> ## Documentation Index
> Fetch the complete documentation index at: https://developer-staging.secfix.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Changelog

> New features and changes in the Secfix Public API.

The Secfix Public API is versioned in the URL (`/v1`). New endpoints, new optional request fields, and
new response fields are added to `/v1` and listed here. See [Versioning & deprecation](https://developer-staging.secfix.com/versioning.md).

**v1.0**

First release

### Secfix Public API v1.0

The first release of the Secfix Public API.

**Authentication and access**

* Get a short-lived bearer token from `POST /oauth/token` with the OAuth 2.0 client credentials
  grant. Each API key has one active token: requesting a new one makes the previous one stop working
  (`401 token_superseded`). See [Authentication](https://developer-staging.secfix.com/authentication.md).
* Create API keys in **Settings → API** in the Secfix app, with **Read** (`all:read`), **Write**
  (`all:write`) or **Full access**. See [Scopes](https://developer-staging.secfix.com/scopes.md).

**Inventory**

* `GET /v1/inventory/assets` and `GET /v1/inventory/assets/{id}`: assets from every category, with
  category fields such as `accountId` and `region` for `CLOUD`, `serialNumber` and `osVersion` for
  `COMPUTER`, and `email` for `EMPLOYEE`.
* Filter the list by `categoryKey`, `subKey`, `hasOwner`, `hasDescription`, `classification`,
  `ownerStatus`, `auditStatus`, `externalSource` and `externalAssetId`.
* Create, update and delete `CUSTOM` and `INFORMATION` assets, one at a time or up to 100 per
  request with `batch-create`, `batch-update` and `batch-delete`. Each record in a batch gets its own
  result.
* Send `externalSource` and `externalAssetId` to link an asset to a record in your own system.
  Creating it again with the same pair updates the existing asset instead of adding a new one.
* `GET /v1/inventory/categories` lists the inventory categories.

See [Working with inventory](https://developer-staging.secfix.com/guides/inventory.md).

**Computers, employees and groups**

* `GET /v1/computers` and `GET /v1/computers/{id}`: computers, their security settings and
  whether Secfix monitors them. Filter by owner with `ownerId`. See [Working with computers](https://developer-staging.secfix.com/guides/computers.md).
* `GET /v1/employees` and `GET /v1/employees/{id}`: the people in your workspace, with employment
  status, group and onboarding progress. See [Working with employees](https://developer-staging.secfix.com/guides/employees.md).
* `GET /v1/groups` and `GET /v1/groups/{id}`: employee groups, member counts, onboarding tasks and
  group settings. See [Working with groups](https://developer-staging.secfix.com/guides/groups.md).

**Health**

* `GET /v1/health` reports whether the API is up. It doesn't need an access token.

**Conventions**

* Cursor pagination on every list, with `pageInfo` for the next and previous page and the total
  count. See [Pagination](https://developer-staging.secfix.com/pagination.md).
* An `Idempotency-Key` header makes `POST` and `PATCH` requests to `/v1` safe to retry. See
  [Idempotency](https://developer-staging.secfix.com/idempotency.md).
* Errors are JSON objects with a stable `code` and the `requestId`. See [Errors](https://developer-staging.secfix.com/errors.md).
* Separate rate limits for token, read and write requests. See [Rate limits](https://developer-staging.secfix.com/rate-limits.md).


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.