Skip to main content
The Secfix Public API is versioned in the URL (/v1) and evolves additively — new endpoints, new optional request fields, and new response fields ship without a version bump. Breaking changes are blocked by an automated contract gate. See Versioning & deprecation.
​
Inventory: category fields & filters

​
Inventory category fields and filters

  • Inventory assets now return category-specific fields — accountId and region for CLOUD, serialNumber and osVersion for COMPUTER, and email for EMPLOYEE.
  • Added list filters on GET /v1/inventory/assets: subKey, hasOwner, and hasDescription.
These are additive response fields and optional query parameters — no action required for existing integrations.
​
v1.0 general availability

​
Secfix Public API v1.0

The first public release of the Secfix Public API.Authentication
  • OAuth 2.0 client_credentials grant at POST /oauth/token, returning a short-lived bearer token. One active token per application; requesting a new one supersedes the old (401 token_superseded).
Endpoints
  • Inventory — GET /v1/inventory/assets, GET /v1/inventory/assets/{id}, PATCH /v1/inventory/assets/{id}, PATCH /v1/inventory/assets (bulk), GET /v1/inventory/categories.
  • Computers — GET /v1/computers, GET /v1/computers/{id} with aggregate device compliance posture.
  • Health — GET /v1/health.
Platform
  • Read / Write / Full access levels (all:read, all:write), forward-covering across current and future resources.
  • Opaque cursor pagination on all list endpoints.
  • RFC 7807 application/problem+json errors with stable code strings.
  • Per-client_id rate limiting across token, read, and write request classes.
  • Self-serve application management in the Developer Console in the Secfix web app.