Wiz integration

Connect DXDT to Wiz using a read-only Service Account (OAuth2 client credentials) so DXDT can query open security issues, vulnerability findings, and projects to feed the Pulse security pillar.

Setup time	~15 minutes
Difficulty	Moderate

Access required: Wiz tenant admin access to create a Service Account under Settings, scoped to read-only permissions.

Prerequisites

• A Wiz tenant.
• Permission to create a Service Account (Settings → Service Accounts / Access Management).
• Your Wiz API (GraphQL) endpoint and OAuth token endpoint from the Wiz API docs.

Setup

1. Create a Wiz Service Account

In Wiz → Settings → Service Accounts (Access Management), create a new service account for DXDT and assign it read-only scopes only (for example read:issues, read:vulnerabilities, read:projects). Do not grant admin or write scopes.

Note

Choose the API-integration / custom-scope service account type so you can restrict it to read-only scopes.

2. Copy the client credentials

On creation, Wiz shows the Client ID and Client Secret. Copy both immediately — the secret is shown only once.

• Client ID → client_id
• Client Secret → client_secret

3. Find your API and auth endpoints

From the Wiz tenant's API docs / API Explorer, copy your tenant-specific GraphQL API endpoint (api_endpoint, for example https://api.<region>.app.wiz.io/graphql) and the Wiz auth endpoint used for the OAuth2 token exchange (auth_url, for example https://auth.app.wiz.io/oauth/token).

4. Enter the configuration in DXDT

Open the wiz plugin and fill Client ID (client_id), Client Secret (client_secret), API Endpoint (api_endpoint), and Auth URL (auth_url). On save, DXDT exchanges the credentials for a short-lived bearer token at auth_url and checks the GraphQL endpoint is reachable.

Configuration fields

Field	Where to find it
Client ID (client_id)	Wiz Settings → Service Accounts → the created service account's Client ID.
Client Secret (client_secret)	Wiz service account → Client Secret (shown once at creation).
API Endpoint (api_endpoint)	Wiz tenant API docs → your GraphQL API endpoint (https://api.<region>.app.wiz.io/graphql).
Auth URL (auth_url)	Wiz API docs → the OAuth2 token endpoint used for the client-credentials exchange (for example https://auth.app.wiz.io/oauth/token).

Verify the connection

After saving, open the plugin Status view (or run the ping command). A healthy connection exchanges the credentials for a token and confirms the GraphQL endpoint is reachable; list issues returns without an auth error.

Security

DXDT makes only read-only Wiz GraphQL queries and exchanges credentials for short-lived bearer tokens on a stateless service. Grant the Service Account least-privilege read-only scopes only — never admin/write. The client_secret is stored encrypted; rotate it per your policy.

Troubleshooting

ping fails / token exchange error

Wrong client_id/client_secret, or the auth_url token endpoint is incorrect. Re-copy the service account credentials and confirm auth_url matches your Wiz tenant's OAuth2 token endpoint.

Token succeeds but GraphQL calls return 401/403

The service account lacks read scopes. Add read-only scopes (read:issues, read:vulnerabilities, read:projects) to the Wiz service account.

api_endpoint unreachable or 404

Wrong or region-mismatched GraphQL endpoint. Copy the exact GraphQL api_endpoint for your tenant/region from the Wiz API docs.

Some list commands return GraphQL field errors

The Wiz GraphQL schema varies slightly by tenant/version. DXDT surfaces the GraphQL error verbatim; confirm the scopes cover the requested objects — field selections may need per-tenant tuning.

---

Vendor documentation: https://docs.wiz.io/wiz-docs/docs/service-accounts