---
url: https://docs.realmsec.info/integration/wiz-api.md
---

# Wiz Audit Logs Integration Guide

This guide walks you through connecting your Wiz tenant to Realm so we can pull audit logs, issues, findings, and vulnerabilities on a regular schedule. It covers the credentials Wiz requires, how to fill out the Wiz API input feed configuration, and what each field does.

## Overview

The Wiz integration authenticates using OAuth 2.0 client credentials and queries the Wiz GraphQL API on your behalf. Once configured, Realm will periodically poll the Wiz APIs you select and ingest the results.

## Prerequisites

You'll need access to your Wiz portal, with a user role capable of creating service accounts (e.g., Global Admin). That's it — the steps below walk you through generating everything else you need directly from the portal.

### Step 1: Create a service account and get your Client ID / Client Secret

A Wiz service account is what Realm uses to authenticate to your tenant.

1. Log in to your Wiz portal.
2. Click the user icon (top right) and go to your organization's **Settings**.
3. Navigate to the **Service Accounts** section.
4. Click **Add Service Account** (or equivalent create action).
5. Give the service account a name (e.g., `realm-integration`) and select **Custom Integration** (or the API/GraphQL type option) as the account type.
6. Assign read scopes for each Wiz API you plan to send to Realm — for example, `read:issues`, `read:vulnerabilities`, and/or `read:audit_logs`. As a best practice, only grant scopes for the APIs you intend to enable.
7. Save the service account. Wiz will display a **Client ID** and **Client Secret** — copy both immediately, as the secret is typically shown only once.

> **Note:** Service account credentials are specific to the tenant they were created in and cannot be reused across different Wiz tenants.

### Step 2: Find your Tenant Data Center and build your API endpoint

1. In the Wiz portal, click the user icon (top right) and select **Tenant Info**.
2. On the left side, click **Data Center and Regions**.
3. Copy the value shown under **Tenant Data Center** (e.g., `us1`, `us2`, `eu1`, `eu2`).
4. Use that value to build your API endpoint URL in the form:

   ```
   https://api.<TENANT_DATA_CENTER>.<ENVIRONMENT>/graphql
   ```

   where `<ENVIRONMENT>` depends on which Wiz product you use:

   | Environment Type | Environment Value | Example Endpoint |
   |---|---|---|
   | Commercial (Standard) | `app.wiz.io` | `https://api.us17.app.wiz.io/graphql` |
   | Gov (FedRAMP) | `app.wiz.us` | `https://api.us17.app.wiz.us/graphql` |
   | Commercial AWS GovCloud | `gov.wiz.io` | `https://api.us17.gov.wiz.io/graphql` |

   This is the value you'll enter in the **Endpoint** field of the feed configuration.

### Step 3: Confirm your auth token URL

Your OAuth token URL depends on which Wiz environment your tenant runs on (this matches the environment you identified in Step 2):

| Wiz Environment | Token URL |
|---|---|
| Wiz Commercial | `https://auth.app.wiz.io/oauth/token` |
| Wiz for Gov (FedRAMP) | `https://auth.app.wiz.us/oauth/token` |
| Wiz Commercial on AWS GovCloud | `https://auth.gov.wiz.io/oauth/token` |

You won't need to enter this URL directly in the feed — Realm handles token requests automatically once your Client ID and Client Secret are configured — but it's useful to know for troubleshooting.

At this point you should have: a **Client ID**, a **Client Secret**, and an **Endpoint URL**. You're ready to configure the feed below.

## Configuring the Wiz API feed in Realm

When you set up the Wiz API feed, you'll be asked to provide the following fields.

| Field | Display Name | Required | Description |
|---|---|---|---|
| `client id` | Client ID | Yes | Your Wiz OAuth client id |
| `client secret` | Client Secret | Yes | Your Wiz OAuth client secret |
| `endpoint` | Endpoint | Yes | Your tenant's Wiz GraphQL API endpoint URL (see Step 2 in [Prerequisites](#prerequisites)). |
| `apis` | Wiz APIs | Yes | One to five Wiz data sources to pull from (see [Supported APIs](#supported-apis)). Each entry must be unique. |

### Supported APIs

Select one or more of the following for the **Wiz APIs** field (up to 5):

| API | Description |
|---|---|
| Audit Logs | User and system activity events from your Wiz tenant. |
| Risk Issues | Detected risk issues, including severity, status, and affected resources. |
| Posture Issues | Security posture findings across your cloud environment. |
| Cloud Configuration Findings | Misconfigurations identified in your cloud resources. |
| Vulnerabilities | Vulnerability findings, including CVEs and affected assets. |

At least one API must be selected.

## Troubleshooting

* **Authentication errors:** Confirm your Client ID and Client Secret are correct and belong to a service account provisioned for the correct tenant. Credentials from one Wiz tenant will not work against another.
* **Missing data for an API:** Verify the service account has been granted the read scope for that specific API (e.g., `read:vulnerabilities` for the Vulnerabilities feed).
* **Wrong region errors:** Double check your `endpoint` value matches your tenant's actual Tenant Data Center — copy it directly from Wiz's **Tenant Info → Data Center and Regions** page rather than assuming a region.