API Reference

List Alerts

get
https://api.doppel.com/v2/alerts

List alerts for the authenticated organization.
The organization is determined from the org_id claim in the JWT.
Only the first 50,000 results of a search can be paged through; a page
at or beyond that offset returns result_window_exceeded. A search
filtered by last_activity_timestamp, last_activity_before,
created_after, or created_before that matches more than 50,000
alerts returns result_window_exceeded on page 0; narrow the time
range and retry. Unfiltered page-0 requests are always served.

Recent Requests
Log in to see full request history
TimeStatusUser Agent
Retrieving recent requests…
LoadingLoading…
Query Params
queue_state
array of strings

Comma-separated queue states to filter alerts by. A single value is
also accepted.
(Note: taken_down is equivalent to Resolved in the Doppel Vision App)

queue_state
Allowed:
string
enum

Filter by product category.

modules
array of strings

Comma-separated production alert modules.

modules
string
enum

Filter alerts by their customer product surface.

Allowed:
boolean

Filter alerts by whether they belong to a dark-web module.

string
enum

The field to sort alerts by. Must be provided together with sort_order. Defaults to date_sourced descending if neither is specified.

  • date_sourced: Sort by alert creation date.
  • last_activity: Sort by the date of the most recent alert activity.
  • last_actioned_at: Sort by the date of the most recent enforcement action.
  • date_last_actioned: Legacy alias for last_activity. Do not use it for a new integration.
  • display_url: Sort by the normalized alert display URL.
  • last_reported_at: Sort by the most recent report timestamp.
  • last_resolved_at: Sort by the most recent resolution timestamp.
  • severity: Sort by alert severity.
string
enum

Sort direction. Must be provided together with sort_type. Defaults to desc if neither is specified.

Allowed:
string

Search alerts by entity (URL/phone/email) substring match.

Search alert display URLs and other indexed alert text.

date-time

ISO 8601 timestamp. Return alerts created at or after this time.

date-time

ISO 8601 timestamp. Return alerts created at or before this time.

date-time

ISO 8601 timestamp. Return alerts with activity at or after this time.

date-time

ISO 8601 timestamp. Return alerts with activity at or before this time.

integer
0 to 200
Defaults to 100

Maximum number of recent audit log entries to return for each alert.

string
enum
Defaults to full

Response detail level. full returns the standard alert response.
basic returns only id, entity, queue_state, entity_state,
severity, product, created_at, and last_activity_timestamp.

Allowed:
tags
array of strings

Comma-separated list of tag names to filter alerts by.

tags
brand_ids
array of uuids

Comma-separated brand UUIDs. Matches the alert's original brand.

brand_ids
tag_ids
array of uuids

Comma-separated tag UUIDs that alerts must include.

tag_ids
excluded_tag_ids
array of uuids

Comma-separated tag UUIDs that alerts must not include.

excluded_tag_ids
uploader_ids
array of uuids

Comma-separated uploader UUIDs.

uploader_ids
boolean

Include alerts uploaded by Doppel users in uploader filtering.

boolean

Filter by whether an alert has preview content.

sources
array of strings

Comma-separated alert source categories.

sources
string
enum

Filter by whether the alert was sourced by the customer or Doppel.

Allowed:
assignee_ids
array of uuids

Comma-separated assignee UUIDs.

assignee_ids
boolean

Include unassigned alerts when filtering by assignee.

severity
array of strings

Comma-separated severity values (high, medium, low).

severity
Allowed:
entity_state
array of strings

Comma-separated entity states (active, down, parked, and other EntityState values).

entity_state
platform
array of strings

Comma-separated Platform enum values.

platform
platforms
array of strings

Comma-separated source-platform slugs used by the DV2 alert lists.

platforms
boolean

Filter by whether an alert has connected alerts.

string

Filter domain alerts by top-level domain.

string

Filter domain alerts by IP address.

registration_countries
array of strings

Comma-separated domain registration country codes.

registration_countries
carriers
array of strings

Comma-separated telco carrier names.

carriers
advertiser_names
array of strings

Comma-separated advertiser names.

advertiser_names
advertiser_verifications
array of strings

Comma-separated advertiser verification states.

advertiser_verifications
Allowed:
dark_web_networks
array of strings

Comma-separated dark-web network identifiers.

dark_web_networks
dark_web_sources
array of strings

Comma-separated dark-web source identifiers.

dark_web_sources
string

Search credential leaks by leak name.

string

Search credential leaks by machine name.

date-time

ISO 8601 timestamp. Return dark-web alerts crawled at or after this time.

date-time

ISO 8601 timestamp. Return dark-web alerts crawled at or before this time.

dark_web_leak_contents
array of strings

Comma-separated credential leak content types.

dark_web_leak_contents
Allowed:
boolean

Return only successfully parsed dark-web alerts.

boolean

Filter credential leaks by organization email matching.

dark_web_exposure_types
array of strings

Comma-separated dark-web exposure categories.

dark_web_exposure_types
Allowed:
integer
0 to 1000

Minimum leaked password length.

integer
0 to 1000

Maximum leaked password length.

dark_web_password_requirements
array of strings

Comma-separated leaked password complexity requirements.

dark_web_password_requirements
Allowed:
string
length ≤ 200

Regular expression that leaked passwords must match.

integer
0 to 1000

Minimum leaked username length.

string
enum

Require leaked usernames to be email addresses or non-email values.

Allowed:
string
length ≤ 200

Regular expression that leaked usernames must match.

integer
Defaults to 0

Page number (0-indexed). Defaults to 0 server-side.

integer
1 to 200
Defaults to 30

Number of items per page. Defaults to 30, max 200.

Responses

Updated 3 months ago

Did this page help you?
Language
Credentials
LoadingLoading…
Response
Click Try It! to start a request and see the response here! Or choose an example:
application/json

Updated 3 months ago

Did this page help you?