Archive and delete also require the Author team permission. Linking external tickets requires the Manager role plus the Author team permission on the datastore.

Can a Member without team access see an anomaly?

No. Anomaly visibility is scoped to the team permissions on the datastore. A Member without any team that owns the datastore sees an empty list.

Can I combine filters?

Yes. Every filter narrows the same result set, and the filters are combined with AND. Within a single filter (for example, Tags), values are combined with OR. So Tags: HIPAA, SOX + Status: Active returns active anomalies tagged with HIPAA or SOX. See Filter & Sort for the full list of supported filters.

Can I search the anomaly message text?

Yes. The Search field (or ?search= on the list endpoint) does substring matching against the anomaly message and the numeric ID.

Bulk operations

What can I bulk-edit on multiple anomalies?

From the UI's Bulk Edit Anomalies modal: Tags and Assignees. Status and description must be set per anomaly in the UI. The PATCH /anomalies API accepts all four fields per entry if you prefer to script bulk status or description changes. See Bulk-Edit Tags and Bulk-Assign Anomalies for the UI flows. To add assignees to a single anomaly, see Add Anomaly Assignees.

Does bulk edit merge or replace?

It replaces. The values you choose in the bulk-edit modal become the new value for every selected anomaly; previous tags or assignees not in your selection are removed. If you want to preserve previous values, edit each anomaly individually.

Can I bulk archive?

Yes. Select multiple anomalies, click the Bulk menu button in the selection toolbar, and choose Archive. The API equivalent is the bulk delete endpoint with archive=true; see Bulk archive or delete.