# Doppel Documentation > Doppel is a cybersecurity company that provides an AI-powered platform for social engineering defense. The platform is designed to protect brands, executives, and employees from AI-powered impersonation, fraud, and social engineering attacks across various digital channels. ## Guides - [Authentication](https://doppel.readme.io/docs/authentication.md) - [Migrating to V2](https://doppel.readme.io/docs/migrating-to-v2.md) - [Submit an alert](https://doppel.readme.io/docs/submit-alert.md) - [Check the status of an alert](https://doppel.readme.io/docs/check-alert-status.md) - [Request a takedown](https://doppel.readme.io/docs/request-takedown.md) ## API Reference - [Create Alert](https://doppel.readme.io/reference/create_alert.md): Creates an alert for a specific entity (URL or phone number) within Doppel's Brand Protection product. **Behavior:** - If an alert already exists for the entity, the existing alert is returned (HTTP 200). - If the alert exists but with a different brand than requested, returns HTTP 409. - After creation, the alert is automatically processed through Doppel's triage workflow. - If `source` is provided, it must exactly match the "API value" field of an external source configured in your organization's settings in Doppel Vision. **Returns HTTP 400 when:** - `entity` is missing, not a valid URL, or not a valid phone number. - `entity` is a protected asset (e.g. google.com). - `tags` is not a list of non-empty strings. - `source` does not match any configured external source for the organization. - `files` contains more than 10 items, duplicate file names, or is missing `file_to_upload`. - [Get Alert](https://doppel.readme.io/reference/get-alert.md): Retrieves the details of a single alert by its ID or entity value. **You must provide exactly one of `id` or `entity`**. Providing neither or both returns HTTP 400. Returns the full alert object including audit logs, tags, entity content, and a signed screenshot URL (expires in 1 hour). - [Update Alert](https://doppel.readme.io/reference/update_alert.md): Updates an alert's information in Doppel's system. Works across all modules. **You must provide exactly one of `id` or `entity`** to identify the alert. At least one field to update must be provided in the request body. **Paired parameters:** - `tag_action` and `tag_name` must both be provided together. - `file_action` and `files` must both be provided together. - [Get Alerts](https://doppel.readme.io/reference/get-alerts.md): Returns a paginated list of alerts across all modules, with support for filtering and sorting. **Sorting:** If `sort_type` is provided, `sort_order` must also be provided. If neither is provided, defaults to `date_sourced` descending. **Pagination:** Zero-indexed. Default page_size is 30, maximum is 200. **Note:** In this endpoint's response, the alert timestamp field is named `last_activity_timestamp` (instead of `last_activity` as returned by GET /alert, PUT /alert, and POST /alert). - [Submit Referrer Logs](https://doppel.readme.io/reference/submit-referrer-logs.md): This endpoint submits referrer logs to Doppel for processing. These logs capture URLs that direct visitors to a site and may help identify threats or suspicious activity. Submitting a referrer log does not guarantee that an alert will be generated. Instead, the submitted URL will be analyzed as part of Doppel's referrer log processing. - [Submit Scan Url](https://doppel.readme.io/reference/submit_scan.md): Submit a URL for analysis to determine if it contains potentially suspicious or malicious content. Doppel will analyze the submitted URL and categorize its suspiciousness on a scale of low, medium, and high. Based on the suspiciousness of the URL, an alert can be created in our system, facilitating further triage actions. - [Get Scan Result](https://doppel.readme.io/reference/get_scan_result.md): Get the suspiciousness result of a scan given the submitted scan's ID. - [Track Phishing Campaign Actions](https://doppel.readme.io/reference/track_campaign_actions.md): Tracks user interactions with phishing simulation campaign emails. This endpoint records various actions such as email opens, link clicks, form submissions, and email reports while returning a transparent tracking pixel. - [Submit Report](https://doppel.readme.io/reference/submit_report.md): Submit a report for the provided URL. Will fail if the URL is invalid or is protected (e.g. google.com) in Doppel's system. - [Get Report](https://doppel.readme.io/reference/get_report.md): Retrieves the report details by URL or ID. Must include exactly one of either `url`, `id` or `display_id`. - [Update Report](https://doppel.readme.io/reference/update_report.md): Updates a report in the system with certain parameters. - [Get Reports](https://doppel.readme.io/reference/get_reports.md): Retrieves a list of reports. Can be filtered by various parameters. - [List Brands](https://doppel.readme.io/reference/list-brands.md): List active brands for the authenticated organization. Filter by brand_type (organization_brand or personal_brand) and/or name, with pagination support. Only returns active brands (archived brands are excluded). - [Delete Brand](https://doppel.readme.io/reference/delete-brand.md): Delete (archive) a brand by ID. This soft-deletes the brand by setting its status to archived, along with disabling related sourcing queries, trademarks, customer assets, and designated takedown assets. - [List Protected Assets](https://doppel.readme.io/reference/list-protected-assets.md): List protected assets for the authenticated organization. Filter by platform and/or brand IDs/brand names, with pagination support. Protected assets are URLs, handles, or identifiers that your organization wants to monitor for unauthorized use across various platforms. - [Create Protected Asset](https://doppel.readme.io/reference/create-protected-asset.md): Create a new protected asset for one or more brands. Protected assets are URLs, handles, or identifiers that your organization wants to monitor for unauthorized use. The asset must be unique per organization, and the brands must belong to your organization. - [Delete Protected Asset](https://doppel.readme.io/reference/delete-protected-asset.md): Delete a protected asset. This removes the asset from your organization's protected assets list, meaning it will no longer suppress alerts for matching content. - [List Campaigns](https://doppel.readme.io/reference/list-hrm-campaigns.md): List phishing simulation campaigns for the authenticated organization. Supports filtering by status, campaign type, date range, and test flag. Returns paginated results. - [Get Campaign](https://doppel.readme.io/reference/get-hrm-campaign.md): Get a single phishing simulation campaign by ID for the authenticated organization. - [List Events](https://doppel.readme.io/reference/list-hrm-events.md): List phishing simulation user events (observations) for the authenticated organization. Events track user interactions with phishing campaigns such as email opens, link clicks, data submissions, and reports. Includes joined user context (name, department, email) in each event. Supports filtering by campaign, action type, user attributes, and date range. - [URL Surfaced](https://doppel.readme.io/reference/url_surfaced.md): This webhook is fired whenever any URL appears in our system. The new URL may be associated with a newly-created or already-existing report. - [Report Surfaced](https://doppel.readme.io/reference/report_surfaced.md): This webhook is fired when a report is surfaced in our system. The new report may have any number of URLs associated with it, and may contain audit logs for events prior to surfacing. - [Alert Updated](https://doppel.readme.io/reference/alert_updated.md): This webhook is fired when an alert is updated in our system. - [IOC Updated Webhook](https://doppel.readme.io/reference/ioc_updated.md): This webhook is fired whenever an IOC is updated in our system. Please contact our team if you are interested in subscribing to this webhook. - [HRM Campaign Event](https://doppel.readme.io/reference/hrm_event.md): This webhook is fired when a Human Risk Management (HRM) phishing simulation campaign engagement event is recorded. Events include attack delivery (email_sent), target interactions (email_opened, link_visited, data_submitted), training outcomes (training_accessed, quiz_passed, quiz_failed), reporting (email_reported), voice call results (call_answered, call_missed), and voice behavior analysis labels (refusal, disclosure_full, security_escalation, etc.). - [SMS Response](https://doppel.readme.io/reference/sms_response.md): This webhook is fired whenever an SMS response is received from a Twilio outreach campaign. ## Changelog - [Doppel API V2 is now available](https://doppel.readme.io/changelog/2026-07-13-api-v2.md) - [Protected assets API now returns who last updated each asset](https://doppel.readme.io/changelog/2026-07-01-updated-by-on-protected-assets.md) - [AI alert summary on alert API responses](https://doppel.readme.io/changelog/2026-07-01-alert-summary-on-alert-api-responses.md) - [Telco screenshots from uploaded alert images](https://doppel.readme.io/changelog/2026-06-23-telco-screenshot-uploaded-files.md) - [AI alert summary on alert API responses](https://doppel.readme.io/changelog/2026-06-18-alert-summary-on-get-alert.md)