> ## Documentation Index
> Fetch the complete documentation index at: https://developer.secfix.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Overview

> The Secfix Public API surface, generated from the OpenAPI contract.

This reference is generated directly from the Secfix Public API **OpenAPI 3.0 contract** — the same
contract our servers are built against, so it is always in sync with production. Every endpoint page
lets you inspect the schema and try requests interactively.

## Base URL

All API requests go to `https://api.secfix.com`.

## Authentication

All `/v1` endpoints require a bearer access token obtained via the OAuth 2.0 `client_credentials`
grant at `POST /oauth/token`. Send it as `Authorization: Bearer <token>`. See
[Authentication](/authentication) and [Scopes](/scopes).

`GET /v1/health` is the only unauthenticated endpoint.

## Endpoint groups

| Group         | Endpoints                                                                                                                                                           | Access                                  |
| ------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------- | --------------------------------------- |
| **OAuth**     | `POST /oauth/token`                                                                                                                                                 | —                                       |
| **Health**    | `GET /v1/health`                                                                                                                                                    | none                                    |
| **Inventory** | `GET /v1/inventory/assets`, `GET /v1/inventory/assets/{id}`, `PATCH /v1/inventory/assets/{id}`, `PATCH /v1/inventory/assets` (bulk), `GET /v1/inventory/categories` | Read / Write (`all:read` / `all:write`) |
| **Computers** | `GET /v1/computers`, `GET /v1/computers/{id}`                                                                                                                       | Read (`all:read`)                       |

## Conventions

* **Pagination** — list endpoints return an opaque cursor envelope. See [Pagination](/pagination).
* **Errors** — RFC 7807 `application/problem+json` with a stable `code`. See [Errors](/errors).
* **Rate limits** — enforced per `client_id`. See [Rate limits](/rate-limits).
* **Versioning** — additive-only within `/v1`. See [Versioning](/versioning).

## Download the spec

The machine-readable contract is available at
[`/api-reference/openapi.yaml`](/api-reference/openapi.yaml) — use it to generate clients or import
into Postman.