> ## Documentation Index
> Fetch the complete documentation index at: https://developer-staging.secfix.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Secfix Developers

> Read your Secfix inventory, computers, employees, and groups, and manage custom and information assets, over a versioned REST API.

The **Secfix Public API** is a REST API for server-to-server integrations. Use it to read your asset
inventory, computers, employees, and groups. You can also create, update, and delete custom
and information assets, so Secfix stays in sync with your own systems.

> [card] [Quickstart](https://developer-staging.secfix.com/quickstart.md)
>
> Get an access token and make your first call.

> [card] [Authentication](https://developer-staging.secfix.com/authentication.md)
>
> Get a bearer token with the OAuth 2.0 client credentials grant.

> [card] [API reference](https://developer-staging.secfix.com/api-reference/overview.md)
>
> Every endpoint with its parameters, request body, and responses.

> [card] [Changelog](https://developer-staging.secfix.com/changelog.md)
>
> New, changed, and deprecated features.

## What you can do in v1

> [card] [Inventory](https://developer-staging.secfix.com/guides/inventory.md)
>
> List and read assets in every category. Create, update, and delete custom and information
> assets.

> [card] [Computers](https://developer-staging.secfix.com/guides/computers.md)
>
> Read computers and their device compliance status.

> [card] [Employees](https://developer-staging.secfix.com/guides/employees.md)
>
> Read employees with their employment status and onboarding progress.

> [card] [Groups](https://developer-staging.secfix.com/guides/groups.md)
>
> Read employee groups, their member counts, onboarding tasks, and settings.

You can write only **custom** and **information** assets. Computers, cloud resources, and employees
are read-only, because their data comes from the Secfix integrations that discover them. The
computers, employees, and groups endpoints are read-only too.

## Base URLs

| Environment | Base URL |
| - | - |
| Production | `https://api.secfix.com` |
| Staging | `https://api-staging.secfix.com` |

## How it works

**1. Create an API key**

In the Secfix app, go to **Settings → API** and create an API key. Choose its access level. You
get a `client_id` and a `client_secret`. See [Managing API keys](https://developer-staging.secfix.com/guides/managing-api-keys.md).

**2. Get an access token**

Send the `client_id` and `client_secret` to `POST /oauth/token` to get a bearer token. See
[Authentication](https://developer-staging.secfix.com/authentication.md).

**3. Call the API**

Send the token in the `Authorization` header on `/v1` requests. See the
[API reference](https://developer-staging.secfix.com/api-reference/overview.md).

## Conventions

| Topic | Summary | Details |
| - | - | - |
| **Authentication** | OAuth 2.0 client credentials grant. One active token per API key. | [Authentication](https://developer-staging.secfix.com/authentication.md) |
| **Scopes** | `all:read` for reads, `all:write` for writes. Both also cover endpoints added later. | [Scopes](https://developer-staging.secfix.com/scopes.md) |
| **Pagination** | Every list endpoint uses cursors. | [Pagination](https://developer-staging.secfix.com/pagination.md) |
| **Errors** | JSON body with a stable `code`. | [Errors](https://developer-staging.secfix.com/errors.md) |
| **Rate limits** | Separate limits for token, read, and write requests. | [Rate limits](https://developer-staging.secfix.com/rate-limits.md) |
| **Versioning** | The version is in the URL (`/v1`). Changes within a version are additive. | [Versioning](https://developer-staging.secfix.com/versioning.md) |


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.