> ## Documentation Index
> Fetch the complete documentation index at: https://developer-staging.secfix.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Quickstart

> Get an access token and make your first Secfix API call.

This guide gets an access token and lists the assets in your workspace. You need a Secfix workspace
and permission to manage API keys in it.

**1. Create an API key**

In the Secfix app, go to **Settings → API** and create an API key. Give it a name and **Read**
access (`all:read`).

You get a **`client_id`** and a **`client_secret`**. The secret is shown **once**, so copy it
somewhere safe. See [Managing API keys](https://developer-staging.secfix.com/guides/managing-api-keys.md).

**2. Get an access token**

Call the token endpoint with the OAuth 2.0 `client_credentials` grant:

```bash theme={null}
curl -X POST https://api.secfix.com/oauth/token \
  -H "Content-Type: application/x-www-form-urlencoded" \
  -d "grant_type=client_credentials" \
  -d "client_id=YOUR_CLIENT_ID" \
  -d "client_secret=YOUR_CLIENT_SECRET"
```

```json Response theme={null}
{
  "access_token": "eyJhbGciOi...",
  "token_type": "Bearer",
  "expires_in": 86400
}
```

Reuse the token until it expires. `expires_in` is its lifetime in seconds. Requesting a new token
for every call uses up your [rate limit](https://developer-staging.secfix.com/rate-limits.md). See [Authentication](https://developer-staging.secfix.com/authentication.md).

**3. List your assets**

Send the token in the `Authorization` header:

```bash theme={null}
curl "https://api.secfix.com/v1/inventory/assets?pageSize=25" \
  -H "Authorization: Bearer eyJhbGciOi..."
```

```json Response theme={null}
{
  "results": [
    {
      "id": "3f1c9a2e-8b4d-4e7a-9c1f-2a5b6c7d8e9f",
      "name": "prod-db-01",
      "categoryKey": "CLOUD",
      "classification": "CONFIDENTIAL",
      "ownerStatus": "COMPLETE",
      "auditStatus": "COMPLETE"
    }
  ],
  "pageInfo": {
    "hasNextPage": true,
    "hasPreviousPage": false,
    "startCursor": "AgEAAAX0bYb1Q0AAJDNmMWM5YTJl..",
    "endCursor": "AgAAAAX0bYb1Q0AAJDNmMWM5YTJl..",
    "pageCount": 25,
    "totalCount": 132
  }
}
```

**4. Get the next page**

While `pageInfo.hasNextPage` is `true`, send `pageInfo.endCursor` as `pageCursor`:

```bash theme={null}
curl "https://api.secfix.com/v1/inventory/assets?pageSize=25&pageCursor=AgAA..." \
  -H "Authorization: Bearer eyJhbGciOi..."
```

See [Pagination](https://developer-staging.secfix.com/pagination.md).

## Next steps

> [card] [Authentication](https://developer-staging.secfix.com/authentication.md)
>
> Token reuse and the one-active-token rule.

> [card] [Scopes](https://developer-staging.secfix.com/scopes.md)
>
> The access each endpoint requires.

> [card] [Work with inventory](https://developer-staging.secfix.com/guides/inventory.md)
>
> Filter, create, update, and delete assets.

> [card] [API reference](https://developer-staging.secfix.com/api-reference/overview.md)
>
> Try every endpoint from your browser.


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.