Skip to main content
API applications are created and managed from the Developer Console in the Secfix web app — not through the API itself. Each application belongs to a workspace, holds a single active token at a time, and is granted a specific set of scopes.

​
Create an application

1

Open the Developer Console

In the Secfix web app, go to the Developer page. You need the permission to manage API applications in your workspace.
2

Create the application

Give it a name and an optional description, then choose its access level. Grant the minimum the integration needs — for example Read for a read-only inventory sync. See Scopes.
3

Copy the client secret

On creation you receive a client_id and a client_secret. The secret is displayed once and never shown again — store it in your secrets manager immediately. You can always rotate it later.

​
Scopes and access levels

The Console offers three access levels, which map to the underlying scopes: all:read grants read access to every resource and all:write grants write access to every resource — see Scopes.

​
Rotate the secret

Rotating an application’s secret issues a new client_secret and immediately invalidates the current access token — the single-active-token rule means the previously issued token starts returning 401 token_superseded. After rotating, fetch a fresh token with the new secret. See Authentication.

​
Delete an application

Deleting an application permanently revokes its credentials and any active token. Requests made with its token afterward fail with 401 unauthorized.
There is no API to create or manage applications — this is a deliberate security boundary. Credential lifecycle lives entirely in the human-operated Developer Console.