# Creating and Managing a Service Account in the Wiz Console for Cloud Security (Beta)

The Wiz Cloud Security Connector is currently in development and will be expanded with additional capabilities in the future.

## 1. Introduction

The Wiz Cloud Security Provider uses OAuth 2.0 client credentials for authentication, and requires a Client ID and Client Secret generated from a Wiz service account, along with your tenant's API Endpoint URL.

## 2. Prerequisites

Before you begin, ensure you have:

- Access to the Wiz console
- A Wiz user with Write (W) permission on service accounts. Project-scoped roles can create service accounts only on their own projects.
- The API Endpoint URL for your Wiz tenant


We recommend creating a dedicated service account for use with this integration.

## 3. Creating a Service Account

### Step 1: Access the Wiz Console

- Log in to your Wiz console as a user with Write (W) permission on service accounts.


### Step 2: Add a Service Account

1. Go to **Settings > Access Management > Service Accounts**, then select **Add Service Account**.
2. Enter a meaningful **Name** for the account.
3. Set **Type** to **Custom Integration (GraphQL API)**.
4. (Optional) Limit access to specific projects by choosing up to 50 projects from the drop-down list. If you are not sure which projects to choose, leave this empty.
5. (Optional) Set an **Expiration date** for the service account. We recommend leaving this empty.
6. Set the **API Scopes** to the scopes listed in [Required Scopes](#required-scopes) below.
7. Select **Add Service Account**. The secret credentials dialog shows the newly created **Client ID** and **Client Secret**.
8. Copy the **Client ID** and **Client Secret** to a secure place, such as a password management tool.
9. Select **Finish**.


### Required Scopes

Grant **all** scopes below. Wiz checks scopes on every API call — missing a scope means that operation is rejected as **not authorized** (typically HTTP `403`).

| Scope | Required for | Without this scope |
|  --- | --- | --- |
| `read:cloud_configuration` | Querying cloud compliance findings | Cannot query compliance findings; returns not authorized. |


TODO: confirm before publishing
The scopes required for cloud resource inventory and threats are not yet confirmed against Wiz documentation. Add them to the table above, with their failure modes, before this guide ships.

## 4. Determining Your API Endpoint URL

The Wiz GraphQL API uses a single endpoint:

`https://api.<TENANT_DATA_CENTER>.<ENVIRONMENT>/graphql`

- **`<TENANT_DATA_CENTER>`** is your Wiz regional data center (for example `us1`, `us2`, `eu1`, or `eu2`).
- **`<ENVIRONMENT>`** is one of `app.wiz.io`, `app.wiz.us`, or `gov.wiz.io`, depending on your deployment:


| Environment Type | Environment Value | Example |
|  --- | --- | --- |
| Commercial (Standard) | `app.wiz.io` | `https://api.us17.app.wiz.io/graphql` |
| Gov (FedRAMP) | `app.wiz.us` | `https://api.us17.app.wiz.us/graphql` |
| Commercial AWS GovCloud | `gov.wiz.io` | `https://api.us17.gov.wiz.io/graphql` |


`https://api.us17.app.wiz.io/graphql` is a sample endpoint for demonstration. In production, use your tenant's data center and environment.

To find your tenant data center:

1. In the Wiz portal, select the **user icon** (top right), then **Tenant Info**.
2. On the left, select **Data Center and Regions**.
3. Copy the **Tenant Data Center** value and combine it with your environment using the format above.


Enter that full GraphQL URL as the integration's **API Endpoint URL**. You do not set data center or environment as separate fields. Synqly infers the OAuth token endpoint from the environment domain in the URL (`app.wiz.io`, `app.wiz.us`, or `gov.wiz.io`).

## 5. Configure the Integration

Create your integration by supplying the following configuration values.

| Integration Parameter | Description |
|  --- | --- |
| API Endpoint URL | The GraphQL API endpoint for your Wiz tenant, in the form `https://api.<TENANT_DATA_CENTER>.<ENVIRONMENT>/graphql`. Example: `https://api.us17.app.wiz.io/graphql`. |
| Client ID | The Client ID shown when the service account was created in Step 2. |
| Client Secret | The Client Secret shown when the service account was created in Step 2. |