> ## Documentation Index > Fetch the complete documentation index at: https://developer-staging.secfix.com/llms.txt > Use this file to discover all available pages before exploring further. # Get an access token > Exchanges your API key's `client_id` and `client_secret` for a bearer access token (OAuth 2.0 client credentials grant). Send the body as `application/x-www-form-urlencoded` with `grant_type=client_credentials`. ## OpenAPI ````yaml /api-reference/openapi.yaml post /oauth/token openapi: 3.0.1 info: title: Secfix Public API description: >- Read and manage your Secfix compliance data from your own systems. Get an access token from `POST /oauth/token` with the OAuth 2.0 client credentials grant, then send it as a bearer token to the `/v1` endpoints. Errors are JSON objects with a stable `code` and the `requestId`. Lists use cursor pagination. contact: name: Secfix Support url: https://secfix.com email: support@secfix.com license: name: Proprietary url: https://secfix.com/license version: 1.0.0 servers: - url: https://api.secfix.com description: Production - url: https://api-staging.secfix.com description: Staging security: - bearerAuth: [] tags: - name: Employees description: >- Read the people in your workspace, with their employment status, group and onboarding progress. - name: Inventory description: >- Read assets in every inventory category. Create, update and delete `CUSTOM` and `INFORMATION` assets. - name: OAuth description: Get an access token with the OAuth 2.0 client credentials grant. - name: Groups description: >- Read employee groups, their member counts and the onboarding tasks assigned to them. - name: Health description: Check that the API is up. - name: Computers description: Read the computers in your workspace and their security settings. paths: /oauth/token: post: tags: - OAuth summary: Get an access token description: >- Exchanges your API key's `client_id` and `client_secret` for a bearer access token (OAuth 2.0 client credentials grant). Send the body as `application/x-www-form-urlencoded` with `grant_type=client_credentials`. operationId: token requestBody: content: application/x-www-form-urlencoded: schema: $ref: '#/components/schemas/OAuthTokenRequest' required: true responses: '200': description: Access token issued. content: application/json: schema: $ref: '#/components/schemas/AccessTokenResponse' '400': description: >- `grant_type` isn't `client_credentials`, or the requested audience isn't supported. Code: `unsupported_grant_type` or `unsupported_audience`. content: application/json: schema: $ref: '#/components/schemas/ProblemDetail' '401': description: >- The `client_id` and `client_secret` don't match an API key. Code: `invalid_client`. content: application/json: schema: $ref: '#/components/schemas/ProblemDetail' '405': description: >- This path doesn't support the HTTP method. The `Allow` header lists the methods it supports. Code: `method_not_allowed`. headers: Allow: description: Comma-separated list of the HTTP methods this path supports. style: simple schema: type: string content: application/json: schema: $ref: '#/components/schemas/ProblemDetail' '429': description: >- Too many token requests from this client or IP address. Wait the number of seconds in `Retry-After`, then retry. Code: `rate_limited`. headers: Retry-After: description: Seconds to wait before retrying. style: simple schema: type: integer content: application/json: schema: $ref: '#/components/schemas/ProblemDetail' security: [] components: schemas: OAuthTokenRequest: required: - client_id - client_secret - grant_type type: object properties: client_id: type: string description: Your API key's client id. example: aB3xY7... client_secret: type: string description: Your API key's client secret. example: s3cr3t... grant_type: type: string description: OAuth 2.0 grant type. Use `client_credentials`. example: client_credentials enum: - client_credentials description: Token request, sent as `application/x-www-form-urlencoded`. AccessTokenResponse: type: object properties: access_token: type: string description: The bearer access token, a JWT signed with RS256. example: eyJhbGciOiJSUzI1NiIsImtpZCI6... expires_in: type: integer description: Seconds until the token expires. format: int64 example: 86400 token_type: type: string description: Always `Bearer`. example: Bearer description: Access token response. ProblemDetail: type: object properties: code: type: string description: >- Error code for your error handling. It doesn't change between releases. example: not_found detail: type: string description: What went wrong in this request. example: No asset found for the given id. instance: type: string description: URI that identifies this occurrence of the error. example: /v1/inventory/assets/3f1c9a2e-8b4d-4e7a-9c1f-2a5b6c7d8e9f requestId: type: string description: >- The request's id, also sent in the `X-Request-Id` header. Include it when you contact support. example: req_01HZY8Q3M4N5P6R7S8T9V0W1X2 status: type: integer description: HTTP status code. format: int32 example: 404 title: type: string description: Short summary of the error type. example: Not Found type: type: string description: URI that identifies the error type. example: https://api.secfix.com/problems/not_found description: The JSON body of every error response. securitySchemes: bearerAuth: type: http description: Access token from `POST /oauth/token`. scheme: bearer bearerFormat: JWT ```` This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.