> ## Documentation Index
> Fetch the complete documentation index at: https://developer.secfix.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Quickstart

> Get an access token and make your first Secfix API call.

This guide takes you from zero to your first authenticated response. It assumes you already have a
Secfix workspace.

<Steps>
  <Step title="Create an API application">
    In the Secfix web app, open the **Developer Console** and create an API application. Give it a
    name and grant it the access it needs — for this guide, **Read** access (`all:read`).

    You receive a **`client_id`** and a **`client_secret`**. The secret is shown **once** — copy it
    somewhere safe. See [Managing applications](/guides/managing-applications) for the full flow.
  </Step>

  <Step title="Exchange your credentials for a token">
    Call the token endpoint with the OAuth 2.0 `client_credentials` grant:

    ```bash theme={null}
    curl -X POST https://api.secfix.com/oauth/token \
      -H "Content-Type: application/x-www-form-urlencoded" \
      -d "grant_type=client_credentials" \
      -d "client_id=YOUR_CLIENT_ID" \
      -d "client_secret=YOUR_CLIENT_SECRET"
    ```

    ```json Response theme={null}
    {
      "access_token": "eyJhbGciOi...",
      "token_type": "Bearer",
      "expires_in": 86400
    }
    ```

    Cache this token and reuse it until it expires — see [Rate limits](/rate-limits). Full details
    in [Authentication](/authentication).
  </Step>

  <Step title="Call your first endpoint">
    Send the access token as a bearer token to list your asset inventory:

    ```bash theme={null}
    curl "https://api.secfix.com/v1/inventory/assets?pageSize=25" \
      -H "Authorization: Bearer eyJhbGciOi..."
    ```

    ```json Response theme={null}
    {
      "results": [
        {
          "id": "3f1c9a2e-8b4d-4e7a-9c1f-2a5b6c7d8e9f",
          "name": "prod-db-01",
          "categoryKey": "CLOUD",
          "classification": "CONFIDENTIAL",
          "completeStatus": "COMPLETE"
        }
      ],
      "pageInfo": {
        "hasNextPage": true,
        "endCursor": "eyJjIjoiMjAyNi0wNi0zMFQwMjowMDowMFoi.."
      }
    }
    ```
  </Step>

  <Step title="Paginate through results">
    Keep passing `pageInfo.endCursor` as `pageCursor` while `pageInfo.hasNextPage` is `true`:

    ```bash theme={null}
    curl "https://api.secfix.com/v1/inventory/assets?pageSize=25&pageCursor=eyJj..." \
      -H "Authorization: Bearer eyJhbGciOi..."
    ```

    See [Pagination](/pagination) for the full contract.
  </Step>
</Steps>

## Next steps

<CardGroup cols={2}>
  <Card title="Authentication" icon="key" href="/authentication">
    Token lifetime, the single-active-token rule, and tenancy.
  </Card>

  <Card title="Scopes" icon="lock" href="/scopes">
    Which permissions each endpoint requires.
  </Card>

  <Card title="Work with inventory" icon="boxes-stacked" href="/guides/inventory">
    Filter assets and update governance metadata.
  </Card>

  <Card title="API reference" icon="code" href="/api-reference/overview">
    Browse every endpoint interactively.
  </Card>
</CardGroup>