Wiz API Integration Guide

This guide walks you through connecting your Wiz tenant to Realm so we can pull audit logs, issues, findings, and vulnerabilities on a regular schedule. It covers the credentials Wiz requires, how to fill out the Wiz API input feed configuration, and what each field does.

Overview

The Wiz integration authenticates using OAuth 2.0 client credentials and queries the Wiz GraphQL API on your behalf. Once configured, Realm will periodically poll the Wiz APIs you select and ingest the results.

Prerequisites

You'll need access to your Wiz portal, with a user role capable of creating service accounts (e.g., Global Admin). That's it — the steps below walk you through generating everything else you need directly from the portal.

Step 1: Create a service account and get your Client ID / Client Secret

A Wiz service account is what Realm uses to authenticate to your tenant.

1. Log in to your Wiz portal.
2. Click the user icon (top right) and go to your organization's Settings.
3. Navigate to the Service Accounts section.
4. Click Add Service Account (or equivalent create action).
5. Give the service account a name (e.g., realm-integration) and select Custom Integration (or the API/GraphQL type option) as the account type.
6. Assign read scopes for each Wiz API you plan to send to Realm — for example, read:issues, read:vulnerabilities, and/or read:audit_logs. As a best practice, only grant scopes for the APIs you intend to enable.
7. Save the service account. Wiz will display a Client ID and Client Secret — copy both immediately, as the secret is typically shown only once.

Note: Service account credentials are specific to the tenant they were created in and cannot be reused across different Wiz tenants.

Step 2: Find your Tenant Data Center and build your API endpoint

1. In the Wiz portal, click the user icon (top right) and select Tenant Info.

2. On the left side, click Data Center and Regions.

3. Copy the value shown under Tenant Data Center (e.g., us1, us2, eu1, eu2).

4. Use that value to build your API endpoint URL in the form:

   https://api.<TENANT_DATA_CENTER>.<ENVIRONMENT>/graphql

   where <ENVIRONMENT> depends on which Wiz product you use:

   Environment Type	Environment Value	Example Endpoint
   Commercial (Standard)	app.wiz.io	https://api.us17.app.wiz.io/graphql
   Gov (FedRAMP)	app.wiz.us	https://api.us17.app.wiz.us/graphql
   Commercial AWS GovCloud	gov.wiz.io	https://api.us17.gov.wiz.io/graphql

   This is the value you'll enter in the Endpoint field of the feed configuration.

Step 3: Confirm your auth token URL

Your OAuth token URL depends on which Wiz environment your tenant runs on (this matches the environment you identified in Step 2):

Wiz Environment	Token URL
Wiz Commercial	https://auth.app.wiz.io/oauth/token
Wiz for Gov (FedRAMP)	https://auth.app.wiz.us/oauth/token
Wiz Commercial on AWS GovCloud	https://auth.gov.wiz.io/oauth/token

You won't need to enter this URL directly in the feed — Realm handles token requests automatically once your Client ID and Client Secret are configured — but it's useful to know for troubleshooting.

At this point you should have: a Client ID, a Client Secret, and an Endpoint URL. You're ready to configure the feed below.

Configuring the Wiz API feed in Realm

When you set up the Wiz API feed, you'll be asked to provide the following fields.

Field	Display Name	Required	Description
auth	Auth	Yes	Your Wiz OAuth client credentials (Client ID and Client Secret) obtained from your Wiz service account. Realm uses these to request a new bearer token automatically — you don't need to generate or rotate tokens manually.
endpoint	Endpoint	Yes	Your tenant's Wiz GraphQL API endpoint URL (see Step 2 in Prerequisites).
apis	Wiz APIs	Yes	One to five Wiz data sources to pull from (see Supported APIs). Each entry must be unique.

Supported APIs

Select one or more of the following for the Wiz APIs field (up to 5):

API	Description
Audit Logs	User and system activity events from your Wiz tenant.
Risk Issues	Detected risk issues, including severity, status, and affected resources.
Posture Issues	Security posture findings across your cloud environment.
Cloud Configuration Findings	Misconfigurations identified in your cloud resources.
Vulnerabilities	Vulnerability findings, including CVEs and affected assets.

At least one API must be selected.

Troubleshooting

• Authentication errors: Confirm your Client ID and Client Secret are correct and belong to a service account provisioned for the correct tenant. Credentials from one Wiz tenant will not work against another.
• Missing data for an API: Verify the service account has been granted the read scope for that specific API (e.g., read:vulnerabilities for the Vulnerabilities feed).
• Wrong region errors: Double check your endpoint value matches your tenant's actual Tenant Data Center — copy it directly from Wiz's Tenant Info → Data Center and Regions page rather than assuming a region.