# Creating and Managing a Service Account in the Wiz Console for Vulnerabilities

## 1. Introduction

The Wiz Vulnerability Provider uses OAuth 2.0 client credentials for authentication, and requires a Client ID and Client Secret generated from a Wiz service account, along with your tenant's API Endpoint URL.

## 2. Prerequisites

Before you begin, ensure you have:

- Access to the Wiz console
- A Wiz user with Write (W) permission on service accounts. Project-scoped roles can create service accounts only on their own projects.
- The API Endpoint URL for your Wiz tenant


We recommend creating a dedicated service account for use with this integration.

## 3. Creating a Service Account

### Step 1: Access the Wiz Console

- Log in to your Wiz console as a user with Write (W) permission on service accounts.


### Step 2: Add a Service Account

1. Go to **Settings > Access Management > Service Accounts**, then select **Add Service Account**.
2. Enter a meaningful **Name** for the account.
3. Set **Type** to **Custom Integration (GraphQL API)**.
4. (Optional) Limit access to specific projects by choosing up to 50 projects from the drop-down list. If you are not sure which projects to choose, leave this empty.
5. (Optional) Set an **Expiration date** for the service account. We recommend leaving this empty.
6. Set the **API Scopes** to the scopes listed in [Required Scopes](#required-scopes) below.
7. Select **Add Service Account**. The secret credentials dialog shows the newly created **Client ID** and **Client Secret**.
8. Copy the **Client ID** and **Client Secret** to a secure place, such as a password management tool.
9. Select **Finish**.


### Required Scopes

Grant **all** scopes below. Wiz checks scopes on every API call — missing a scope means that operation is rejected as **not authorized** (typically HTTP `403`).

| Scope | Required for | Without this scope |
|  --- | --- | --- |
| `read:vulnerabilities` | Querying vulnerability findings | Cannot query vulnerabilities; returns not authorized. |


## 4. Determining Your API Endpoint URL

The Wiz GraphQL API uses a single endpoint:

`https://api.<TENANT_DATA_CENTER>.<ENVIRONMENT>/graphql`

- **`<TENANT_DATA_CENTER>`** is your Wiz regional data center (for example `us1`, `us2`, `eu1`, or `eu2`).
- **`<ENVIRONMENT>`** is one of `app.wiz.io`, `app.wiz.us`, or `gov.wiz.io`, depending on your deployment:


| Environment Type | Environment Value | Example |
|  --- | --- | --- |
| Commercial (Standard) | `app.wiz.io` | `https://api.us17.app.wiz.io/graphql` |
| Gov (FedRAMP) | `app.wiz.us` | `https://api.us17.app.wiz.us/graphql` |
| Commercial AWS GovCloud | `gov.wiz.io` | `https://api.us17.gov.wiz.io/graphql` |


`https://api.us17.app.wiz.io/graphql` is a sample endpoint for demonstration. In production, use your tenant's data center and environment.

To find your tenant data center:

1. In the Wiz portal, select the **user icon** (top right), then **Tenant Info**.
2. On the left, select **Data Center and Regions**.
3. Copy the **Tenant Data Center** value and combine it with your environment using the format above.


Enter that full GraphQL URL as the integration's **API Endpoint URL**. You do not set data center or environment as separate fields. Synqly infers the OAuth token endpoint from the environment domain in the URL (`app.wiz.io`, `app.wiz.us`, or `gov.wiz.io`).

## 5. Configure the Integration

Create your integration by supplying the following configuration values.

| Integration Parameter | Description |
|  --- | --- |
| API Endpoint URL | The GraphQL API endpoint for your Wiz tenant, in the form `https://api.<TENANT_DATA_CENTER>.<ENVIRONMENT>/graphql`. Example: `https://api.us17.app.wiz.io/graphql`. |
| Client ID | The Client ID shown when the service account was created in Step 2. |
| Client Secret | The Client Secret shown when the service account was created in Step 2. |