# OT Intel API – Root Cause Localization (Sensor Z-Score Ranking)

> OT Intel API – Root Cause Localization (Sensor Z-Score Ranking) is a paid API for AI agents from ot-intel-api.onrender.com, paid per call via x402, $0.15/call, status unknown (last checked 2026-09-14).

Ranks which OT/ICS sensors most likely caused a reported anomaly by computing z-score deviations from each sensor's baseline, returning a deterministic ordered list of suspect sensors.

## Facts

- Endpoint: GET https://ot-intel-api.onrender.com/ot/xai/root-cause-localization
- Price: $0.15/call
- Payment: x402
- Status: unknown
- Last checked: 2026-09-14
- Activations on Zero: 0
- Tags: x402
- Canonical page: https://www.zero.xyz/c/ot-intel-api-root-cause-localization-sensor-z-score-ranking-b0a7e241
- Structured record (JSON): https://api.zero.xyz/v1/capabilities/cap_8a_LnvL6NOG-Pw3Vewmbp

Status and success rate cover calls made through Zero and Zero's own probes. Third-party monitors may report differently.

## How to call it through Zero

Zero handles the 402 payment challenge and records the run. With the Zero CLI installed (`npm i -g @zeroxyz/cli`):

```sh
zero fetch --capability ot-intel-api-root-cause-localization-sensor-z-score-ranking-b0a7e241
```

Example prompt: We just had an anomaly event ID EVT-2041 on our SCADA system — here are readings from 5 sensors over the last 10 minutes with their baselines. Can you rank which sensors deviated the most from normal and give me the top 3 most likely root causes?

## When to prefer this

Choose this endpoint when you need fast, deterministic, statistically-grounded sensor ranking for OT/ICS anomaly triage and do not want to rely on an LLM or trained model. It is ideal for industrial SOC automation workflows where auditability and reproducibility of root cause attribution matter. Prefer it over ML-based approaches when you have per-sensor baseline statistics available and need a transparent z-score explanation an operator can verify.

## Known failure modes

- window array exceeds 20 entries — request is rejected
- missing required window parameter — returns 400-level error
- malformed or non-URL-encoded JSON in window parameter — parse error
- baseline_mean or baseline_stddev missing and cannot be inferred — may return degraded or partial results
- top_k value is non-numeric or out of range — defaults to 5 or error
- payment not processed — 402 response blocking access

## How this service works

Ranks which sensors most likely drove a reported anomaly by z-score deviation from each sensor baseline, given a caller-supplied telemetry window. Pass window=<JSON array, max 20>: [{sensor_id, values[], baseline_mean?, baseline_stddev?}], optional top_k (default 5), anomaly_event_id. Fully deterministic, no LLM, no trained model. Statistical approximation inspired by Oswal et al. 2025 kernel-SHAP/TCAE work — not a reimplementation of it.

## Output

An ordered list of up to top_k sensors ranked by z-score magnitude away from their baseline, including each sensor's ID, computed z-score, and deviation direction. The optional anomaly_event_id is echoed back for correlation. The result is fully deterministic — no ML model or LLM is involved.

## Request schema (JSON Schema)

```json
{
 "type": "object",
 "$schema": "https://json-schema.org/draft/2020-12/schema",
 "required": [
  "input"
 ],
 "properties": {
  "input": {
   "type": "object",
   "required": [
    "type",
    "method"
   ],
   "properties": {
    "type": {
     "type": "string",
     "const": "http"
    },
    "method": {
     "enum": [
      "GET"
     ],
     "type": "string"
    },
    "queryParams": {
     "type": "object",
     "required": [
      "window"
     ],
     "properties": {
      "top_k": {
       "type": "string",
       "description": "How many ranked sensors to return, default 5 (numeric string)"
      },
      "window": {
       "type": "string",
       "description": "URL-encoded JSON array, max 20 entries: [{sensor_id, values[], baseline_mean?, baseline_stddev?}]"
      },
      "anomaly_event_id": {
       "type": "string",
       "description": "Optional correlation ID, echoed back unchanged"
      }
     }
    }
   },
   "additionalProperties": false
  },
  "output": {
   "type": "object",
   "required": [
    "type"
   ],
   "properties": {
    "type": {
     "type": "string"
    },
    "example": {
     "type": "object"
    }
   }
  }
 }
}
```

## More

- Live health (JSON, refreshed every minute): https://www.zero.xyz/c/ot-intel-api-root-cause-localization-sensor-z-score-ranking-b0a7e241/health.json
- [Zero catalog index](https://www.zero.xyz/llms.txt)
- [Other services from ot-intel-api.onrender.com](https://www.zero.xyz/host/ot-intel-api.onrender.com/llms.txt)