Detecting API anomalies behind a 200 OK — with statistics, not AI

Short summary

Uptime monitors often miss broken endpoints that return 200 OK—like cached errors, truncated payloads, or sudden slowdowns. This post explains per-endpoint statistical baselines (rolling mean, standard deviation, 3-sigma detection) with guardrails to catch anomalies. The author deliberately uses LLMs only for explaining anomalies, not detecting them, arguing that deterministic statistics are cheaper and more trustworthy than ML.

• •Per-endpoint baselines catch 200-OK failures (cached errors, empty payloads, slowdowns)
• •3-sigma statistical detection with anti-flapping guards replaces noisy ML
• •LLM explains the anomaly; math decides whether it's anomalous

Generated with AI, which can make mistakes.