# Doppel Documentation > Doppel is a cybersecurity company that provides an AI-powered platform for social engineering defense. The platform is designed to protect brands, executives, and employees from AI-powered impersonation, fraud, and social engineering attacks across various digital channels. ## Guides: Getting Started - [Authentication](https://developers.doppel.com/docs/authentication.md) - [Migrating from V1](https://developers.doppel.com/docs/migration.md) ## Guides: Common Workflows - [Submit an alert](https://developers.doppel.com/docs/submit-alert.md) - [Check the status of an alert](https://developers.doppel.com/docs/check-alert-status.md) - [Request a takedown](https://developers.doppel.com/docs/request-takedown.md) - [Manage assets](https://developers.doppel.com/docs/manage-assets.md) - [Update an alert](https://developers.doppel.com/docs/assign-alert.md) - [Find related alerts](https://developers.doppel.com/docs/related-alerts.md) - [Track takedown requests](https://developers.doppel.com/docs/list-takedown-requests.md) ## API Reference: Doppel - brands - [List Brands](https://developers.doppel.com/reference/list-brands.md): List active brands for the authenticated organization. The organization is determined from the org_id claim in the JWT. - [Delete Brand](https://developers.doppel.com/reference/delete-brand.md): Delete (archive) a brand by ID. This soft-deletes the brand by setting its status to archived, along with disabling related sourcing queries, trademarks, customer assets, and designated takedown… - [Get Brand](https://developers.doppel.com/reference/get-brand.md): Get one brand for the authenticated organization. The organization is determined from the org_id claim in the JWT. Identify the brand with `id`. Brands in any lifecycle status are returned,… - alerts - [List Alerts](https://developers.doppel.com/reference/get-alerts.md): List alerts for the authenticated organization. The organization is determined from the org_id claim in the JWT. Only the first 50,000 results of a search can be paged through; a page at or beyond… - [Get Alert](https://developers.doppel.com/reference/get-alert.md): Get a single alert by ID. The organization is determined from the org_id claim in the JWT. - [Create Alert](https://developers.doppel.com/reference/create_alert.md): Creates an alert for a specific entity (URL or phone number) within Doppel's Brand Protection product. The organization is determined from the org_id claim in the JWT. **Behavior:** - If an alert… - [Update Alert](https://developers.doppel.com/reference/update_alert.md): Updates an alert's information in Doppel's system. Works across all modules. The organization is determined from the org_id claim in the JWT. **You must provide exactly one of `id` or `entity`** to… - [Submit Referrer Logs](https://developers.doppel.com/reference/submit-referrer-logs.md): Submits referrer logs to Doppel for processing. These logs capture URLs that direct visitors to a site and may help identify threats or suspicious activity. The organization is determined from the… - [Get Related Alerts](https://developers.doppel.com/reference/get-related-alerts.md): Get the alerts that share threat infrastructure with one alert, for example a shared name server, registrant, or hosting provider. Provide exactly one of `id` or `entity` to identify the alert. The… - [List Takedown Requests For Alert](https://developers.doppel.com/reference/list-takedown-requests.md): List the takedown requests Doppel filed for one of your alerts, newest first. A takedown request is one submission to one platform, so an alert can have several. Each request carries its current… - [Get Takedown Request](https://developers.doppel.com/reference/get-takedown-request.md): Get one takedown request that Doppel filed, by its own ID. Use this to resolve a request ID you already hold, for example one returned by `GET /alert/takedown-requests`. The response repeats every… - assets - [List Assets](https://developers.doppel.com/reference/list-assets.md): List assets of one type for the authenticated organization. `asset_type` is required, so each response holds owned assets or associated assets, never both. Filter by platform and/or brand IDs/brand… - [Create Asset](https://developers.doppel.com/reference/create-asset.md): Create an owned or an associated asset for one or more brands. Assets are URLs, handles, or identifiers that belong to or relate to your organization. `asset_type` is required. The brands must belong… - [Get Asset](https://developers.doppel.com/reference/get-asset.md): Get one asset for the authenticated organization. The organization is determined from the org_id claim in the JWT. Identify the asset with `id`. Unlike `GET /assets`, this route is not scoped to a… - [Replace Asset Brands](https://developers.doppel.com/reference/replace-asset-brands.md): Replace all brand associations for one asset. The organization is determined from the org_id claim in the JWT. Use an empty brand_ids list to remove all brand associations. The operation accepts… - [Create Asset From Alert](https://developers.doppel.com/reference/create-asset-from-alert.md): Create an asset from one of your alerts. Identify the alert with exactly one of `alert_id` or `entity`, the same way as GET /alert. The asset value and the brand come from the alert, so the request… - protected-assets - [List Protected Assets](https://developers.doppel.com/reference/list-protected-assets.md): List protected assets for the authenticated organization. Filter by platform and/or brand IDs/brand names, with pagination support. The organization is determined from the org_id claim in the JWT. - [Create Protected Asset](https://developers.doppel.com/reference/create-protected-asset.md): Create a new protected asset for one or more brands. Protected assets are URLs, handles, or identifiers that your organization wants to monitor for unauthorized use. The asset must be unique per… - [Delete Protected Asset](https://developers.doppel.com/reference/delete-protected-asset.md): Delete a protected asset. This removes the asset from your organization's protected assets list, meaning it will no longer suppress alerts for matching content. The organization is determined from… - scan - [Submit Scan Url](https://developers.doppel.com/reference/scan-1.md): Submit a URL for analysis to determine if it contains potentially suspicious or malicious content. Doppel will analyze the submitted URL and categorize its suspiciousness on a scale of low, medium,… - [Get Scan Result](https://developers.doppel.com/reference/get_scan_result.md): Retrieve the result of a previously submitted scan. The organization is determined from the org_id claim in the JWT. - reports - [Submit Report](https://developers.doppel.com/reference/submit_report.md): Submit a report for the provided URL. Will fail if the URL is invalid or is protected (e.g. google.com) in Doppel's system. The organization is determined from the org_id claim in the JWT. - [Get Report](https://developers.doppel.com/reference/get_report.md): Retrieves the report details by URL or ID. Must include exactly one of either `url`, `id` or `display_id`. The organization is determined from the org_id claim in the JWT. - [Update Report](https://developers.doppel.com/reference/update_report.md): Updates a report in the system with certain parameters. The organization is determined from the org_id claim in the JWT. - [Get Reports](https://developers.doppel.com/reference/get_reports.md): Retrieves a list of reports. Can be filtered by various parameters. The organization is determined from the org_id claim in the JWT. - hrm - [List Campaigns](https://developers.doppel.com/reference/list-hrm-campaigns.md): List phishing simulation campaigns for the authenticated organization. Supports filtering by status, campaign type, date range, and test flag. Returns paginated results. The organization is… - [Get Campaign](https://developers.doppel.com/reference/get-hrm-campaign.md): Get a single phishing simulation campaign by ID for the authenticated organization. The organization is determined from the org_id claim in the JWT. - [List Events](https://developers.doppel.com/reference/list-hrm-events.md): List phishing simulation user events (observations) for the authenticated organization. Events track user interactions with phishing campaigns such as email opens, link clicks, data submissions, and… - [List Campaign Training Status](https://developers.doppel.com/reference/list-hrm-campaign-training-status.md): List per-user training status for one campaign. A user is training_complete when at least one assigned course is completed and every assignment is completed, canceled, or cancelled. Users who were… ## API Reference: Webhooks - urls - [URL Surfaced](https://developers.doppel.com/reference/url_surfaced.md): This webhook is fired whenever any URL appears in our system. The new URL may be associated with a newly-created or already-existing report. - reports (deprecated) - [Report Surfaced](https://developers.doppel.com/reference/report_surfaced.md): This webhook is fired when a report is surfaced in our system. The new report may have any number of URLs associated with it, and may contain audit logs for events prior to surfacing. - alerts - [Alert Updated](https://developers.doppel.com/reference/alert_updated.md): This webhook is fired when an alert is updated in our system. A Custom Webhook can be set to receive it only when an alert enters a chosen queue (moves into it from any queue, or is created there);… - iocs - [IOC Updated Webhook](https://developers.doppel.com/reference/ioc_updated.md): This webhook is fired whenever an IOC is updated in our system. Please contact our team if you are interested in subscribing to this webhook. - hrm - [HRM Campaign Event](https://developers.doppel.com/reference/hrm_event.md): This webhook is fired when a Human Risk Management (HRM) phishing simulation campaign engagement event is recorded. Events include attack delivery (email_sent), target interactions (email_opened,… - sms_responses - [SMS Response](https://developers.doppel.com/reference/sms_response.md): This webhook is fired whenever an SMS response is received from a Twilio outreach campaign. ## Changelog - [Alert lists use organization Dark Web access by default](https://developers.doppel.com/changelog/2026-10-30-v2-alert-dark-web-default.md) - [Send Custom Webhook alert updates only when an alert enters a queue](https://developers.doppel.com/changelog/2026-10-29-custom-webhook-queue-filter.md) - [Upload a primary screenshot through the alert API](https://developers.doppel.com/changelog/2026-10-27-alert-screenshot-upload.md) - [More V2 alert list filters and sort options](https://developers.doppel.com/changelog/2026-10-15-alert-list-parity.md) - [Alert API result-window check no longer applies to unfiltered page-0 requests](https://developers.doppel.com/changelog/2026-10-14-alert-result-window-unfiltered-page-zero.md) - [Per-user training status on the HRM API](https://developers.doppel.com/changelog/2026-10-14-hrm-campaign-training-status.md) - [Course and due date on HRM training completions](https://developers.doppel.com/changelog/2026-10-08-hrm-events-course-and-due-date.md) - [Delegated access for asset endpoints](https://developers.doppel.com/changelog/2026-10-07-delegated-asset-access.md) - [Alert API result-window safety boundary](https://developers.doppel.com/changelog/2026-10-04-alert-result-window.md) - [Basic alert list responses](https://developers.doppel.com/changelog/2026-09-28-basic-alert-list-response.md)