Creating and Managing a Service Account in the Wiz Console for Vulnerabilities

1. Introduction

The Wiz Vulnerability Provider uses OAuth 2.0 client credentials for authentication, and requires a Client ID and Client Secret generated from a Wiz service account, along with your tenant's API Endpoint URL.

2. Prerequisites

Before you begin, ensure you have:

Access to the Wiz console
A Wiz user with Write (W) permission on service accounts. Project-scoped roles can create service accounts only on their own projects.
The API Endpoint URL for your Wiz tenant

We recommend creating a dedicated service account for use with this integration.

3. Creating a Service Account

Step 1: Access the Wiz Console

Step 2: Add a Service Account

Go to Settings > Access Management > Service Accounts, then select Add Service Account.
Enter a meaningful Name for the account.
Set Type to Custom Integration (GraphQL API).
(Optional) Limit access to specific projects by choosing up to 50 projects from the drop-down list. If you are not sure which projects to choose, leave this empty.
(Optional) Set an Expiration date for the service account. We recommend leaving this empty.
Set the API Scopes to the scopes listed in Required Scopes below.
Select Add Service Account. The secret credentials dialog shows the newly created Client ID and Client Secret.
Copy the Client ID and Client Secret to a secure place, such as a password management tool.
Select Finish.

Required Scopes

Grant all scopes below. Wiz checks scopes on every API call — missing a scope means that operation is rejected as not authorized (typically HTTP 403).

Scope	Required for	Without this scope
`read:vulnerabilities`	Querying vulnerability findings	Cannot query vulnerabilities; returns not authorized.

4. Determining Your API Endpoint URL

The Wiz GraphQL API uses a single endpoint:

https://api.<TENANT_DATA_CENTER>.<ENVIRONMENT>/graphql

<TENANT_DATA_CENTER> is your Wiz regional data center (for example us1, us2, eu1, or eu2).
<ENVIRONMENT> is one of app.wiz.io, app.wiz.us, or gov.wiz.io, depending on your deployment:

Environment Type	Environment Value	Example
Commercial (Standard)	`app.wiz.io`	`https://api.us17.app.wiz.io/graphql`
Gov (FedRAMP)	`app.wiz.us`	`https://api.us17.app.wiz.us/graphql`
Commercial AWS GovCloud	`gov.wiz.io`	`https://api.us17.gov.wiz.io/graphql`

https://api.us17.app.wiz.io/graphql is a sample endpoint for demonstration. In production, use your tenant's data center and environment.

To find your tenant data center:

In the Wiz portal, select the user icon (top right), then Tenant Info.
On the left, select Data Center and Regions.
Copy the Tenant Data Center value and combine it with your environment using the format above.

Enter that full GraphQL URL as the integration's API Endpoint URL. You do not set data center or environment as separate fields. Synqly infers the OAuth token endpoint from the environment domain in the URL (app.wiz.io, app.wiz.us, or gov.wiz.io).

5. Configure the Integration

Create your integration by supplying the following configuration values.

Integration Parameter	Description
API Endpoint URL	The GraphQL API endpoint for your Wiz tenant, in the form `https://api.<TENANT_DATA_CENTER>.<ENVIRONMENT>/graphql`. Example: `https://api.us17.app.wiz.io/graphql`.
Client ID	The Client ID shown when the service account was created in Step 2.
Client Secret	The Client Secret shown when the service account was created in Step 2.