Update an alert

Use PUT /v2/alert to update one alert. You can change the queue state, entity
state, brand, assignee, tags, comments, and files in one request.

Prerequisite

Get an OAuth access token (see Authentication).

Identify the alert

Provide exactly one query parameter:

id=ACM-1234 for the public alert ID.
entity=<URL, phone number, or email> for the alert entity. URL-encode this value.

A request that contains both parameters, or neither parameter, returns 400 Bad Request.

Update fields

Send one or more fields in the request body. This example changes the brand and
assignee. It also adds a public comment.

curl --request PUT \
  --url "https://api.doppel.com/v2/alert?id=ACM-1234" \
  --header "Authorization: Bearer <YOUR_ACCESS_TOKEN>" \
  --header "Content-Type: application/json" \
  --data '{
    "brand_id": "123e4567-e89b-12d3-a456-426614174000",
    "assignee": "[email protected]",
    "comment": "Assigned for follow-up."
  }'

The response contains the full updated alert.

Use these fields for common updates:

queue_state changes the alert workflow state.
entity_state changes the observed entity state.
brand_id replaces the current brand. The brand must be active and must
belong to your organization. You cannot clear the brand.
assignee accepts the email of an eligible organization member. Use JSON
null to unassign the alert.
comment adds a public comment.
tag_action and tag_name add or remove a tag. Send both fields together.
file_action and files upload or delete files. Send both fields together.

An update that changes only the brand or assignee does not change the alert
queue state. A comment that is part of an assignee update also does not change
the queue state.

Unassign an alert

Send JSON null as the assignee value:

curl --request PUT \
  --url "https://api.doppel.com/v2/alert?id=ACM-1234" \
  --header "Authorization: Bearer <YOUR_ACCESS_TOKEN>" \
  --header "Content-Type: application/json" \
  --data '{"assignee": null}'

Eligible assignees

The assignee must be a visible and active member of your organization. An
unknown or ineligible email returns 404 Not Found. An alert that your
organization cannot read also returns 404 Not Found.

Status codes

200 OK: Doppel updated the alert and returned the full alert.
400 Bad Request: The alert identifier or update value is invalid.
401 Unauthorized: The access token is missing or invalid.
403 Forbidden: The token does not map to a Doppel organization.
404 Not Found: Doppel cannot find the alert, assignee, brand, or tag.
429 Too Many Requests: The request limit was exceeded.