Overview - Secfix Developers

This reference is generated directly from the Secfix Public API OpenAPI 3.0 contract — the same contract our servers are built against, so it is always in sync with production. Every endpoint page lets you inspect the schema and try requests interactively.

Base URL

All API requests go to https://api.secfix.com.

Authentication

All /v1 endpoints require a bearer access token obtained via the OAuth 2.0 client_credentials grant at POST /oauth/token. Send it as Authorization: Bearer <token>. See Authentication and Scopes. GET /v1/health is the only unauthenticated endpoint.

Endpoint groups

Group	Endpoints	Access
OAuth	`POST /oauth/token`	—
Health	`GET /v1/health`	none
Inventory	`GET /v1/inventory/assets`, `GET /v1/inventory/assets/{id}`, `PATCH /v1/inventory/assets/{id}`, `PATCH /v1/inventory/assets` (bulk), `GET /v1/inventory/categories`	Read / Write (`all:read` / `all:write`)
Computers	`GET /v1/computers`, `GET /v1/computers/{id}`	Read (`all:read`)

Conventions

Pagination — list endpoints return an opaque cursor envelope. See Pagination.
Errors — JSON (application/json) with a stable code. See Errors.
Rate limits — enforced per workspace across token, read, and write request classes. See Rate limits.
Versioning — additive-only within /v1. See Versioning.

Download the spec

The machine-readable contract is available at /api-reference/openapi.yaml — use it to generate clients or import into Postman.