# BGP Update Anomaly Detector

> BGP Update Anomaly Detector is a paid API for AI agents from netz.halowerk.com, paid per call via x402, $0.005/call, status unknown (last checked 2026-09-15).

Counts BGP updates for a prefix or AS in a recent window and compares against a self-calibrated baseline to detect routing update anomalies.

## Facts

- Endpoint: POST https://netz.halowerk.com/v1/bgp-update-anomaly
- Price: $0.005/call
- Payment: x402
- Status: unknown
- Last checked: 2026-09-15
- Activations on Zero: 0
- Tags: x402
- Canonical page: https://www.zero.xyz/c/bgp-update-anomaly-detector-8d4f3648
- Structured record (JSON): https://api.zero.xyz/v1/capabilities/cap_aIun39OdNR0HBg8XN8qeY

Status and success rate cover calls made through Zero and Zero's own probes. Third-party monitors may report differently.

## How to call it through Zero

Zero handles the 402 payment challenge and records the run. With the Zero CLI installed (`npm i -g @zeroxyz/cli`):

```sh
zero fetch --capability bgp-update-anomaly-detector-8d4f3648 -d '<json body>'
```

Example prompt: Check whether AS15169 is experiencing an abnormal BGP update rate right now — compare the recent window against its own historical baseline and tell me if there's an anomaly.

## When to prefer this

Use this endpoint when you need adaptive, self-calibrated BGP anomaly detection that accounts for each resource's own scale — especially when fixed thresholds would be either too noisy for large ASes or too blind for small ones. Prefer it over generic BGP monitoring when you want a relative deviation signal rather than an absolute count comparison.

## Known failure modes

- Unknown or unrouted prefix returns no data
- Invalid ASN format returns a validation error
- Insufficient historical data for baseline computation returns an inconclusive result
- Resource with very low BGP activity may produce high variance baselines
- Network data gaps during the baseline period may skew the comparison

## How this service works

Counts BGP updates for a prefix or an autonomous system in a recent window and compares them against a baseline built from a longer preceding period for the same resource. The comparison is deliberately self-referential: an AS with a hundred prefixes has a different normal than one with ten thousand, and a fixed threshold is blind for the first and a permanent alarm for the second.

## Output

Returns the BGP update count observed in the recent window, the expected baseline count derived from the preceding longer period for the same resource, a deviation metric, and an anomaly verdict — all normalized to the resource's own historical behavior rather than a fixed threshold.

## Request schema (JSON Schema)

```json
{
 "type": "object",
 "properties": {
  "resource": {
   "type": "string",
   "maxLength": 60,
   "minLength": 2,
   "description": "A prefix like 8.8.8.0/24 or an AS like AS3320."
  },
  "sensitivity": {
   "enum": [
    "low",
    "normal",
    "high"
   ],
   "type": "string",
   "default": "normal"
  },
  "window_hours": {
   "type": "integer",
   "default": 6,
   "maximum": 48,
   "minimum": 1,
   "description": "The recent window to examine."
  },
  "baseline_hours": {
   "type": "integer",
   "default": 72,
   "maximum": 336,
   "minimum": 6,
   "description": "The preceding period used to build the baseline."
  }
 }
}
```

## More

- Live health (JSON, refreshed every minute): https://www.zero.xyz/c/bgp-update-anomaly-detector-8d4f3648/health.json
- [Zero catalog index](https://www.zero.xyz/llms.txt)
- [Other services from netz.halowerk.com](https://www.zero.xyz/host/netz.halowerk.com/llms.txt)