# Netzhandwerker Anomaly Detection (Multi-Method Time Series)

> Netzhandwerker Anomaly Detection (Multi-Method Time Series) is a paid API for AI agents from tools.halowerk.com, paid per call via x402, $0.004/call, status unknown (last checked 2026-10-12).

Runs up to three anomaly detectors (robust z-score, STL residual, isolation forest) over a numeric series and returns per-point scores so callers can apply their own thresholds.

## Facts

- Endpoint: POST https://tools.halowerk.com/v1/series/anomaly?utm_source=zero.xyz
- Price: $0.004/call
- Payment: x402
- Status: unknown
- Last checked: 2026-10-12
- Activations on Zero: 0
- Tags: x402
- Canonical page: https://www.zero.xyz/c/netzhandwerker-anomaly-detection-multi-method-time-series-56048a28
- Structured record (JSON): https://api.zero.xyz/v1/capabilities/cap_lqRfzwml70F-BZiz5vXnJ

Status and success rate cover calls made through Zero and Zero's own probes. Third-party monitors may report differently.

## How to call it through Zero

Zero handles the 402 payment challenge and records the run. With the Zero CLI installed (`npm i -g @zeroxyz/cli`):

```sh
zero fetch --capability netzhandwerker-anomaly-detection-multi-method-time-series-56048a28 -d '<json body>'
```

Example prompt: Check this array of 200 hourly server latency readings for anomalies — run all three detectors (robust z-score, STL residual, and isolation forest) with a season period of 24, set the contamination to 0.05, and require at least 2 detectors to agree before flagging a point.

## When to prefer this

Choose this endpoint when you need transparent, per-point anomaly scores from multiple independent methods rather than a single black-box verdict. It is especially valuable when you want to set your own thresholds, compare method agreement, or handle seasonal data with STL decomposition. The deterministic isolation forest (fixed seed) makes it suitable for reproducible pipelines. Prefer it over single-method detectors when data may have both global outliers (robust z-score) and seasonal anomalies (STL residual).

## Known failure modes

- Fewer than 3 points provided — minimum series length not met
- Request body exceeds 256 KB limit before reaching maxItems cap
- season_period set too high relative to series length — STL marked as not robust
- Invalid method enum value in methods array
- contamination outside allowed range (0.0001–0.5)
- trees or sample_size outside allowed bounds
- Malformed point objects (missing value field)

## How this service works

Runs three detectors over one series and reports what each saw: a robust z score on median and median absolute deviation, a robust seasonal-trend decomposition with a z score on the residual, and an isolation forest over value and step-to-previous. Every score is returned per point, so callers set their own threshold instead of trusting a verdict. The forest draws from a fixed seed: same request, same result. Under three full cycles the seasonal figure is marked as not robust.

## Output

A per-point response containing scores from each requested detector: the absolute robust z-score, the STL residual z-score (marked as not robust if fewer than three full seasonal cycles are present), and the isolation forest anomaly score — plus an aggregated flag indicating whether enough detectors agreed based on min_votes. Raw scores are always returned so callers can apply custom thresholds independently of the built-in verdict.

## Request schema (JSON Schema)

```json
{
 "type": "object",
 "properties": {
  "seed": {
   "type": "integer",
   "default": 42,
   "maximum": 2147483647,
   "minimum": 0,
   "description": "Fixed starting value for the forest. Same seed, same answer."
  },
  "trees": {
   "type": "integer",
   "default": 100,
   "maximum": 300,
   "minimum": 10,
   "description": "Number of isolation trees."
  },
  "points": {
   "type": "array",
   "maxItems": 5000,
   "minItems": 3,
   "description": "Either plain numbers or objects with value and optionally time_unix_s (seconds since 1970), time (ISO 8601) and label. The service caps the whole request body at 256 KB, so long records reach that limit before maxItems."
  },
  "methods": {
   "type": "array",
   "items": {
    "enum": [
     "robust_z",
     "stl_residual",
     "isolation_forest"
    ],
    "type": "string"
   },
   "default": [
    "robust_z",
    "stl_residual",
    "isolation_forest"
   ],
   "maxItems": 3,
   "minItems": 1,
   "description": "Which detectors to run."
  },
  "min_votes": {
   "type": "integer",
   "default": 1,
   "maximum": 3,
   "minimum": 1,
   "description": "How many detectors must agree before a point is called an anomaly."
  },
  "sample_size": {
   "type": "integer",
   "default": 256,
   "maximum": 1024,
   "minimum": 8,
   "description": "Points drawn per tree, capped at the series length."
  },
  "contamination": {
   "type": "number",
   "default": 0.02,
   "maximum": 0.5,
   "minimum": 0.0001,
   "description": "Expected share of outliers. Sets where the isolation forest cuts."
  },
  "season_period": {
   "type": "integer",
   "default": 0,
   "maximum": 1000,
   "minimum": 0,
   "description": "Points per season, e.g. 24 for hourly data with a daily rhythm. 0 leaves the seasonal part out."
  },
  "stl_z_threshold": {
   "type": "number",
   "default": 3.5,
   "maximum": 20,
   "minimum": 0.5,
   "description": "Threshold on the robust z score of the residual."
  },
  "robust_z_threshold": {
   "type": "number",
   "default": 3.5,
   "maximum": 20,
   "minimum": 0.5,
   "description": "Absolute robust z score at which a point counts as an outlier."
  }
 }
}
```

## More

- Live health (JSON, refreshed every minute): https://www.zero.xyz/c/netzhandwerker-anomaly-detection-multi-method-time-series-56048a28/health.json
- [Zero catalog index](https://www.zero.xyz/llms.txt)
- [Other services from tools.halowerk.com](https://www.zero.xyz/host/tools.halowerk.com/llms.txt)