Submit an alert

This guide walks through submitting a new alert to Doppel for an entity (a URL or phone number) you want investigated. Submitting an alert tells Doppel to triage the entity through its standard workflow and return a handle you can use to follow up.

What you'll do

1. Get an OAuth access token (see Authentication).
2. POST /v2/alert with the entity and brand.
3. Capture the alert id from the response so you can check the status or request a takedown later.

Prerequisites

• A valid access token (see Authentication).
• The exact name of an active brand in your organization. Brand names are case-insensitive but must match an existing, non-archived brand. Use GET /v2/brands to list yours if you're unsure.

Submit an alert

cURL

curl --request POST \
  --url "https://api.doppel.com/v2/alert" \
  --header "Authorization: Bearer <YOUR_ACCESS_TOKEN>" \
  --header "Content-Type: application/json" \
  --data '{
    "entity": "https://suspicious-site.example.com",
    "brand": "Acme Corp",
    "tags": ["Credential Theft"]
  }'

Python

import requests

response = requests.post(
    "https://api.doppel.com/v2/alert",
    headers={"Authorization": f"Bearer {access_token}"},
    json={
        "entity": "https://suspicious-site.example.com",
        "brand": "Acme Corp",
        "tags": ["Credential Theft"],
    },
)
response.raise_for_status()
alert = response.json()
alert_id = alert["id"]

Node.js

const response = await fetch("https://api.doppel.com/v2/alert", {
  method: "POST",
  headers: {
    Authorization: `Bearer ${access_token}`,
    "Content-Type": "application/json",
  },
  body: JSON.stringify({
    entity: "https://suspicious-site.example.com",
    brand: "Acme Corp",
    tags: ["Credential Theft"],
  }),
});

if (!response.ok) {
  throw new Error(`Submit failed: ${response.status}`);
}
const alert = await response.json();
const alertId = alert.id;

Request body

Response

A successful submission returns the new alert's identity and a deep link into Doppel Vision:

{
  "id": "ACM-1234",
  "entity": "https://suspicious-site.example.com",
  "doppel_link": "https://vision.doppel.com/drp/ACM-1234",
  "last_activity": "2026-06-15T10:30:00"
}

The id is in the format ORG-NUMBER, where ORG is your organization's abbreviation. Persist this id — it's the handle you'll use to check status or take action on the alert later.

Status codes

Common patterns

Tagging the submission with a custom source

To label submissions from a particular integration, include source. Per the V2 OpenAPI spec, the string must exactly match the API value field of an API source configured under Settings → API sources in Doppel Vision (not the display name).

Each API source carries a name, an optional description and type, and a severity (high, medium, or low). Alerts submitted with that source are created at the source's severity. The API value is fixed once the source is created, and a source can't be deleted while alerts still reference it.

{
  "entity": "https://suspicious-site.example.com",
  "brand": "Acme Corp",
  "source": "slack-integration"
}

Attaching evidence at creation time

Attach files to the alert at creation time:

import base64

with open("evidence.png", "rb") as f:
    encoded = base64.b64encode(f.read()).decode()

response = requests.post(
    "https://api.doppel.com/v2/alert",
    headers={"Authorization": f"Bearer {access_token}"},
    json={
        "entity": "https://suspicious-site.example.com",
        "brand": "Acme Corp",
        "files": [{"file_name": "evidence.png", "file_to_upload": encoded}],
    },
)

You can attach up to 10 files per request, each up to 50MB.

Next steps

• Check the status of a submitted alert — read the alert's queue_state and entity_state via GET /v2/alert.
• Request a takedown — set an alert's queue_state to actioned via PUT /v2/alert.