> ## Documentation Index > Fetch the complete documentation index at: https://developer.secfix.com/llms.txt > Use this file to discover all available pages before exploring further. # Update governance metadata (and tags) on one asset. > Requires the inventory:write scope. Governance fields only; employee rows are read-only. ## OpenAPI ````yaml /api-reference/openapi.yaml patch /v1/inventory/assets/{id} openapi: 3.0.1 info: title: Secfix Public API description: >- Machine-to-machine API for the Secfix compliance platform. Authenticate with the OAuth 2.0 client_credentials grant via POST /oauth/token, then call /v1 endpoints with the bearer access token. Errors follow RFC 7807 (application/problem+json) with stable code strings; lists use opaque cursor pagination. contact: name: Secfix Support url: https://secfix.com email: support@secfix.com license: name: Proprietary url: https://secfix.com/license version: 1.0.0 servers: - url: https://api.secfix.com description: Production security: - bearerAuth: [] tags: - name: Health description: Service liveness. - name: Inventory description: List and govern assets across all categories. - name: OAuth description: Token endpoint for OAuth 2.0 client-credentials authentication. - name: Computers description: Read-only monitored computers with device compliance posture. paths: /v1/inventory/assets/{id}: patch: tags: - Inventory summary: Update governance metadata (and tags) on one asset. description: >- Requires the inventory:write scope. Governance fields only; employee rows are read-only. operationId: update parameters: - name: id in: path required: true schema: type: string format: uuid requestBody: content: application/json: schema: $ref: '#/components/schemas/AssetMetadataPatchRequest' required: true responses: '200': description: OK content: application/json: schema: $ref: '#/components/schemas/AssetDto' components: schemas: AssetMetadataPatchRequest: type: object properties: classification: type: string description: Data classification. example: CONFIDENTIAL description: maxLength: 500 minLength: 0 type: string description: Governance description (max 500 chars). example: Primary production web server. ownerId: type: string description: New owner's employee UUID. format: uuid example: a1b2c3d4-e5f6-4a7b-8c9d-0e1f2a3b4c5d tags: maxItems: 20 minItems: 0 type: array description: >- Tags to set (single-asset PATCH only; not supported in bulk). Diffed add/remove against existing customer tag keys; an unknown key is rejected. items: $ref: '#/components/schemas/TagDto' description: >- Governance-only metadata update. Governance fields only - no name, device facts, status, create or delete. AssetDto: type: object properties: accountId: type: string description: Cloud account id (CLOUD assets). example: '123456789012' categoryKey: type: string description: Asset category key. example: CLOUD enum: - CLOUD - COMPUTER - CUSTOM - INFORMATION - EMPLOYEE classification: type: string description: Data classification. example: CONFIDENTIAL completeStatus: type: string description: >- Read-only completeness status. COMPLETE when an owner is assigned, else INCOMPLETE. Applies to all categories. readOnly: true example: COMPLETE enum: - COMPLETE - INCOMPLETE createdAt: type: string description: Creation timestamp (UTC). format: date-time example: '2026-01-15T09:30:00.000Z' dataStored: $ref: '#/components/schemas/DataStoredDto' description: type: string description: Governance description. example: Primary production web server. email: type: string description: >- Employee email - PII, surfaced under inventory:read (EMPLOYEE assets). example: jane.doe@example.com externalId: type: string description: Identifier of the asset in its source system. example: i-0abc123def456 id: type: string description: Opaque public asset id (UUID). format: uuid example: 3f1c9a2e-8b4d-4e7a-9c1f-2a5b6c7d8e9f lastCheckedAt: type: string description: Timestamp of the last compliance check (UTC), where applicable. format: date-time example: '2026-06-30T02:00:00.000Z' name: type: string description: Asset display name. example: prod-web-01 osVersion: type: string description: Operating system family and version, combined (COMPUTER assets). example: macOS 14.5 ownerId: type: string description: Owner's employee UUID. format: uuid example: a1b2c3d4-e5f6-4a7b-8c9d-0e1f2a3b4c5d ownerSource: type: string description: Origin of the owner assignment. example: MANUAL region: type: string description: Cloud region/location (CLOUD assets). example: eu-central-1 serialNumber: type: string description: Hardware serial number (COMPUTER assets). example: C02XY1234ABC tags: type: array description: Structured tags on the asset. items: $ref: '#/components/schemas/TagDto' type: type: string description: Asset type within its category. example: SERVER description: >- Public asset. The id is an opaque public reference (never the internal PK); for EMPLOYEE-category rows it is the stable employee UUID. Category-specific fields are populated only for their owning category; completeStatus is read-only. TagDto: type: object properties: key: maxLength: 1000 minLength: 0 type: string description: Tag key (an existing customer tag definition). example: environment value: maxLength: 255 minLength: 0 type: string description: Tag value. example: production description: >- Structured asset tag. On writes, key must match an existing customer tag key; value is read-only in v1. DataStoredDto: type: object properties: containsPatientData: type: boolean description: Whether the asset contains patient data. example: false containsUserData: type: boolean description: Whether the asset contains user data. example: true userDataInfo: type: string description: Free-text descriptor of the user data contained in the asset. example: Customer contact records description: User/patient-data flags for INFORMATION/CUSTOM assets. Read-only. securitySchemes: bearerAuth: type: http description: Bearer access token obtained from /oauth/token. scheme: bearer bearerFormat: JWT ````