> ## Documentation Index
> Fetch the complete documentation index at: https://developer-staging.secfix.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Overview

> Every Secfix Public API endpoint, generated from the OpenAPI contract.

This reference is generated from the API's OpenAPI 3.0 contract. Each endpoint page shows the
parameters, request body, and responses, and lets you try the request.

## Base URLs

| Environment | Base URL |
| - | - |
| Production | `https://api.secfix.com` |
| Staging | `https://api-staging.secfix.com` |

## Authentication

Every `/v1` endpoint except `GET /v1/health` requires a bearer access token. Get one with the OAuth
2.0 `client_credentials` grant at `POST /oauth/token`, then send it as
`Authorization: Bearer <token>`. See [Authentication](https://developer-staging.secfix.com/authentication.md) and [Scopes](https://developer-staging.secfix.com/scopes.md).

## Endpoints

| Group | Endpoint | Method and path | Access |
| - | - | - | - |
| OAuth | Get an access token | `POST /oauth/token` | None |
| Health | Check API health | `GET /v1/health` | None |
| Inventory | List assets | `GET /v1/inventory/assets` | Read |
| Inventory | Get an asset | `GET /v1/inventory/assets/{id}` | Read |
| Inventory | Create or update an asset | `POST /v1/inventory/assets` | Write |
| Inventory | Create assets in a batch | `POST /v1/inventory/assets/batch-create` | Write |
| Inventory | Update an asset | `PATCH /v1/inventory/assets/{id}` | Write |
| Inventory | Update assets in a batch | `PATCH /v1/inventory/assets/batch-update` | Write |
| Inventory | Delete an asset | `DELETE /v1/inventory/assets/{id}` | Write |
| Inventory | Delete assets in a batch | `POST /v1/inventory/assets/batch-delete` | Write |
| Inventory | List asset categories | `GET /v1/inventory/categories` | Read |
| Computers | List computers | `GET /v1/computers` | Read |
| Computers | Get a computer | `GET /v1/computers/{id}` | Read |
| Employees | List employees | `GET /v1/employees` | Read |
| Employees | Get an employee | `GET /v1/employees/{id}` | Read |
| Groups | List groups | `GET /v1/groups` | Read |
| Groups | Get a group | `GET /v1/groups/{id}` | Read |

**Read** is the `all:read` scope and **Write** is `all:write`.

## Conventions

* **Pagination:** list endpoints return cursor-based pages. See [Pagination](https://developer-staging.secfix.com/pagination.md).
* **Errors:** JSON body with a stable `code`. See [Errors](https://developer-staging.secfix.com/errors.md).
* **Rate limits:** separate limits for token, read, and write requests. See
  [Rate limits](https://developer-staging.secfix.com/rate-limits.md).
* **Versioning:** only additive changes within `/v1`. See [Versioning](https://developer-staging.secfix.com/versioning.md).

## Download the spec

Download the contract at [`/api-reference/openapi.yaml`](https://developer-staging.secfix.com/api-reference/openapi.yaml). Use it to
generate a client or import it into your API tool.


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.