--- updatedAt: 2026-05-26T22:08:32.000Z agentTools: projectIndex: https://doppel.readme.io/llms.txt --- # Get Alert Retrieves the details of a single alert by its ID or entity value. **You must provide exactly one of `id` or `entity`**. Providing neither or both returns HTTP 400. Returns the full alert object including audit logs, tags, entity content, and a signed screenshot URL (expires in 1 hour). # OpenAPI definition ```json { "openapi": "3.0.0", "info": { "version": "1.0.0", "title": "Doppel", "description": "APIs to interface with Doppel's core system", "contact": {} }, "x-readme": { "parameter-ordering": [ "path", "header", "query", "body", "cookie", "form" ] }, "x-google-management": { "metrics": [ { "name": "get-scan-result-request", "displayName": "Get Scan Result Quota", "valueType": "INT64", "metricKind": "DELTA" }, { "name": "submit-scan-request", "displayName": "Submit Scan Quota", "valueType": "INT64", "metricKind": "DELTA" }, { "name": "submit-eml-request", "displayName": "Submit EML Quota", "valueType": "INT64", "metricKind": "DELTA" }, { "name": "track-campaign-action-request", "displayName": "Track Campaign Action Quota", "valueType": "INT64", "metricKind": "DELTA" }, { "name": "create-alert-request", "displayName": "Create Alert Quota", "valueType": "INT64", "metricKind": "DELTA" }, { "name": "get-alert-request", "displayName": "Get Alert Quota", "valueType": "INT64", "metricKind": "DELTA" }, { "name": "get-alerts-request", "displayName": "Get Alerts Quota", "valueType": "INT64", "metricKind": "DELTA" }, { "name": "update-alert-request", "displayName": "Update Alert Quota", "valueType": "INT64", "metricKind": "DELTA" }, { "name": "alert-abuse-request", "displayName": "Alert Abuse Quota", "valueType": "INT64", "metricKind": "DELTA" }, { "name": "update-report-request", "displayName": "Update Report Quota", "valueType": "INT64", "metricKind": "DELTA" }, { "name": "submit-report-request", "displayName": "Submit Report Quota", "valueType": "INT64", "metricKind": "DELTA" }, { "name": "get-report-request", "displayName": "Get Report Quota", "valueType": "INT64", "metricKind": "DELTA" }, { "name": "get-reports-request", "displayName": "Get Reports", "valueType": "INT64", "metricKind": "DELTA" }, { "name": "upload-new-protected-asset-request", "displayName": "Upload New Protected Asset Quota", "valueType": "INT64", "metricKind": "DELTA" }, { "name": "cloned-website-request", "displayName": "Cloned Website Quota", "valueType": "INT64", "metricKind": "DELTA" }, { "name": "submit-referrer-logs-request", "displayName": "Submit Referrer Logs Quota", "valueType": "INT64", "metricKind": "DELTA" }, { "name": "delete-protected-asset-request", "displayName": "Delete Protected Asset Quota", "valueType": "INT64", "metricKind": "DELTA" } ], "quota": { "limits": [ { "name": "get-scan-result-limit", "metric": "get-scan-result-request", "unit": "1/min/{project}", "values": { "STANDARD": 300 } }, { "name": "submit-scan-limit", "metric": "submit-scan-request", "unit": "1/min/{project}", "values": { "STANDARD": 300 } }, { "name": "submit-eml-limit", "metric": "submit-eml-request", "unit": "1/min/{project}", "values": { "STANDARD": 3000 } }, { "name": "track-campaign-action-limit", "metric": "track-campaign-action-request", "unit": "1/min/{project}", "values": { "STANDARD": 300 } }, { "name": "create-alert-limit", "metric": "create-alert-request", "unit": "1/min/{project}", "values": { "STANDARD": 100 } }, { "name": "alert-limit", "metric": "get-alert-request", "unit": "1/min/{project}", "values": { "STANDARD": 100 } }, { "name": "get-alerts-limit", "metric": "get-alerts-request", "unit": "1/min/{project}", "values": { "STANDARD": 100 } }, { "name": "alert-abuse-limit", "metric": "alert-abuse-request", "unit": "1/min/{project}", "values": { "STANDARD": 1000 } }, { "name": "update-alert-limit", "metric": "update-alert-request", "unit": "1/min/{project}", "values": { "STANDARD": 100 } }, { "name": "update-report-limit", "metric": "update-report-request", "unit": "1/min/{project}", "values": { "STANDARD": 100 } }, { "name": "submit-report-limit", "metric": "submit-report-request", "unit": "1/min/{project}", "values": { "STANDARD": 100 } }, { "name": "get-report-limit", "metric": "get-report-request", "unit": "1/min/{project}", "values": { "STANDARD": 100 } }, { "name": "get-reports", "metric": "get-reports-request", "unit": "1/min/{project}", "values": { "STANDARD": 100 } }, { "name": "submit-referrer-logs-limit", "metric": "submit-referrer-logs-request", "unit": "1/min/{project}", "values": { "STANDARD": 1000 } }, { "name": "upload-new-protected-asset-limit", "metric": "upload-new-protected-asset-request", "unit": "1/min/{project}", "values": { "STANDARD": 5 } }, { "name": "cloned-website-limit", "metric": "cloned-website-request", "unit": "1/min/{project}", "values": { "STANDARD": 5 } }, { "name": "delete-protected-asset-limit", "metric": "delete-protected-asset-request", "unit": "1/min/{project}", "values": { "STANDARD": 100 } } ] } }, "paths": { "/alert": { "get": { "description": "Retrieves the details of a single alert by its ID or entity value.\n\n**You must provide exactly one of `id` or `entity`**. Providing neither or both returns HTTP 400.\n\nReturns the full alert object including audit logs, tags, entity content, and a signed screenshot URL (expires in 1 hour).\n", "summary": "Get Alert", "operationId": "get-alert", "tags": [ "alerts" ], "x-google-backend": { "address": "https://external-api-gateway-725058953679.us-west1.run.app", "jwt_audience": "https://external-api-gateway-725058953679.us-west1.run.app", "path_translation": "APPEND_PATH_TO_ADDRESS" }, "parameters": [ { "$ref": "#/components/parameters/XOrganizationCodeHeader" }, { "name": "id", "in": "query", "required": false, "description": "The alert ID (format ORG-1234). Mutually exclusive with `entity`.", "example": "ACM-1234", "schema": { "type": "string" } }, { "name": "entity", "in": "query", "required": false, "description": "The URL, phone number, or email of the alert to retrieve. Mutually exclusive with `id`.", "example": "https://suspicious-site.example.com", "schema": { "type": "string" } } ], "responses": { "200": { "description": "Alert successfully retrieved", "headers": {}, "content": { "application/json": { "schema": { "$ref": "#/components/schemas/AlertResponse" } } } }, "400": { "description": "Invalid input", "headers": {}, "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorResponse" } } } }, "401": { "description": "Unauthorized", "headers": {}, "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorResponse" } } } }, "404": { "description": "Alert not found", "headers": {}, "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorResponse" } } } }, "429": { "description": "Rate limit exceeded", "headers": {}, "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorResponse" } } } }, "500": { "description": "Internal Server Error", "headers": {}, "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorResponse" } } } } }, "security": [ { "api_key": [], "user_api_key": [] } ], "x-google-quota": { "metricCosts": { "get-alert-request": 1 } } } } }, "security": [ { "api_key": [], "user_api_key": [] } ], "externalDocs": { "url": "https://doppel.com", "description": "Find out more about Doppel" }, "servers": [ { "url": "https://api.doppel.com/v1" } ], "components": { "parameters": { "XOrganizationCodeHeader": { "name": "x-organization-code", "in": "header", "description": "(optional) Your Doppel Organization Code. Required if user is in multiple organizations.", "required": false, "schema": { "type": "string" } } }, "securitySchemes": { "api_key": { "type": "apiKey", "name": "x-api-key", "in": "header", "description": "API key from Doppel Vision API settings. Required for gateway authentication and quota." }, "user_api_key": { "type": "apiKey", "name": "x-user-api-key", "in": "header", "description": "User API key from Doppel Vision API settings. Required together with x-api-key for authenticated requests." } }, "schemas": { "QueueState": { "description": "The workflow queue an alert is currently in. Maps to the status columns in Doppel Vision.\n- `doppel_review`: Under review by Doppel's internal team.\n- `needs_confirmation`: Awaiting customer confirmation before enforcement action.\n- `actioned`: Enforcement action has been taken (e.g. takedown request sent).\n- `taken_down`: Threat has been resolved. Equivalent to \"Resolved\" in Doppel Vision.\n- `monitoring`: Being actively monitored but no enforcement action taken yet.\n- `archived`: Dismissed or no longer relevant.\n", "type": "string", "enum": [ "doppel_review", "needs_confirmation", "actioned", "taken_down", "monitoring", "archived" ] }, "EntityState": { "description": "The live status of the entity (URL, phone number, etc.) that the alert is tracking.\n- `active`: The entity is currently live/accessible.\n- `down`: The entity is no longer accessible (e.g. domain taken down).\n- `parked`: The domain is parked (registered but not hosting active content).\n- `suspicious`: The entity appears to be malicious or suspicious.\n- `unclassified`: The entity has not yet been classified.\n- `unrelated`: The entity has been determined to be unrelated to the brand.\n- `related`: The entity is related to the brand but not necessarily malicious.\n- `unknown`: The entity's status cannot be determined.\n", "type": "string", "enum": [ "active", "down", "parked", "suspicious", "unclassified", "unrelated", "related", "unknown" ] }, "Severity": { "description": "Severity level assigned to the alert.\n- `high`: Confirmed or high-confidence threat requiring immediate action.\n- `medium`: Likely threat that needs further investigation.\n- `low`: Low-confidence signal; may be benign.\n", "type": "string", "enum": [ "high", "medium", "low" ] }, "FileResult": { "description": "Result of an individual file operation.", "type": "object", "properties": { "file_name": { "type": "string" }, "success": { "type": "boolean" }, "error": { "type": "string", "description": "Error message if the file operation failed. Only present when success is false." } } }, "EntityContent": { "description": "Content related to the entity of the alert, if available, for the following product types: domains, social media posts, social media users, social media groups, mobile apps, ecommerce, emails and paid advertisements. Object fields vary based on product type and availability.\n\nPossible keys and their fields:\n- `root_domain` (product: domains): `domain`, `registrar`, `ip_address`, `country_code`, `hosting_provider`, `contact_email`, `mx_records`, `nameservers`\n- `social_media_user` (product: social_media): `account_created_at`, `slug`, `profile_display_name`, `profile_image_url`, `profile_id`, `num_followers`, `profile_description`, `profile_display_url`\n- `social_media_post` (product: social_media): `external_created_at`, `num_upvotes`, `full_text`, `extra_urls`\n- `social_media_group` (product: social_media): `external_created_at`, `name`, `description`, `num_members`, `image_url`\n- `mobile_app` (product: mobile_apps): `external_created_at`, `title`, `platform_name`, `app_id`, `bundle_id`, `developer_id`, `developer_name`\n- `ecommerce` (product: ecommerce): `price`, `num_units`, `title`, `seller_name`, `description`, `telegram_link`\n- `email` (product: email): `subject`, `forwarder`, `sender`, `receiver`, `cc`, `bcc`, `eml_url`, `body`\n- `telco` (product: telco): `entity_created_at`, `entity_updated_at`, `country_code`, `telco_provider`\n- `advertisement_data` (product: paid_ads): `ad_detail_link`, `destination_url`, `text_content`, `date_first_shown`, `date_last_shown`, `advertiser_data`\n", "type": "object", "additionalProperties": true }, "Product": { "description": "Product category the report belongs to.", "type": "string", "enum": [ "domains", "social_media", "mobile_apps", "ecommerce", "crypto", "email", "paid_ads", "telco", "darkweb" ] }, "ReportSource": { "description": "How the report was sourced.", "type": "string", "enum": [ "Manual Upload", "API Upload", "Social Media API", "Web Search API", "Domains Feed", "Phishing Feed", "Marketplace API", "Ads Feed", "Dark Web Feed", "SSL Transparency Logs", "Pivot", "Abuse Box", "Brand Abusebox", "Email Inbox", "Web Beacon", "Other", "Crawler" ] }, "ErrorResponse": { "title": "ErrorResponse", "description": "Standard error response returned for all non-2xx responses. Contains a single `message` field with a human-readable error description.", "type": "object", "required": [ "message" ], "properties": { "message": { "type": "string", "description": "Human-readable error description.", "example": "This is an error message" } } }, "AuditLog": { "title": "AuditLog", "description": "A log of the changes on a report.", "type": "object", "properties": { "changed_by": { "type": "string", "description": "Email of the user who made the change, or \"Doppel\"." }, "value": { "type": "string", "description": "New log value" }, "timestamp": { "type": "string", "format": "date-time", "description": "Timestamp when the change was made." }, "type": { "type": "string", "description": "Type of audit log." }, "metadata": { "title": "Metadata", "description": "Metadata for audit log.", "type": "object", "properties": { "enforcement_request": { "description": "Enforcement request information.", "type": "object", "properties": { "platform": { "description": "Platform where the enforcement request was made.", "type": "string" }, "type": { "description": "Type of enforcement request.", "type": "string" } } }, "match": { "description": "Match information.", "type": "object", "properties": { "domain": { "description": "Domain information.", "type": "object", "properties": { "url": { "description": "URL associated with metadata.", "type": "string" } } } } } } } } }, "AlertResponse": { "title": "AlertResponse", "description": "Full alert object returned by GET /alert, GET /alerts, and PUT /alert.\nRepresents a single threat alert tracked by Doppel across any product type (domains, social media, mobile apps, etc.).\nGET /alerts returns a subset of these fields when `detail_level=basic`.\n", "type": "object", "properties": { "id": { "type": "string", "description": "Alert ID in the format ORG-NUMBER (e.g. ACM-1234). The prefix is your organization's abbreviation.", "example": "ACM-1234" }, "entity": { "description": "The URL, phone number, or email being tracked by this alert.", "type": "string", "example": "https://suspicious-site.example.com" }, "brand": { "description": "The brand name this alert is associated with.", "type": "string", "example": "Acme Corp" }, "doppel_link": { "description": "Direct link to this alert in the Doppel Vision web app.", "type": "string", "example": "https://vision.doppel.com/drp/ACM-1234" }, "queue_state": { "$ref": "#/components/schemas/QueueState" }, "entity_state": { "$ref": "#/components/schemas/EntityState" }, "severity": { "$ref": "#/components/schemas/Severity" }, "source": { "$ref": "#/components/schemas/ReportSource" }, "product": { "$ref": "#/components/schemas/Product" }, "platform": { "description": "The specific platform the alert is associated with (e.g. Twitter, Facebook, Linkedin). More granular than product.", "type": "string", "example": "twitter" }, "notes": { "description": "Latest comment associated with the alert.", "type": "string" }, "uploaded_by": { "description": "Email of the user who submitted the alert, or \"Doppel\" if sourced automatically.", "type": "string", "example": "jane.doe@company.com" }, "assignee": { "description": "Email of the user currently assigned to handle this alert.", "type": "string", "example": "john.doe@company.com" }, "created_at": { "description": "Timestamp when the alert was created (ISO 8601).", "type": "string", "format": "date-time", "example": "2024-06-15T10:30:00" }, "screenshot_url": { "description": "Signed URL of the screenshot associated with the alert. Expires after 1 hour. May be null if no screenshot is available.", "type": "string" }, "audit_logs": { "description": "Chronological list of visible changes made to this alert.", "type": "array", "items": { "$ref": "#/components/schemas/AuditLog" } }, "tags": { "description": "List of tags associated with this alert.", "type": "array", "items": { "type": "object", "properties": { "name": { "type": "string", "description": "The name of the tag." } }, "example": { "name": "Credential Theft" } } }, "entity_content": { "$ref": "#/components/schemas/EntityContent" }, "last_activity": { "description": "Timestamp of the most recent activity on this alert (ISO 8601).\nNote: GET /alerts returns this field as `last_activity_timestamp` instead.\n", "type": "string", "format": "date-time", "example": "2024-06-20T14:00:00" }, "score": { "description": "Numeric severity score for the alert, ranging from 0.0 to 1.0 (higher = more severe). May be null.\n", "type": "number", "format": "float", "minimum": 0, "maximum": 1 }, "file_results": { "description": "Results of file operations, only present when files were included in the request (PUT /alert).", "type": "array", "items": { "$ref": "#/components/schemas/FileResult" } }, "alert_summary": { "description": "AI-generated summary of the alert, returned by GET /alert, GET /alerts, and PUT /alert.\nMay be null when summary generation is still in progress, no visible summary exists, or\nthe summary is withheld for restricted users on redacted dark-web alerts.\n", "type": "string", "example": "This alert tracks a phishing domain impersonating Acme Corp login pages." } } } } } } ```