# Secfix Developers (Staging) > Staging documentation for the Secfix Public API — includes the staging environment. For production docs, see developer.secfix.com. - [Secfix Developers](https://developer-staging.secfix.com/index.md): Read your Secfix inventory, computers, employees, and groups, and manage custom and information assets, over a versioned REST API. - [Quickstart](https://developer-staging.secfix.com/quickstart.md): Get an access token and make your first Secfix API call. - [Authentication](https://developer-staging.secfix.com/authentication.md): Get an OAuth 2.0 access token and send it with your requests. - [Scopes](https://developer-staging.secfix.com/scopes.md): The access you can grant an API key. - [Pagination](https://developer-staging.secfix.com/pagination.md): Read long lists one page at a time with cursors. - [Idempotency](https://developer-staging.secfix.com/idempotency.md): Retry write requests safely with an Idempotency-Key. - [Errors](https://developer-staging.secfix.com/errors.md): The error format and every error code. - [Rate limits](https://developer-staging.secfix.com/rate-limits.md): Request limits and how to handle 429 responses. - [Versioning & deprecation](https://developer-staging.secfix.com/versioning.md): How the API is versioned and how we announce retiring endpoints. - [Managing API keys](https://developer-staging.secfix.com/guides/managing-api-keys.md): Create, rotate, and delete the API keys your integrations use. - [Working with inventory](https://developer-staging.secfix.com/guides/inventory.md): List and filter assets in every category. Create, update, and delete custom and information assets. - [Working with computers](https://developer-staging.secfix.com/guides/computers.md): Read computers and their device compliance status. - [Working with employees](https://developer-staging.secfix.com/guides/employees.md): Read employees with their employment status, group, and onboarding progress. - [Working with groups](https://developer-staging.secfix.com/guides/groups.md): Read employee groups, their member counts, onboarding tasks, and settings. - [Overview](https://developer-staging.secfix.com/api-reference/overview.md): Every Secfix Public API endpoint, generated from the OpenAPI contract. - [Get an access token](https://developer-staging.secfix.com/api-reference/oauth/get-an-access-token.md): Exchanges your API key's `client_id` and `client_secret` for a bearer access token (OAuth 2.0 client credentials grant). Send the body as `application/x-www-form-urlencoded` with `grant_type=client_credentials`. - [List computers](https://developer-staging.secfix.com/api-reference/computers/list-computers.md): Returns the computers in your workspace. `isMonitored` tells you whether the Secfix agent reports each one. To get one employee's computers, pass `ownerId`. Requires the `all:read` scope. - [Get a computer](https://developer-staging.secfix.com/api-reference/computers/get-a-computer.md): Requires the `all:read` scope. - [List employees](https://developer-staging.secfix.com/api-reference/employees/list-employees.md): Returns the people in your workspace who are included in compliance. Only active employees are returned unless you set `status`. Service accounts are never returned. Filters combine with AND. To pass several values to one filter, separate them with commas: `group=Engineering,Sales`. Names and email… - [Get an employee](https://developer-staging.secfix.com/api-reference/employees/get-an-employee.md): Returns active and terminated employees. An unknown `id`, an `id` from another workspace and a service account all return 404. Requires the `all:read` scope. - [List groups](https://developer-staging.secfix.com/api-reference/groups/list-groups.md): Returns the employee groups in your workspace, oldest first. Requires the `all:read` scope. - [Get a group](https://developer-staging.secfix.com/api-reference/groups/get-a-group.md): Returns one group with its settings: trainings, device monitoring and policy acceptance. Requires the `all:read` scope. - [Check API health](https://developer-staging.secfix.com/api-reference/health/check-api-health.md): Returns the service status and the API version. Doesn't need an access token. - [List assets](https://developer-staging.secfix.com/api-reference/inventory/list-assets.md): Returns assets from every inventory category. Assets hidden in the Secfix app and deleted assets aren't returned. Filters combine with AND. Requires the `all:read` scope. - [Create or update an asset](https://developer-staging.secfix.com/api-reference/inventory/create-or-update-an-asset.md): Creates a `CUSTOM` or `INFORMATION` asset. It appears in Secfix like an asset added in the app. Set the owner with `ownerId` or `ownerEmail`. - [Create assets in a batch](https://developer-staging.secfix.com/api-reference/inventory/create-assets-in-a-batch.md): Creates up to 100 `CUSTOM` or `INFORMATION` assets in one request. Each record is validated and saved on its own, so one invalid record doesn't stop the others. The response is 200 with one result per record, in request order. - [Delete assets in a batch](https://developer-staging.secfix.com/api-reference/inventory/delete-assets-in-a-batch.md): Deletes up to 100 `CUSTOM` or `INFORMATION` assets in one request. Each record is processed on its own. An unknown or already deleted `id` fails with `not_found` in its result. Each `id` can appear only once. A batch counts as one write request for rate limiting. Requires the `all:write` scope. - [Update assets in a batch](https://developer-staging.secfix.com/api-reference/inventory/update-assets-in-a-batch.md): Updates up to 100 `CUSTOM` or `INFORMATION` assets in one request, each with its own values. Each record is saved on its own, so one invalid record doesn't stop the others. The response is 200 with one result per record, in request order. An unknown `id` fails with `not_found`. Any other asset (a co… - [Get an asset](https://developer-staging.secfix.com/api-reference/inventory/get-an-asset.md): Requires the `all:read` scope. - [Delete an asset](https://developer-staging.secfix.com/api-reference/inventory/delete-an-asset.md): Deletes a `CUSTOM` or `INFORMATION` asset. Deleting an asset that's already deleted returns 404. Requires the `all:write` scope. - [Update an asset](https://developer-staging.secfix.com/api-reference/inventory/update-an-asset.md): Updates a `CUSTOM` or `INFORMATION` asset: `name`, `customIdentifier`, owner, `description`, `classification`, `dataStored` and `tags`. Only the fields you send change. Other assets (computers, cloud resources and employees) are read-only through the API and return 403 `resource_not_writable`. Requi… - [List asset categories](https://developer-staging.secfix.com/api-reference/inventory/list-asset-categories.md): Returns the inventory categories and their keys. Requires the `all:read` scope. - [Changelog](https://developer-staging.secfix.com/changelog.md): New features and changes in the Secfix Public API. ## OpenAPI Specs - [openapi](/api-reference/openapi.yaml) ## Optional - [Support](mailto:support@secfix.com) - [Secfix.com](https://secfix.com) This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.