Authentication

The Secfix Public API uses the OAuth 2.0 client credentials grant. Exchange your API key’s client_id and client_secret for a bearer access token. Then send that token with every request.

Get a token

curl -X POST https://api.secfix.com/oauth/token \
  -H "Content-Type: application/x-www-form-urlencoded" \
  -d "grant_type=client_credentials" \
  -d "client_id=YOUR_CLIENT_ID" \
  -d "client_secret=YOUR_CLIENT_SECRET"

Response

{
  "access_token": "eyJhbGciOi...",
  "token_type": "Bearer",
  "expires_in": 86400
}

Field	Meaning
`access_token`	The token to send with your requests.
`token_type`	Always `Bearer`.
`expires_in`	The token’s lifetime in seconds.

The token request can fail with:

Status	`code`	Cause
`400`	`unsupported_grant_type`	`grant_type` isn’t `client_credentials`.
`401`	`invalid_client`	The `client_id` or `client_secret` is wrong.
`429`	`rate_limited`	Too many token requests. See Rate limits.

Call the API

Send the token in the Authorization header:

curl https://api.secfix.com/v1/inventory/assets \
  -H "Authorization: Bearer eyJhbGciOi..."

One active token per API key

Each API key has one active token at a time. When you request a new token or rotate the secret, the previous token stops working. Requests with it return 401 token_superseded. Fetch a token, reuse it until it expires, and fetch a new one when you get a 401.

Workspace

A token is bound to the workspace of its API key when it is issued. You only see that workspace’s data. The API ignores any workspace value you send in a request.

Get started

Core concepts

Guides

Get a token

Call the API

One active token per API key

Workspace

​Get a token

​Call the API

​One active token per API key

​Workspace

Get a token

Call the API

One active token per API key

Workspace