Skip to main content
The Secfix Public API is a REST API for server-to-server integrations. Use it to read your asset inventory, computers, employees, and groups. You can also create, update, and delete custom and information assets, so Secfix stays in sync with your own systems.

Quickstart

Get an access token and make your first call.

Authentication

Get a bearer token with the OAuth 2.0 client credentials grant.

API reference

Every endpoint with its parameters, request body, and responses.

Changelog

New, changed, and deprecated features.

​
What you can do in v1

Inventory

List and read assets in every category. Create, update, and delete custom and information assets.

Computers

Read computers and their device compliance status.

Employees

Read employees with their employment status and onboarding progress.

Groups

Read employee groups, their member counts, onboarding tasks, and settings.
You can write only custom and information assets. Computers, cloud resources, and employees are read-only, because their data comes from the Secfix integrations that discover them. The computers, employees, and groups endpoints are read-only too.

​
Base URLs

​
How it works

1

Create an API key

In the Secfix app, go to Settings → API and create an API key. Choose its access level. You get a client_id and a client_secret. See Managing API keys.
2

Get an access token

Send the client_id and client_secret to POST /oauth/token to get a bearer token. See Authentication.
3

Call the API

Send the token in the Authorization header on /v1 requests. See the API reference.

​
Conventions