Skip to main content
The Secfix Public API is versioned in the URL (/v1). New endpoints, new optional request fields, and new response fields are added to /v1 and listed here. See Versioning & deprecation.
​
First release

​
Secfix Public API v1.0

The first release of the Secfix Public API.Authentication and access
  • Get a short-lived bearer token from POST /oauth/token with the OAuth 2.0 client credentials grant. Each API key has one active token: requesting a new one makes the previous one stop working (401 token_superseded). See Authentication.
  • Create API keys in Settings → API in the Secfix app, with Read (all:read), Write (all:write) or Full access. See Scopes.
Inventory
  • GET /v1/inventory/assets and GET /v1/inventory/assets/{id}: assets from every category, with category fields such as accountId and region for CLOUD, serialNumber and osVersion for COMPUTER, and email for EMPLOYEE.
  • Filter the list by categoryKey, subKey, hasOwner, hasDescription, classification, ownerStatus, auditStatus, externalSource and externalAssetId.
  • Create, update and delete CUSTOM and INFORMATION assets, one at a time or up to 100 per request with batch-create, batch-update and batch-delete. Each record in a batch gets its own result.
  • Send externalSource and externalAssetId to link an asset to a record in your own system. Creating it again with the same pair updates the existing asset instead of adding a new one.
  • GET /v1/inventory/categories lists the inventory categories.
See Working with inventory.Computers, employees and groups
  • GET /v1/computers and GET /v1/computers/{id}: computers, their security settings and whether Secfix monitors them. Filter by owner with ownerId. See Working with computers.
  • GET /v1/employees and GET /v1/employees/{id}: the people in your workspace, with employment status, group and onboarding progress. See Working with employees.
  • GET /v1/groups and GET /v1/groups/{id}: employee groups, member counts, onboarding tasks and group settings. See Working with groups.
Health
  • GET /v1/health reports whether the API is up. It doesn’t need an access token.
Conventions
  • Cursor pagination on every list, with pageInfo for the next and previous page and the total count. See Pagination.
  • An Idempotency-Key header makes POST and PATCH requests to /v1 safe to retry. See Idempotency.
  • Errors are JSON objects with a stable code and the requestId. See Errors.
  • Separate rate limits for token, read and write requests. See Rate limits.