Create or update an asset
curl --request POST \
--url https://api.secfix.com/v1/inventory/assets \
--header 'Authorization: Bearer <token>' \
--header 'Content-Type: application/json' \
--header 'Idempotency-Key: <idempotency-key>' \
--data '
{
"categoryKey": "CUSTOM",
"name": "Office badge printer",
"classification": "CONFIDENTIAL",
"customIdentifier": "SN-48213",
"dataStored": {
"containsPatientData": false,
"containsUserData": true,
"userDataInfo": "Customer names and email addresses."
},
"description": "Printer in the front office.",
"externalAssetId": "CI-1042",
"externalSource": "servicenow-cmdb",
"ownerEmail": "alex@example.com",
"ownerId": "a1b2c3d4-e5f6-4a7b-8c9d-0e1f2a3b4c5d"
}
'import requests
url = "https://api.secfix.com/v1/inventory/assets"
payload = {
"categoryKey": "CUSTOM",
"name": "Office badge printer",
"classification": "CONFIDENTIAL",
"customIdentifier": "SN-48213",
"dataStored": {
"containsPatientData": False,
"containsUserData": True,
"userDataInfo": "Customer names and email addresses."
},
"description": "Printer in the front office.",
"externalAssetId": "CI-1042",
"externalSource": "servicenow-cmdb",
"ownerEmail": "alex@example.com",
"ownerId": "a1b2c3d4-e5f6-4a7b-8c9d-0e1f2a3b4c5d"
}
headers = {
"Idempotency-Key": "<idempotency-key>",
"Authorization": "Bearer <token>",
"Content-Type": "application/json"
}
response = requests.post(url, json=payload, headers=headers)
print(response.text)const options = {
method: 'POST',
headers: {
'Idempotency-Key': '<idempotency-key>',
Authorization: 'Bearer <token>',
'Content-Type': 'application/json'
},
body: JSON.stringify({
categoryKey: 'CUSTOM',
name: 'Office badge printer',
classification: 'CONFIDENTIAL',
customIdentifier: 'SN-48213',
dataStored: {
containsPatientData: false,
containsUserData: true,
userDataInfo: 'Customer names and email addresses.'
},
description: 'Printer in the front office.',
externalAssetId: 'CI-1042',
externalSource: 'servicenow-cmdb',
ownerEmail: 'alex@example.com',
ownerId: 'a1b2c3d4-e5f6-4a7b-8c9d-0e1f2a3b4c5d'
})
};
fetch('https://api.secfix.com/v1/inventory/assets', options)
.then(res => res.json())
.then(res => console.log(res))
.catch(err => console.error(err));<?php
$curl = curl_init();
curl_setopt_array($curl, [
CURLOPT_URL => "https://api.secfix.com/v1/inventory/assets",
CURLOPT_RETURNTRANSFER => true,
CURLOPT_ENCODING => "",
CURLOPT_MAXREDIRS => 10,
CURLOPT_TIMEOUT => 30,
CURLOPT_HTTP_VERSION => CURL_HTTP_VERSION_1_1,
CURLOPT_CUSTOMREQUEST => "POST",
CURLOPT_POSTFIELDS => json_encode([
'categoryKey' => 'CUSTOM',
'name' => 'Office badge printer',
'classification' => 'CONFIDENTIAL',
'customIdentifier' => 'SN-48213',
'dataStored' => [
'containsPatientData' => false,
'containsUserData' => true,
'userDataInfo' => 'Customer names and email addresses.'
],
'description' => 'Printer in the front office.',
'externalAssetId' => 'CI-1042',
'externalSource' => 'servicenow-cmdb',
'ownerEmail' => 'alex@example.com',
'ownerId' => 'a1b2c3d4-e5f6-4a7b-8c9d-0e1f2a3b4c5d'
]),
CURLOPT_HTTPHEADER => [
"Authorization: Bearer <token>",
"Content-Type: application/json",
"Idempotency-Key: <idempotency-key>"
],
]);
$response = curl_exec($curl);
$err = curl_error($curl);
curl_close($curl);
if ($err) {
echo "cURL Error #:" . $err;
} else {
echo $response;
}package main
import (
"fmt"
"strings"
"net/http"
"io"
)
func main() {
url := "https://api.secfix.com/v1/inventory/assets"
payload := strings.NewReader("{\n \"categoryKey\": \"CUSTOM\",\n \"name\": \"Office badge printer\",\n \"classification\": \"CONFIDENTIAL\",\n \"customIdentifier\": \"SN-48213\",\n \"dataStored\": {\n \"containsPatientData\": false,\n \"containsUserData\": true,\n \"userDataInfo\": \"Customer names and email addresses.\"\n },\n \"description\": \"Printer in the front office.\",\n \"externalAssetId\": \"CI-1042\",\n \"externalSource\": \"servicenow-cmdb\",\n \"ownerEmail\": \"alex@example.com\",\n \"ownerId\": \"a1b2c3d4-e5f6-4a7b-8c9d-0e1f2a3b4c5d\"\n}")
req, _ := http.NewRequest("POST", url, payload)
req.Header.Add("Idempotency-Key", "<idempotency-key>")
req.Header.Add("Authorization", "Bearer <token>")
req.Header.Add("Content-Type", "application/json")
res, _ := http.DefaultClient.Do(req)
defer res.Body.Close()
body, _ := io.ReadAll(res.Body)
fmt.Println(string(body))
}HttpResponse<String> response = Unirest.post("https://api.secfix.com/v1/inventory/assets")
.header("Idempotency-Key", "<idempotency-key>")
.header("Authorization", "Bearer <token>")
.header("Content-Type", "application/json")
.body("{\n \"categoryKey\": \"CUSTOM\",\n \"name\": \"Office badge printer\",\n \"classification\": \"CONFIDENTIAL\",\n \"customIdentifier\": \"SN-48213\",\n \"dataStored\": {\n \"containsPatientData\": false,\n \"containsUserData\": true,\n \"userDataInfo\": \"Customer names and email addresses.\"\n },\n \"description\": \"Printer in the front office.\",\n \"externalAssetId\": \"CI-1042\",\n \"externalSource\": \"servicenow-cmdb\",\n \"ownerEmail\": \"alex@example.com\",\n \"ownerId\": \"a1b2c3d4-e5f6-4a7b-8c9d-0e1f2a3b4c5d\"\n}")
.asString();require 'uri'
require 'net/http'
url = URI("https://api.secfix.com/v1/inventory/assets")
http = Net::HTTP.new(url.host, url.port)
http.use_ssl = true
request = Net::HTTP::Post.new(url)
request["Idempotency-Key"] = '<idempotency-key>'
request["Authorization"] = 'Bearer <token>'
request["Content-Type"] = 'application/json'
request.body = "{\n \"categoryKey\": \"CUSTOM\",\n \"name\": \"Office badge printer\",\n \"classification\": \"CONFIDENTIAL\",\n \"customIdentifier\": \"SN-48213\",\n \"dataStored\": {\n \"containsPatientData\": false,\n \"containsUserData\": true,\n \"userDataInfo\": \"Customer names and email addresses.\"\n },\n \"description\": \"Printer in the front office.\",\n \"externalAssetId\": \"CI-1042\",\n \"externalSource\": \"servicenow-cmdb\",\n \"ownerEmail\": \"alex@example.com\",\n \"ownerId\": \"a1b2c3d4-e5f6-4a7b-8c9d-0e1f2a3b4c5d\"\n}"
response = http.request(request)
puts response.read_body{
"accountId": "123456789012",
"auditStatus": "INCOMPLETE",
"categoryKey": "CLOUD",
"classification": "CONFIDENTIAL",
"createdAt": "2026-01-15T09:30:00.000Z",
"customIdentifier": "i-0abc123def456",
"dataStored": {
"containsPatientData": false,
"containsUserData": true,
"userDataInfo": "Customer contact records"
},
"description": "Primary production web server.",
"email": "jane.doe@example.com",
"externalAssetId": "CI-1042",
"externalSource": "servicenow-cmdb",
"id": "3f1c9a2e-8b4d-4e7a-9c1f-2a5b6c7d8e9f",
"lastCheckedAt": "2026-06-30T02:00:00.000Z",
"name": "prod-web-01",
"osVersion": "macOS 14.5",
"ownerId": "a1b2c3d4-e5f6-4a7b-8c9d-0e1f2a3b4c5d",
"ownerSource": "MANUAL",
"ownerStatus": "COMPLETE",
"region": "eu-central-1",
"serialNumber": "C02XY1234ABC",
"tags": [
{
"key": "environment",
"readOnly": false,
"value": "production"
}
],
"type": "SERVER"
}{
"accountId": "123456789012",
"auditStatus": "INCOMPLETE",
"categoryKey": "CLOUD",
"classification": "CONFIDENTIAL",
"createdAt": "2026-01-15T09:30:00.000Z",
"customIdentifier": "i-0abc123def456",
"dataStored": {
"containsPatientData": false,
"containsUserData": true,
"userDataInfo": "Customer contact records"
},
"description": "Primary production web server.",
"email": "jane.doe@example.com",
"externalAssetId": "CI-1042",
"externalSource": "servicenow-cmdb",
"id": "3f1c9a2e-8b4d-4e7a-9c1f-2a5b6c7d8e9f",
"lastCheckedAt": "2026-06-30T02:00:00.000Z",
"name": "prod-web-01",
"osVersion": "macOS 14.5",
"ownerId": "a1b2c3d4-e5f6-4a7b-8c9d-0e1f2a3b4c5d",
"ownerSource": "MANUAL",
"ownerStatus": "COMPLETE",
"region": "eu-central-1",
"serialNumber": "C02XY1234ABC",
"tags": [
{
"key": "environment",
"readOnly": false,
"value": "production"
}
],
"type": "SERVER"
}{
"code": "not_found",
"detail": "No asset found for the given id.",
"instance": "/v1/inventory/assets/3f1c9a2e-8b4d-4e7a-9c1f-2a5b6c7d8e9f",
"requestId": "req_01HZY8Q3M4N5P6R7S8T9V0W1X2",
"status": 404,
"title": "Not Found",
"type": "https://api.secfix.com/problems/not_found"
}{
"code": "not_found",
"detail": "No asset found for the given id.",
"instance": "/v1/inventory/assets/3f1c9a2e-8b4d-4e7a-9c1f-2a5b6c7d8e9f",
"requestId": "req_01HZY8Q3M4N5P6R7S8T9V0W1X2",
"status": 404,
"title": "Not Found",
"type": "https://api.secfix.com/problems/not_found"
}{
"code": "not_found",
"detail": "No asset found for the given id.",
"instance": "/v1/inventory/assets/3f1c9a2e-8b4d-4e7a-9c1f-2a5b6c7d8e9f",
"requestId": "req_01HZY8Q3M4N5P6R7S8T9V0W1X2",
"status": 404,
"title": "Not Found",
"type": "https://api.secfix.com/problems/not_found"
}{
"code": "not_found",
"detail": "No asset found for the given id.",
"instance": "/v1/inventory/assets/3f1c9a2e-8b4d-4e7a-9c1f-2a5b6c7d8e9f",
"requestId": "req_01HZY8Q3M4N5P6R7S8T9V0W1X2",
"status": 404,
"title": "Not Found",
"type": "https://api.secfix.com/problems/not_found"
}{
"code": "not_found",
"detail": "No asset found for the given id.",
"instance": "/v1/inventory/assets/3f1c9a2e-8b4d-4e7a-9c1f-2a5b6c7d8e9f",
"requestId": "req_01HZY8Q3M4N5P6R7S8T9V0W1X2",
"status": 404,
"title": "Not Found",
"type": "https://api.secfix.com/problems/not_found"
}{
"code": "not_found",
"detail": "No asset found for the given id.",
"instance": "/v1/inventory/assets/3f1c9a2e-8b4d-4e7a-9c1f-2a5b6c7d8e9f",
"requestId": "req_01HZY8Q3M4N5P6R7S8T9V0W1X2",
"status": 404,
"title": "Not Found",
"type": "https://api.secfix.com/problems/not_found"
}{
"code": "not_found",
"detail": "No asset found for the given id.",
"instance": "/v1/inventory/assets/3f1c9a2e-8b4d-4e7a-9c1f-2a5b6c7d8e9f",
"requestId": "req_01HZY8Q3M4N5P6R7S8T9V0W1X2",
"status": 404,
"title": "Not Found",
"type": "https://api.secfix.com/problems/not_found"
}{
"code": "not_found",
"detail": "No asset found for the given id.",
"instance": "/v1/inventory/assets/3f1c9a2e-8b4d-4e7a-9c1f-2a5b6c7d8e9f",
"requestId": "req_01HZY8Q3M4N5P6R7S8T9V0W1X2",
"status": 404,
"title": "Not Found",
"type": "https://api.secfix.com/problems/not_found"
}{
"code": "not_found",
"detail": "No asset found for the given id.",
"instance": "/v1/inventory/assets/3f1c9a2e-8b4d-4e7a-9c1f-2a5b6c7d8e9f",
"requestId": "req_01HZY8Q3M4N5P6R7S8T9V0W1X2",
"status": 404,
"title": "Not Found",
"type": "https://api.secfix.com/problems/not_found"
}Inventory
Create or update an asset
Creates a CUSTOM or INFORMATION asset. It appears in Secfix like an asset added in the app. Set the owner with ownerId or ownerEmail.
To link the asset to a record in your own system, send externalSource and externalAssetId. If an asset in the same category already has that pair, the call updates it instead: only the fields you send change, and the response is 200 instead of 201.
Requires the all:write scope.
POST
/
v1
/
inventory
/
assets
Create or update an asset
curl --request POST \
--url https://api.secfix.com/v1/inventory/assets \
--header 'Authorization: Bearer <token>' \
--header 'Content-Type: application/json' \
--header 'Idempotency-Key: <idempotency-key>' \
--data '
{
"categoryKey": "CUSTOM",
"name": "Office badge printer",
"classification": "CONFIDENTIAL",
"customIdentifier": "SN-48213",
"dataStored": {
"containsPatientData": false,
"containsUserData": true,
"userDataInfo": "Customer names and email addresses."
},
"description": "Printer in the front office.",
"externalAssetId": "CI-1042",
"externalSource": "servicenow-cmdb",
"ownerEmail": "alex@example.com",
"ownerId": "a1b2c3d4-e5f6-4a7b-8c9d-0e1f2a3b4c5d"
}
'import requests
url = "https://api.secfix.com/v1/inventory/assets"
payload = {
"categoryKey": "CUSTOM",
"name": "Office badge printer",
"classification": "CONFIDENTIAL",
"customIdentifier": "SN-48213",
"dataStored": {
"containsPatientData": False,
"containsUserData": True,
"userDataInfo": "Customer names and email addresses."
},
"description": "Printer in the front office.",
"externalAssetId": "CI-1042",
"externalSource": "servicenow-cmdb",
"ownerEmail": "alex@example.com",
"ownerId": "a1b2c3d4-e5f6-4a7b-8c9d-0e1f2a3b4c5d"
}
headers = {
"Idempotency-Key": "<idempotency-key>",
"Authorization": "Bearer <token>",
"Content-Type": "application/json"
}
response = requests.post(url, json=payload, headers=headers)
print(response.text)const options = {
method: 'POST',
headers: {
'Idempotency-Key': '<idempotency-key>',
Authorization: 'Bearer <token>',
'Content-Type': 'application/json'
},
body: JSON.stringify({
categoryKey: 'CUSTOM',
name: 'Office badge printer',
classification: 'CONFIDENTIAL',
customIdentifier: 'SN-48213',
dataStored: {
containsPatientData: false,
containsUserData: true,
userDataInfo: 'Customer names and email addresses.'
},
description: 'Printer in the front office.',
externalAssetId: 'CI-1042',
externalSource: 'servicenow-cmdb',
ownerEmail: 'alex@example.com',
ownerId: 'a1b2c3d4-e5f6-4a7b-8c9d-0e1f2a3b4c5d'
})
};
fetch('https://api.secfix.com/v1/inventory/assets', options)
.then(res => res.json())
.then(res => console.log(res))
.catch(err => console.error(err));<?php
$curl = curl_init();
curl_setopt_array($curl, [
CURLOPT_URL => "https://api.secfix.com/v1/inventory/assets",
CURLOPT_RETURNTRANSFER => true,
CURLOPT_ENCODING => "",
CURLOPT_MAXREDIRS => 10,
CURLOPT_TIMEOUT => 30,
CURLOPT_HTTP_VERSION => CURL_HTTP_VERSION_1_1,
CURLOPT_CUSTOMREQUEST => "POST",
CURLOPT_POSTFIELDS => json_encode([
'categoryKey' => 'CUSTOM',
'name' => 'Office badge printer',
'classification' => 'CONFIDENTIAL',
'customIdentifier' => 'SN-48213',
'dataStored' => [
'containsPatientData' => false,
'containsUserData' => true,
'userDataInfo' => 'Customer names and email addresses.'
],
'description' => 'Printer in the front office.',
'externalAssetId' => 'CI-1042',
'externalSource' => 'servicenow-cmdb',
'ownerEmail' => 'alex@example.com',
'ownerId' => 'a1b2c3d4-e5f6-4a7b-8c9d-0e1f2a3b4c5d'
]),
CURLOPT_HTTPHEADER => [
"Authorization: Bearer <token>",
"Content-Type: application/json",
"Idempotency-Key: <idempotency-key>"
],
]);
$response = curl_exec($curl);
$err = curl_error($curl);
curl_close($curl);
if ($err) {
echo "cURL Error #:" . $err;
} else {
echo $response;
}package main
import (
"fmt"
"strings"
"net/http"
"io"
)
func main() {
url := "https://api.secfix.com/v1/inventory/assets"
payload := strings.NewReader("{\n \"categoryKey\": \"CUSTOM\",\n \"name\": \"Office badge printer\",\n \"classification\": \"CONFIDENTIAL\",\n \"customIdentifier\": \"SN-48213\",\n \"dataStored\": {\n \"containsPatientData\": false,\n \"containsUserData\": true,\n \"userDataInfo\": \"Customer names and email addresses.\"\n },\n \"description\": \"Printer in the front office.\",\n \"externalAssetId\": \"CI-1042\",\n \"externalSource\": \"servicenow-cmdb\",\n \"ownerEmail\": \"alex@example.com\",\n \"ownerId\": \"a1b2c3d4-e5f6-4a7b-8c9d-0e1f2a3b4c5d\"\n}")
req, _ := http.NewRequest("POST", url, payload)
req.Header.Add("Idempotency-Key", "<idempotency-key>")
req.Header.Add("Authorization", "Bearer <token>")
req.Header.Add("Content-Type", "application/json")
res, _ := http.DefaultClient.Do(req)
defer res.Body.Close()
body, _ := io.ReadAll(res.Body)
fmt.Println(string(body))
}HttpResponse<String> response = Unirest.post("https://api.secfix.com/v1/inventory/assets")
.header("Idempotency-Key", "<idempotency-key>")
.header("Authorization", "Bearer <token>")
.header("Content-Type", "application/json")
.body("{\n \"categoryKey\": \"CUSTOM\",\n \"name\": \"Office badge printer\",\n \"classification\": \"CONFIDENTIAL\",\n \"customIdentifier\": \"SN-48213\",\n \"dataStored\": {\n \"containsPatientData\": false,\n \"containsUserData\": true,\n \"userDataInfo\": \"Customer names and email addresses.\"\n },\n \"description\": \"Printer in the front office.\",\n \"externalAssetId\": \"CI-1042\",\n \"externalSource\": \"servicenow-cmdb\",\n \"ownerEmail\": \"alex@example.com\",\n \"ownerId\": \"a1b2c3d4-e5f6-4a7b-8c9d-0e1f2a3b4c5d\"\n}")
.asString();require 'uri'
require 'net/http'
url = URI("https://api.secfix.com/v1/inventory/assets")
http = Net::HTTP.new(url.host, url.port)
http.use_ssl = true
request = Net::HTTP::Post.new(url)
request["Idempotency-Key"] = '<idempotency-key>'
request["Authorization"] = 'Bearer <token>'
request["Content-Type"] = 'application/json'
request.body = "{\n \"categoryKey\": \"CUSTOM\",\n \"name\": \"Office badge printer\",\n \"classification\": \"CONFIDENTIAL\",\n \"customIdentifier\": \"SN-48213\",\n \"dataStored\": {\n \"containsPatientData\": false,\n \"containsUserData\": true,\n \"userDataInfo\": \"Customer names and email addresses.\"\n },\n \"description\": \"Printer in the front office.\",\n \"externalAssetId\": \"CI-1042\",\n \"externalSource\": \"servicenow-cmdb\",\n \"ownerEmail\": \"alex@example.com\",\n \"ownerId\": \"a1b2c3d4-e5f6-4a7b-8c9d-0e1f2a3b4c5d\"\n}"
response = http.request(request)
puts response.read_body{
"accountId": "123456789012",
"auditStatus": "INCOMPLETE",
"categoryKey": "CLOUD",
"classification": "CONFIDENTIAL",
"createdAt": "2026-01-15T09:30:00.000Z",
"customIdentifier": "i-0abc123def456",
"dataStored": {
"containsPatientData": false,
"containsUserData": true,
"userDataInfo": "Customer contact records"
},
"description": "Primary production web server.",
"email": "jane.doe@example.com",
"externalAssetId": "CI-1042",
"externalSource": "servicenow-cmdb",
"id": "3f1c9a2e-8b4d-4e7a-9c1f-2a5b6c7d8e9f",
"lastCheckedAt": "2026-06-30T02:00:00.000Z",
"name": "prod-web-01",
"osVersion": "macOS 14.5",
"ownerId": "a1b2c3d4-e5f6-4a7b-8c9d-0e1f2a3b4c5d",
"ownerSource": "MANUAL",
"ownerStatus": "COMPLETE",
"region": "eu-central-1",
"serialNumber": "C02XY1234ABC",
"tags": [
{
"key": "environment",
"readOnly": false,
"value": "production"
}
],
"type": "SERVER"
}{
"accountId": "123456789012",
"auditStatus": "INCOMPLETE",
"categoryKey": "CLOUD",
"classification": "CONFIDENTIAL",
"createdAt": "2026-01-15T09:30:00.000Z",
"customIdentifier": "i-0abc123def456",
"dataStored": {
"containsPatientData": false,
"containsUserData": true,
"userDataInfo": "Customer contact records"
},
"description": "Primary production web server.",
"email": "jane.doe@example.com",
"externalAssetId": "CI-1042",
"externalSource": "servicenow-cmdb",
"id": "3f1c9a2e-8b4d-4e7a-9c1f-2a5b6c7d8e9f",
"lastCheckedAt": "2026-06-30T02:00:00.000Z",
"name": "prod-web-01",
"osVersion": "macOS 14.5",
"ownerId": "a1b2c3d4-e5f6-4a7b-8c9d-0e1f2a3b4c5d",
"ownerSource": "MANUAL",
"ownerStatus": "COMPLETE",
"region": "eu-central-1",
"serialNumber": "C02XY1234ABC",
"tags": [
{
"key": "environment",
"readOnly": false,
"value": "production"
}
],
"type": "SERVER"
}{
"code": "not_found",
"detail": "No asset found for the given id.",
"instance": "/v1/inventory/assets/3f1c9a2e-8b4d-4e7a-9c1f-2a5b6c7d8e9f",
"requestId": "req_01HZY8Q3M4N5P6R7S8T9V0W1X2",
"status": 404,
"title": "Not Found",
"type": "https://api.secfix.com/problems/not_found"
}{
"code": "not_found",
"detail": "No asset found for the given id.",
"instance": "/v1/inventory/assets/3f1c9a2e-8b4d-4e7a-9c1f-2a5b6c7d8e9f",
"requestId": "req_01HZY8Q3M4N5P6R7S8T9V0W1X2",
"status": 404,
"title": "Not Found",
"type": "https://api.secfix.com/problems/not_found"
}{
"code": "not_found",
"detail": "No asset found for the given id.",
"instance": "/v1/inventory/assets/3f1c9a2e-8b4d-4e7a-9c1f-2a5b6c7d8e9f",
"requestId": "req_01HZY8Q3M4N5P6R7S8T9V0W1X2",
"status": 404,
"title": "Not Found",
"type": "https://api.secfix.com/problems/not_found"
}{
"code": "not_found",
"detail": "No asset found for the given id.",
"instance": "/v1/inventory/assets/3f1c9a2e-8b4d-4e7a-9c1f-2a5b6c7d8e9f",
"requestId": "req_01HZY8Q3M4N5P6R7S8T9V0W1X2",
"status": 404,
"title": "Not Found",
"type": "https://api.secfix.com/problems/not_found"
}{
"code": "not_found",
"detail": "No asset found for the given id.",
"instance": "/v1/inventory/assets/3f1c9a2e-8b4d-4e7a-9c1f-2a5b6c7d8e9f",
"requestId": "req_01HZY8Q3M4N5P6R7S8T9V0W1X2",
"status": 404,
"title": "Not Found",
"type": "https://api.secfix.com/problems/not_found"
}{
"code": "not_found",
"detail": "No asset found for the given id.",
"instance": "/v1/inventory/assets/3f1c9a2e-8b4d-4e7a-9c1f-2a5b6c7d8e9f",
"requestId": "req_01HZY8Q3M4N5P6R7S8T9V0W1X2",
"status": 404,
"title": "Not Found",
"type": "https://api.secfix.com/problems/not_found"
}{
"code": "not_found",
"detail": "No asset found for the given id.",
"instance": "/v1/inventory/assets/3f1c9a2e-8b4d-4e7a-9c1f-2a5b6c7d8e9f",
"requestId": "req_01HZY8Q3M4N5P6R7S8T9V0W1X2",
"status": 404,
"title": "Not Found",
"type": "https://api.secfix.com/problems/not_found"
}{
"code": "not_found",
"detail": "No asset found for the given id.",
"instance": "/v1/inventory/assets/3f1c9a2e-8b4d-4e7a-9c1f-2a5b6c7d8e9f",
"requestId": "req_01HZY8Q3M4N5P6R7S8T9V0W1X2",
"status": 404,
"title": "Not Found",
"type": "https://api.secfix.com/problems/not_found"
}{
"code": "not_found",
"detail": "No asset found for the given id.",
"instance": "/v1/inventory/assets/3f1c9a2e-8b4d-4e7a-9c1f-2a5b6c7d8e9f",
"requestId": "req_01HZY8Q3M4N5P6R7S8T9V0W1X2",
"status": 404,
"title": "Not Found",
"type": "https://api.secfix.com/problems/not_found"
}Authorizations
Access token from POST /oauth/token.
Headers
A unique key, up to 256 characters, that makes the request safe to retry. Use a new UUID for each distinct request. If you send the same key again, you get the first response back, for at least 24 hours after the first request completes. Only successful (2xx) responses are stored. If the first request is still running, you get 409 idempotency_in_progress: wait the number of seconds in Retry-After, then retry. See Idempotency.
Maximum string length:
256Example:
"b0f8e5a2-3c1d-4e6f-8a9b-0c1d2e3f4a5b"
Body
application/json
Creates one CUSTOM or INFORMATION asset. It appears in Secfix like an asset added in the app. Send externalSource and externalAssetId to link it to a record in your system: a later create with the same pair in the same category updates this asset instead of adding another, and changes only the fields you send.
Category to create the asset in: CUSTOM or INFORMATION, in any letter case.
Available options:
CUSTOM, INFORMATION Example:
"CUSTOM"
Asset name, 1-255 characters. Leading and trailing spaces are removed.
Maximum string length:
255Example:
"Office badge printer"
Data classification, in any letter case. Defaults to INTERNAL.
Available options:
RESTRICTED, CONFIDENTIAL, INTERNAL, PUBLIC, UNKNOWN Example:
"CONFIDENTIAL"
Serial number or asset ID, shown in Secfix as ID/Serial No. Up to 255 characters. Free text and not unique: to identify the asset in your system, use externalSource and externalAssetId.
Maximum string length:
255Example:
"SN-48213"
What data the asset stores. On create, fields you leave out stay unset.
Show child attributes
Show child attributes
Asset description, up to 500 characters.
Maximum string length:
500Example:
"Printer in the front office."
The asset's id in your system. Up to 255 characters; leading and trailing spaces are removed. Must be unique per workspace, category and externalSource among assets that haven't been deleted. Matched exactly. Send it with externalSource. You can't change it later.
Maximum string length:
255Example:
"CI-1042"
A name you choose for the system the asset comes from, such as servicenow. Up to 255 characters; leading and trailing spaces are removed. Matched exactly, so send the same value every time. Send it with externalAssetId.
Maximum string length:
255Example:
"servicenow-cmdb"
Owner's email address, case-insensitive. Send ownerId or ownerEmail, not both.
Maximum string length:
320Example:
"alex@example.com"
Owner's employee id. Send ownerId or ownerEmail, not both. An asset without an owner shows as incomplete.
Example:
"a1b2c3d4-e5f6-4a7b-8c9d-0e1f2a3b4c5d"
Response
An asset with the same externalSource and externalAssetId already existed and was updated.
An inventory asset. Fields marked with a category are only set for assets in that category. For EMPLOYEE assets, id is the employee's id.
Cloud account id. CLOUD assets only.
Example:
"123456789012"
Audit status, as shown in the Secfix app: COMPLETE when every field the category needs for an audit is set, otherwise INCOMPLETE. Left out when Secfix hasn't computed it yet. Read-only.
Available options:
COMPLETE, INCOMPLETE Example:
"INCOMPLETE"
The asset's category key. For cloud assets it's the sub-type, such as CLOUD_QUEUE.
Available options:
CLOUD, COMPUTER, CUSTOM, INFORMATION, EMPLOYEE Example:
"CLOUD"
Data classification.
Example:
"CONFIDENTIAL"
When the asset was created (UTC).
Example:
"2026-01-15T09:30:00.000Z"
Serial number or asset ID, shown in Secfix as ID/Serial No.: the provider's resource id for cloud assets, the serial number for computers, and free text for CUSTOM and INFORMATION assets. Not unique.
Example:
"i-0abc123def456"
What data a CUSTOM or INFORMATION asset stores. Set it with dataStored on create or update.
Show child attributes
Show child attributes
Asset description.
Example:
"Primary production web server."
Employee's email address. Personal data. EMPLOYEE assets only.
Example:
"jane.doe@example.com"
The asset's id in your system, as sent on create. Left out for other assets.
Example:
"CI-1042"
The system the asset comes from, as sent on create. Only set on CUSTOM and INFORMATION assets created through the API.
Example:
"servicenow-cmdb"
The asset's id (UUID).
Example:
"3f1c9a2e-8b4d-4e7a-9c1f-2a5b6c7d8e9f"
When the asset was last checked for compliance (UTC). Left out for assets that aren't checked.
Example:
"2026-06-30T02:00:00.000Z"
Asset name.
Example:
"prod-web-01"
Operating system and version. COMPUTER assets only.
Example:
"macOS 14.5"
Owner's employee id: the owner the Secfix app shows. The owner can be someone GET /v1/employees doesn't list, such as a service account or a person excluded from compliance, so looking them up there can return 404.
Example:
"a1b2c3d4-e5f6-4a7b-8c9d-0e1f2a3b4c5d"
Where the owner assignment comes from.
Example:
"MANUAL"
COMPLETE when the asset has an owner, otherwise INCOMPLETE. Set for every category. This isn't the audit status; see auditStatus. Read-only.
Available options:
COMPLETE, INCOMPLETE Example:
"COMPLETE"
Cloud region or location. CLOUD assets only.
Example:
"eu-central-1"
Hardware serial number. COMPUTER assets only.
Example:
"C02XY1234ABC"
Tags on the asset.
Show child attributes
Show child attributes
Asset type within its category.
Example:
"SERVER"