Skip to main content
The Secfix Public API is versioned in the URL (/v1) and evolves additively — new endpoints, new optional request fields, and new response fields ship without a version bump. Breaking changes are blocked by an automated contract gate. See Versioning & deprecation.
​
Errors are now application/json

​
Error responses use application/json

Every error response now has Content-Type: application/json (previously application/problem+json), including errors returned before a request reaches the API (except a request body over 10 MB, which is rejected with a minimal response). The body is unchanged: type, title, status, detail, instance (when it applies), a stable code and the requestId. If your client selects its error parser by content type, match application/json. See Errors.A path with no endpoint now returns 404 not_found, and an Accept header that rules out application/json returns 406 not_acceptable, both in the same error envelope.
​
Inventory: category fields & filters

​
Inventory category fields and filters

  • Inventory assets now return category-specific fields — accountId and region for CLOUD, serialNumber and osVersion for COMPUTER, and email for EMPLOYEE.
  • Added list filters on GET /v1/inventory/assets: subKey, hasOwner, and hasDescription.
These are additive response fields and optional query parameters — no action required for existing integrations.
​
v1.0 general availability

​
Secfix Public API v1.0

The first public release of the Secfix Public API.Authentication
  • OAuth 2.0 client_credentials grant at POST /oauth/token, returning a short-lived bearer token. One active token per API key; requesting a new one supersedes the old (401 token_superseded).
Endpoints
  • Inventory — GET /v1/inventory/assets, GET /v1/inventory/assets/{id}, PATCH /v1/inventory/assets/{id}, PATCH /v1/inventory/assets (bulk), GET /v1/inventory/categories.
  • Computers — GET /v1/computers, GET /v1/computers/{id} with aggregate device compliance posture.
  • Health — GET /v1/health.
Platform
  • Read / Write / Full access levels (all:read, all:write), forward-covering across current and future resources.
  • Opaque cursor pagination on all list endpoints.
  • RFC 7807 application/problem+json errors with stable code strings.
  • Rate limiting across token, read, and write request classes.
  • Self-serve API key management in Settings → API in the Secfix web app.