> ## Documentation Index
> Fetch the complete documentation index at: https://developer.secfix.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Changelog

> Notable changes to the Secfix Public API. The API is additive within a version — see Versioning for our compatibility guarantees.

The Secfix Public API is versioned in the URL (`/v1`) and evolves additively — new endpoints, new
optional request fields, and new response fields ship without a version bump. Breaking changes are
blocked by an automated contract gate. See [Versioning & deprecation](/versioning).

<Update label="July 2026" description="Inventory: category fields & filters">
  ### Inventory category fields and filters

  * Inventory assets now return **category-specific fields** — `accountId` and `region` for
    `CLOUD`, `serialNumber` and `osVersion` for `COMPUTER`, and `email` for `EMPLOYEE`.
  * Added list filters on `GET /v1/inventory/assets`: `subKey`, `hasOwner`, and `hasDescription`.

  These are additive response fields and optional query parameters — no action required for existing
  integrations.
</Update>

<Update label="July 2026" description="v1.0 general availability">
  ### Secfix Public API v1.0

  The first public release of the Secfix Public API.

  **Authentication**

  * OAuth 2.0 `client_credentials` grant at `POST /oauth/token`, returning a short-lived bearer
    token. One active token per application; requesting a new one supersedes the old
    (`401 token_superseded`).

  **Endpoints**

  * **Inventory** — `GET /v1/inventory/assets`, `GET /v1/inventory/assets/{id}`,
    `PATCH /v1/inventory/assets/{id}`, `PATCH /v1/inventory/assets` (bulk),
    `GET /v1/inventory/categories`.
  * **Computers** — `GET /v1/computers`, `GET /v1/computers/{id}` with aggregate device compliance
    posture.
  * **Health** — `GET /v1/health`.

  **Platform**

  * Read / Write / Full access levels (`all:read`, `all:write`), forward-covering across current and
    future resources.
  * Opaque cursor pagination on all list endpoints.
  * RFC 7807 `application/problem+json` errors with stable `code` strings.
  * Per-`client_id` rate limiting across token, read, and write request classes.
  * Self-serve application management in the **Developer Console** in the Secfix web app.
</Update>