--- title: Wiz slug: connectors/wiz docTags: createdAt: 2026-06-09T16:30:30.778Z --- Wiz is a cloud security platform that provides unified visibility, vulnerability management, and risk assessment for cloud infrastructure and workloads. Wiz is a leading cloud security platform that provides comprehensive visibility, risk assessment, and compliance monitoring across multi-cloud environments. This connector enables Swimlane Turbine users to automate the retrieval, analysis, and management of cloud resources, vulnerabilities, configuration findings, audit logs, reports, and user data from Wiz. By integrating Wiz with Swimlane Turbine, security teams can orchestrate rapid incident response, streamline compliance workflows, and enrich security operations with actionable cloud insights—all without writing code. This integration empowers organizations to proactively detect, investigate, and remediate cloud security risks at scale. ## Notes As of version 1.6.0, all report-related actions have been removed from the Wiz connector to align with Wiz API best practices. [Wiz API Documentation](https://integrate.wiz.io/reference/prerequisites) ## Prerequisites Before you can use the Wiz connector, ensure you have the following prerequisites in place: - OAuth 2.0 Client Credentials authentication configured with these parameters: - API Endpoint URL: The base URL of your Wiz API instance. - Client ID: The unique identifier for your Wiz application or integration. - Client Secret: The secret key associated with your Wiz client ID for secure authentication. - Authentication URL: The endpoint used to obtain OAuth 2.0 tokens from Wiz. - Audience: The intended recipient (audience) value for the issued token, typically representing the Wiz API. ## Capabilities This connector provides the following capabilities: - Get Cloud Resources V2 - Get Configuration Findings - Get Issues - Update Issue - Get Report Status and URL - Get List of Report Names - Get Users - Get Vulnerability Findings - Pull Audit Logs - Rerun Report - Execute GraphQL Query ### Execute GraphQL Query The `Execute GraphQL Query` action is a generic passthrough to the Wiz GraphQL endpoint (`POST https://.wiz.io/graphql`). Provide a `query` (and optional `variables` / `operationName`) in `json_body` and the connector forwards the payload as-is, returning the raw GraphQL response. Use this action for any Wiz GraphQL operation that does not have a dedicated action in this connector — for example, retrieving Threat Detection findings with `process` and `triggeringEvent` details: ```graphql query GetThreatFindings($filter: ThreatFindingFilters) { threatFindings(filterBy: $filter) { nodes { id name severity process { commandLine name arguments parentProcess { commandLine name } } triggeringEvent { commandLine processName processArgs } } } } ``` :::BlockQuote Note: Unlike the dedicated actions, `Execute GraphQL Query` does NOT auto-inject the asset-level `first` argument or strip empty `after` values. Include all pagination arguments explicitly in `variables`. ::: ## Asset Setup ### API Endpoint URL The Wiz Integration API has a single URL for all the actions. `https://api..app.wiz.io/graphql` You can use the above URL, and replace it with the region where your tenant resides, e.g. **us1**, **us2**, **eu1**, or **eu2**. Example: `https://api.us17.app.wiz.io/graphql` ### Client Credentials The Client ID and Client Secret must be provided by your Wiz customer or Wiz customer service team. ### Token URL There are two possible Token URLs depending on your service account's identity provider: | IdP | Endpoint | Endpoint for gov tenants | | -------------- | -------------------------------------------------------------------------- | ---------------------------------------------------------------------------- | | Amazon Cognito | [https://auth.app.wiz.io/oauth/token](https://auth.app.wiz.io/oauth/token) | [https://auth.gov.wiz.io/oauth/token](https://auth.gov.wiz.io/oauth/token) | | Auth0 | [https://auth.wiz.io/oauth/token](https://auth.wiz.io/oauth/token) | [https://auth0.gov.wiz.io/oauth/token](https://auth0.gov.wiz.io/oauth/token) | ### Audience Choose a relevant Audience from the following: | IdP | Audience | | -------------- | ---------- | | Amazon Cognito | wiz-api | | Auth0 | beyond-api | ## Action Setup You need different permissions for each of the actions to run. Please refer to the API documentation to know more. # Configurations ## Oauth 2.0 Client Credentials Authenticates using oauth 2.0 client credentials ### Configuration Parameters | **Parameter** | **Description** | **Type** | **Required** | | -------------- | -------------------------------------------------------------------------------------------------------------------- | -------- | ------------ | | url | A URL to the target host. | string | Required | | token\_url | | string | Required | | client\_id | The client ID | string | Required | | client\_secret | The client secret. | string | Required | | audience | Permission scopes for this action. | string | Required | | first | Use as a pagination argument to refine your results. Possible values `1-5000`. Default will be 500 if not mentioned. | number | Optional | | verify\_ssl | Verify SSL certificate | boolean | Optional | | http\_proxy | A proxy to route requests through. | string | Optional | # Actions ## Execute GraphQL Query Execute a GraphQL query or mutation on the Wiz endpoint using the specified query, variables, and operation name, and receive the corresponding response data. ### Endpoint - **Method:** `POST` ### Input | **Argument Name** | **Type** | **Required** | **Description** | | ----------------- | -------- | ------------ | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ | | `query` | string | Optional | The GraphQL query or mutation document to execute. Provide the full query string. Example - `query GetThreatFindings($filter- ThreatFindingFilters) { threatFindings(filterBy- $filter) { nodes { id name severity process { commandLine name arguments parentProcess { commandLine name } } triggeringEvent { commandLine processName processArgs } } } }`. | | `variables` | object | Optional | Optional GraphQL variables passed to the query as-is. Pagination arguments such as `first` and `after` are NOT auto-injected for this action; include them explicitly when needed. | | `operationName` | string | Optional | Optional operation name to execute when the query document contains multiple named operations. | ### Input Example `{"query":"string","variables":{},"operationName":"Example Name"}` ### Output | **Parameter** | **Type** | **Description** | | ------------------- | -------- | ------------------------------------------------------------------------------------------------------- | | `status_code` | number | HTTP status code of the response | | `reason` | string | Response reason phrase | | `data` | object | The data payload returned by the GraphQL operation. The exact structure depends on the submitted query. | | `errors` | array | Optional list of GraphQL errors returned for the operation. | | `errors.message` | string | Response message | | `errors.path` | array | Error message if any | | `errors.extensions` | object | Error message if any | ### Output Example `{"status_code":200,"response_headers":{"Date":"Thu, 08 May 2026 06:07:08 GMT","Content-Type":"application/json; charset=utf-8"},"reason":"OK","json_body":{"data":{"threatFindings":{}}}}` ## Get Cloud Resources V2 Retrieve a filtered list of cloud resources from Wiz based on specified variables and query parameters. ### Endpoint - **Method:** `POST` ### Input | **Argument Name** | **Type** | **Required** | **Description** | | ----------------------------------------------------- | -------- | ------------ | ----------------------------------------------------------------------------------------------------------------------------------------------------------- | | `query` | string | Optional | The GraphQL query to execute. | | `variables` | object | Optional | Parameter for Get Cloud Resources V2 | | `variables.after` | string | Optional | Use as a pagination argument for results. Use the value returned by pageInfo.endCursor from the previous response. | | `variables.fetchTotalCount` | boolean | Optional | Whethwizer to fetch the total count of resources. | | `variables.filterBy` | object | Optional | This object defines query filters to narrow down search results and return specific cloud resources. | | `variables.filterBy.cloudPlatform` | object | Optional | Filter by cloud platform. | | `variables.filterBy.cloudPlatform.equals` | array | Optional | Parameter for Get Cloud Resources V2 | | `variables.filterBy.cloudAccountV2` | object | Optional | Filter by cloud account external ID(s) | | `variables.filterBy.cloudAccountV2.externalId` | object | Optional | Unique identifier | | `variables.filterBy.cloudAccountV2.externalId.equals` | array | Optional | Unique identifier | | `variables.filterBy.hasAdminPrivileges` | object | Optional | Filter by whether the resource has admin privileges. | | `variables.filterBy.hasAdminPrivileges.equals` | boolean | Optional | Parameter for Get Cloud Resources V2 | | `variables.filterBy.hasHighPrivileges` | object | Optional | Filter by whether the resource has high privileges. | | `variables.filterBy.hasHighPrivileges.equals` | boolean | Optional | Parameter for Get Cloud Resources V2 | | `variables.filterBy.hasSensitiveData` | object | Optional | Filter by whether the resource contains sensitive data. | | `variables.filterBy.hasSensitiveData.equals` | boolean | Optional | Response data | | `variables.filterBy.hasAccessToSensitiveData` | object | Optional | Filter by whether the resource has access to sensitive data. | | `variables.filterBy.hasAccessToSensitiveData.equals` | boolean | Optional | Response data | | `variables.filterBy.isAccessibleFromInternet` | object | Optional | Filter by whether the resource is accessible from the internet. | | `variables.filterBy.isAccessibleFromInternet.equals` | boolean | Optional | Parameter for Get Cloud Resources V2 | | `variables.filterBy.isOpenToAllInternet` | object | Optional | Filter by whether the resource is open to all internet. | | `variables.filterBy.isOpenToAllInternet.equals` | boolean | Optional | Parameter for Get Cloud Resources V2 | | `variables.filterBy.tag` | object | Optional | Filter by resource tags. | | `variables.filterBy.tag.containsAll` | array | Optional | Parameter for Get Cloud Resources V2 | | `variables.filterBy.type` | object | Optional | The cloud-managed resource object(s) to return. Entity types must be specified in ALL\_CAPS format. For example, use VIRTUAL\_MACHINE for virtual machines. | ### Input Example `{"query":"query CloudResourcesTable($first: Int, $after: String, $filterBy: CloudResourceV2Filters, $orderBy: CloudResourceOrder, $fetchTotalCount: Boolean = true) {\\n cloudResourcesV2(\\n first: $first\\n after: $after\\n filterBy: $filterBy\\n orderBy: $orderBy\\n ) {\\n totalCount: totalServiceUsageResourceCount @include(if: $fetchTotalCount)\\n pageInfo {\\n hasNextPage\\n endCursor\\n }\\n nodes {\\n id\\n name\\n externalId\\n type\\n technology {\\n id\\n name\\n }\\n cloudAccount {\\n id\\n name\\n cloudProvider\\n externalId\\n }\\n cloudPlatform\\n status\\n region\\n regionLocation\\n tags {\\n key\\n value\\n }\\n projects {\\n id\\n name\\n slug\\n isFolder\\n }\\n createdAt\\n updatedAt\\n deletedAt\\n firstSeen\\n lastSeen\\n typeFields {\\n ... on CloudResourceV2VirtualMachine {\\n instanceType\\n operatingSystem\\n }\\n ... on CloudResourceV2Database {\\n kind\\n }\\n }\\n resourceGroup {\\n id\\n name\\n }\\n isOpenToAllInternet\\n isAccessibleFromInternet\\n hasAccessToSensitiveData\\n hasAdminPrivileges\\n hasHighPrivileges\\n hasSensitiveData\\n nativeType\\n }\\n }\\n}","variables":{"after":"string","fetchTotalCount":true,"filterBy":{"cloudPlatform":{"equals":["string"]},"cloudAccountV2":{"externalId":{}},"hasAdminPrivileges":{"equals":true},"hasHighPrivileges":{"equals":true},"hasSensitiveData":{"equals":true},"hasAccessToSensitiveData":{"equals":true},"isAccessibleFromInternet":{"equals":true},"isOpenToAllInternet":{"equals":true},"tag":{"containsAll":[]},"type":{"equals":["string"]},"updatedAt":{"before":"string","after":"string"},"orderBy":{"field":"string","direction":"string"}},"orderBy":{"field":"string","direction":"string"}}}` ## Get Configuration Findings Retrieve filtered cloud configuration findings from Wiz using specified variables for targeted rules, resources, or frameworks. ### Endpoint - **Method:** `POST` ### Input | **Argument Name** | **Type** | **Required** | **Description** | | -------------------------------------------- | -------- | ------------ | ------------------------------------------------------------------------------------------------------------------------ | | `output_format` | string | Optional | JSON returns structured Wiz API data (default). CSV converts configuration findings into a readable CSV file attachment. | | `variables` | object | Optional | Parameter for Get Configuration Findings | | `variables.after` | string | Optional | Parameter for Get Configuration Findings | | `variables.orderBy` | object | Optional | Parameter for Get Configuration Findings | | `variables.orderBy.direction` | string | Optional | The order direction. Can be ASC or DESC. | | `variables.orderBy.field` | string | Optional | The order Field. | | `variables.filterBy` | object | Optional | Parameter for Get Configuration Findings | | `variables.filterBy.id` | array | Optional | Filter Configuration Findings matching these IDs. You can specify multiple values. | | `variables.filterBy.source` | array | Optional | Filter by source of the configuration. You can specify multiple values. | | `variables.filterBy.rule` | object | Optional | Parameter for Get Configuration Findings | | `variables.filterBy.rule.id` | array | Optional | Filter Configuration Findings that match these Cloud Configuration Rule IDs. You can specify multiple values. | | `variables.filterBy.rule.name` | array | Optional | Filters Configuration Findings that match the name of these Cloud Configuration Rules. You can specify multiple values. | | `variables.filterBy.rule.description` | array | Optional | Filter by these Cloud Configuration Rule descriptions. You can specify multiple values. | | `variables.filterBy.resource` | object | Optional | Parameter for Get Configuration Findings | | `variables.filterBy.resource.id` | array | Optional | Filter Configuration Findings by resource ID. You can specify multiple values. | | `variables.filterBy.resource.type` | array | Optional | Filter Configuration Findings by specific entity types. You can specify multiple values. | | `variables.filterBy.resource.projectId` | array | Optional | Filter Configuration Findings by Wiz project ID. You can specify multiple values. | | `variables.filterBy.resource.name` | array | Optional | Filter by Configuration Finding resource name. You can specify multiple values. | | `variables.filterBy.resource.status` | array | Optional | Filter by resource status. You can specify multiple values. | | `variables.filterBy.resource.subscriptionId` | array | Optional | Filter by subscription ID. You can specify multiple values. | | `variables.filterBy.resource.cloudPlatform` | array | Optional | Filter Configuration Findings by cloud platform. You can specify multiple values. | | `variables.filterBy.resource.nativeType` | array | Optional | The name of the resource provided by its cloud service provider, as opposed to how Wiz normalizes its name. | | `variables.filterBy.resource.tags` | array | Optional | Filter by tags associated with the resource. You can specify multiple values. | | `variables.filterBy.analyzedAt` | object | Optional | Parameter for Get Configuration Findings | | `variables.filterBy.analyzedAt.before` | string | Optional | Parameter for Get Configuration Findings | ### Input Example `{"output_format":"JSON"}` ### Output | **Parameter** | **Type** | **Description** | | --------------------------------------------------------------- | -------- | ----------------------------------- | | `file` | object | CSV file when Output Format is CSV. | | `file.filename` | string | Name of the resource | | `file.file_data` | string | Response data | | `status_code` | number | HTTP status code of the response | | `reason` | string | Response reason phrase | | `data` | object | Response data | | `data.configurationFindings` | object | Response data | | `data.configurationFindings.nodes` | array | Response data | | `data.configurationFindings.nodes.id` | string | Response data | | `data.configurationFindings.nodes.targetExternalId` | string | Response data | | `data.configurationFindings.nodes.targetObjectProviderUniqueId` | string | Response data | | `data.configurationFindings.nodes.firstSeenAt` | string | Response data | | `data.configurationFindings.nodes.severity` | string | Response data | | `data.configurationFindings.nodes.result` | string | Response data | | `data.configurationFindings.nodes.status` | string | Response data | | `data.configurationFindings.nodes.remediation` | object | Response data | | `data.configurationFindings.nodes.resource` | object | Response data | | `data.configurationFindings.nodes.resource.id` | string | Response data | | `data.configurationFindings.nodes.resource.providerId` | string | Response data | | `data.configurationFindings.nodes.resource.name` | string | Response data | | `data.configurationFindings.nodes.resource.nativeType` | string | Response data | | `data.configurationFindings.nodes.resource.type` | string | Response data | | `data.configurationFindings.nodes.resource.region` | string | Response data | | `data.configurationFindings.nodes.resource.subscription` | object | Response data | | `data.configurationFindings.nodes.resource.projects` | array | Response data | ### Output Example `{"status_code":200,"response_headers":{"Date":"Mon, 31 Jul 2023 09:08:42 GMT","Content-Type":"application/json; charset=utf-8","Transfer-Encoding":"chunked","Connection":"keep-alive","content-security-policy":"default-src 'self';base-uri 'self';font-src 'self' https: data:;form-action 'sel...","cross-origin-embedder-policy":"require-corp","cross-origin-opener-policy":"same-origin","cross-origin-resource-policy":"same-origin","x-dns-prefetch-control":"off","x-frame-options":"SAMEORIGIN","strict-t...` ## Get Issues Obtain a list of issues from Wiz by executing targeted queries with specified variables for accurate and filtered search results. ### Endpoint - **Method:** `POST` ### Input | **Argument Name** | **Type** | **Required** | **Description** | | --------------------------------------- | -------- | ------------ | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ | | `output_format` | string | Optional | JSON returns structured Wiz API data (default). CSV converts issues and security findings into a readable CSV file attachment. | | `variables` | object | Optional | Parameter for Get Issues | | `variables.after` | string | Optional | Use as a pagination argument to refine your results. Use the value returned by `pageInfo.endCursor` from the previous response. | | `variables.orderBy` | object | Optional | The query's results order. Can be ASC or DESC. | | `variables.orderBy.direction` | string | Optional | Parameter for Get Issues | | `variables.orderBy.field` | string | Optional | The order Field. | | `variables.filterBy` | object | Optional | Parameter for Get Issues | | `variables.filterBy.status` | array | Optional | Filter by Issue handling status. You can specify multiple values. If no values are provided, then returns results from all statuses. | | `variables.filterBy.id` | array | Optional | Filter only Issues that match these IDs. You can specify multiple values. If no values are provided, then returns results from all Issues. | | `variables.filterBy.search` | string | Optional | Free text search on Issue title or object name. Returns NULL if no match is found. | | `variables.filterBy.frameworktegory` | array | Optional | Filter Issues by security framework IDs. You can specify multiple values. If no values are provided, then returns results from all framework categories. | | `variables.filterBy.stackLayer` | array | Optional | Filter Issues from a specific stack layer (as defined by the control). You can specify multiple values. If no values are provided, then returns results from all stack layers. | | `variables.filterBy.project` | array | Optional | Filter Issues associated with these project IDs. You can specify multiple values. If no values are provided, then returns results from all projects. | | `variables.filterBy.severity` | array | Optional | Filter Issues according to Control severity. You can specify multiple values. If no values are provided, then returns results from all severities. | | `variables.filterBy.sourceSecurityScan` | string | Optional | Filter by security scan source. | | `variables.filterBy.resolutionReason` | array | Optional | Filter Issues by resolution reason. You can specify multiple values. If no values are provided, then returns results from all resolution reasons. | | `variables.filterBy.type` | array | Optional | Filter by Issue type. You can specify multiple values. If no values are provided, then returns results from all Issue types. | | `variables.filterBy.createdAt` | object | Optional | Parameter for Get Issues | | `variables.filterBy.createdAt.after` | string | Optional | DateTime in ISO 8601 format. | | `variables.filterBy.createdAt.before` | string | Optional | DateTime in ISO 8601 format. | | `variables.filterBy.resolvedAt` | object | Optional | Parameter for Get Issues | | `variables.filterBy.resolvedAt.after` | string | Optional | DateTime in ISO 8601 format. | | `variables.filterBy.resolvedAt.before` | string | Optional | DateTime in ISO 8601 format. | | `variables.filterBy.dueAt` | object | Optional | Parameter for Get Issues | | `variables.filterBy.dueAt.after` | string | Optional | DateTime in ISO 8601 format. | ### Input Example `{"output_format":"JSON"}` ### Output | **Parameter** | **Type** | **Description** | | ------------------------------------------------------- | -------- | ----------------------------------- | | `file` | object | CSV file when Output Format is CSV. | | `file.filename` | string | Name of the resource | | `file.file_data` | string | Response data | | `status_code` | number | HTTP status code of the response | | `reason` | string | Response reason phrase | | `data` | object | Response data | | `data.issues` | object | Response data | | `data.issues.nodes` | array | Response data | | `data.issues.nodes.id` | string | Response data | | `data.issues.nodes.sourceRule` | object | Response data | | `data.issues.nodes.sourceRule.__typename` | string | Response data | | `data.issues.nodes.sourceRule.id` | string | Response data | | `data.issues.nodes.sourceRule.name` | string | Response data | | `data.issues.nodes.sourceRule.controlDescription` | string | Response data | | `data.issues.nodes.sourceRule.resolutionRecommendation` | string | Response data | | `data.issues.nodes.sourceRule.securitySubCategories` | array | Response data | | `data.issues.nodes.createdAt` | string | Response data | | `data.issues.nodes.updatedAt` | string | Response data | | `data.issues.nodes.dueAt` | object | Response data | | `data.issues.nodes.resolvedAt` | object | Response data | | `data.issues.nodes.statusChangedAt` | string | Response data | | `data.issues.nodes.projects` | array | Response data | | `data.issues.nodes.projects.id` | string | Response data | | `data.issues.nodes.projects.name` | string | Response data | | `data.issues.nodes.projects.slug` | string | Response data | ### Output Example `{"status_code":200,"response_headers":{"Date":"Mon, 31 Jul 2023 06:07:08 GMT","Content-Type":"application/json; charset=utf-8","Transfer-Encoding":"chunked","Connection":"keep-alive","content-security-policy":"default-src 'self';base-uri 'self';font-src 'self' https: data:;form-action 'sel...","cross-origin-embedder-policy":"require-corp","cross-origin-opener-policy":"same-origin","cross-origin-resource-policy":"same-origin","x-dns-prefetch-control":"off","x-frame-options":"SAMEORIGIN","strict-t...` ## Get Report Status and URL Retrieve the current status and access URL for a Wiz report by providing required variables in the request body. ### Endpoint - **Method:** `POST` ### Input | **Argument Name** | **Type** | **Required** | **Description** | | -------------------- | -------- | ------------ | --------------------------------------- | | `variables` | object | Optional | Parameter for Get Report Status and URL | | `variables.reportId` | string | Required | The ID of the report to return. | ### Input Example `{"variables":{"reportId":"string"}}` ### Output | **Parameter** | **Type** | **Description** | | ---------------------------- | -------- | -------------------------------- | | `status_code` | number | HTTP status code of the response | | `reason` | string | Response reason phrase | | `data` | object | Response data | | `data.report` | object | Response data | | `data.report.lastRun` | object | Response data | | `data.report.lastRun.url` | string | Response data | | `data.report.lastRun.status` | string | Response data | ### Output Example `{"status_code":200,"response_headers":{"Date":"Sun, 30 Jul 2023 09:07:18 GMT","Content-Type":"application/json; charset=utf-8","Transfer-Encoding":"chunked","Connection":"keep-alive","content-security-policy":"default-src 'self';base-uri 'self';font-src 'self' https: data:;form-action 'sel...","cross-origin-embedder-policy":"require-corp","cross-origin-opener-policy":"same-origin","cross-origin-resource-policy":"same-origin","x-dns-prefetch-control":"off","x-frame-options":"SAMEORIGIN","strict-t...` ## Get List of Report Names Retrieve a filtered list of reports from Wiz based on specified criteria such as ID and name provided in the JSON body. ### Endpoint - **Method:** `POST` ### Input | **Argument Name** | **Type** | **Required** | **Description** | | ---------------------------------------- | -------- | ------------ | ------------------------------------------------------------------------------------------------------------------------------- | | `variables` | object | Optional | Parameter for Get List of Report Names | | `variables.first` | number | Required | Use as a pagination argument to refine your results. Possible values `1-5000`. | | `variables.after` | string | Optional | Use as a pagination argument to refine your results. Use the value returned by `pageInfo.endCursor` from the previous response. | | `variables.filterBy` | object | Optional | Parameter for Get List of Report Names | | `variables.filterBy.search` | string | Optional | Filter reports matching these names. | | `variables.filterBy.type` | array | Optional | Filter reports of specific types. You can specify multiple values. | | `variables.filterBy.projectId` | string | Optional | Filter reports associated with a specific project identified by its project ID. | | `variables.filterBy.lastReportRunStatus` | array | Optional | Filter reports with a specific last run status. You can specify multiple values. | ### Input Example `{"variables":{"first":123,"after":"string","filterBy":{"search":"string","type":["string"],"projectId":"string","lastReportRunStatus":["string"]}}}` ### Output | **Parameter** | **Type** | **Description** | | ----------------------------------- | -------- | -------------------------------- | | `status_code` | number | HTTP status code of the response | | `reason` | string | Response reason phrase | | `data` | object | Response data | | `data.reports` | object | Response data | | `data.reports.nodes` | array | Response data | | `data.reports.nodes.id` | string | Response data | | `data.reports.nodes.name` | string | Response data | | `data.reports.pageInfo` | object | Response data | | `data.reports.pageInfo.hasNextPage` | boolean | Response data | | `data.reports.pageInfo.endCursor` | string | Response data | ### Output Example `{"status_code":200,"response_headers":{"Date":"Sun, 30 Jul 2023 09:01:15 GMT","Content-Type":"application/json; charset=utf-8","Transfer-Encoding":"chunked","Connection":"keep-alive","content-security-policy":"default-src 'self';base-uri 'self';font-src 'self' https: data:;form-action 'sel...","cross-origin-embedder-policy":"require-corp","cross-origin-opener-policy":"same-origin","cross-origin-resource-policy":"same-origin","x-dns-prefetch-control":"off","x-frame-options":"SAMEORIGIN","strict-t...` ## Get Users Retrieve a filtered list of Wiz users by specifying variables such as role, authentication provider, or project assignments. ### Endpoint - **Method:** `POST` ### Input | **Argument Name** | **Type** | **Required** | **Description** | | ------------------------------------- | -------- | ------------ | ------------------------------------------------------------------------------------------------------------------------------- | | `variables` | object | Optional | Parameter for Get Users | | `variables.after` | string | Optional | Use as a pagination argument to refine your results. Use the value returned by `pageInfo.endCursor` from the previous response. | | `variables.filterBy` | object | Optional | Parameter for Get Users | | `variables.filterBy.role` | array | Optional | Filter by user role. Can be created by a user or built-in. | | `variables.filterBy.authProviderType` | array | Optional | Unique identifier | | `variables.filterBy.deleted` | boolean | Optional | Whether the user is deleted. | | `variables.filterBy.assignedProjects` | array | Optional | Filter users that are assigned (have access to) specific projects. | | `variables.filterBy.search` | string | Optional | Free text search on name, email title, or object name. | | `variables.filterBy.updatedAt` | object | Required | Parameter for Get Users | | `variables.filterBy.updatedAt.after` | string | Optional | DateTime in ISO 8601 format. | | `variables.filterBy.updatedAt.before` | string | Optional | DateTime in ISO 8601 format. | ### Input Example `{"variables":{"after":"string","filterBy":{"role":["string"],"authProviderType":["string"],"deleted":true,"assignedProjects":["string"],"search":"string","updatedAt":{"after":"string","before":"string"}}}}` ### Output | **Parameter** | **Type** | **Description** | | --------------------------------------- | -------- | -------------------------------- | | `status_code` | number | HTTP status code of the response | | `reason` | string | Response reason phrase | | `data` | object | Response data | | `data.users` | object | Response data | | `data.users.nodes` | array | Response data | | `data.users.nodes.id` | string | Response data | | `data.users.nodes.name` | string | Response data | | `data.users.nodes.email` | string | Response data | | `data.users.nodes.lastLoginAt` | string | Response data | | `data.users.nodes.isSuspended` | boolean | Response data | | `data.users.nodes.createdAt` | string | Response data | | `data.users.nodes.identityProvider` | object | Response data | | `data.users.nodes.identityProviderType` | string | Response data | | `data.users.nodes.assignedProjects` | object | Response data | | `data.users.nodes.role` | object | Response data | | `data.users.nodes.role.id` | string | Response data | | `data.users.nodes.role.name` | string | Response data | | `data.users.nodes.role.scopes` | array | Response data | | `data.users.pageInfo` | object | Response data | | `data.users.pageInfo.endCursor` | object | Response data | | `data.users.pageInfo.hasNextPage` | boolean | Response data | ### Output Example `{"status_code":200,"response_headers":{"Date":"Mon, 31 Jul 2023 06:58:20 GMT","Content-Type":"application/json; charset=utf-8","Content-Length":"488","Connection":"keep-alive","content-security-policy":"default-src 'self';base-uri 'self';font-src 'self' https: data:;form-action 'sel...","cross-origin-embedder-policy":"require-corp","cross-origin-opener-policy":"same-origin","cross-origin-resource-policy":"same-origin","x-dns-prefetch-control":"off","x-frame-options":"SAMEORIGIN","strict-transpor...` ## Get Vulnerability Findings Retrieve categorized vulnerability findings from Wiz, filtered by asset and severity based on specified variables. ### Endpoint - **Method:** `POST` ### Input | **Argument Name** | **Type** | **Required** | **Description** | | -------------------------------------------- | -------- | ------------ | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | `output_format` | string | Optional | JSON returns structured Wiz API data (default). CSV converts vulnerability findings into a readable CSV file attachment. | | `variables` | object | Optional | Parameter for Get Vulnerability Findings | | `variables.after` | string | Optional | Use as a pagination argument to refine your results. Use the value returned by `pageInfo.endCursor` from the previous response. | | `variables.orderBy` | object | Optional | The query's results order. Can be ASC or DESC. Determined by the firstDetectedAt value. | | `variables.orderBy.direction` | string | Optional | Parameter for Get Vulnerability Findings | | `variables.filterBy` | object | Optional | Parameter for Get Vulnerability Findings | | `variables.filterBy.id` | array | Optional | Filter vulnerability findings matching these IDs. You can specify multiple values. If no values are provided, then returns results from all IDs. | | `variables.filterBy.vendorSeverity` | array | Optional | Filter vulnerability findings according to the vendor severity. You can specify multiple values. If no values are provided, then returns results from all vendor severities. | | `variables.filterBy.firstSeenAt` | object | Optional | Parameter for Get Vulnerability Findings | | `variables.filterBy.firstSeenAt.after` | string | Optional | DateTime in ISO 8601 format. | | `variables.filterBy.firstSeenAt.before` | string | Optional | DateTime in ISO 8601 format. | | `variables.filterBy.updatedAt` | object | Required | Parameter for Get Vulnerability Findings | | `variables.filterBy.updatedAt.after` | string | Optional | DateTime in ISO 8601 format. | | `variables.filterBy.updatedAt.before` | string | Optional | DateTime in ISO 8601 format. | | `variables.filterBy.resolvedAt` | object | Optional | Parameter for Get Vulnerability Findings | | `variables.filterBy.resolvedAt.after` | string | Optional | DateTime in ISO 8601 format. | | `variables.filterBy.resolvedAt.before` | string | Optional | DateTime in ISO 8601 format. | | `variables.filterBy.hasFix` | boolean | Optional | Filter only vulnerability findings for vulnerabilities with an available fix. | | `variables.filterBy.hasExploit` | boolean | Optional | Filter only vulnerability findings for vulnerabilities with an available exploit. | | `variables.filterBy.hasCisaKevExploit` | boolean | Optional | Filter only vulnerability findings for vulnerabilities with an available CISA KEV exploit. | | `variables.filterBy.vulnerabilityExternalId` | array | Optional | Filter only vulnerability findings whose external ID matches these. You can specify multiple values. If no values are provided, then returns results from all external IDs. | | `variables.filterBy.subscriptionExternalId` | array | Optional | Filter vulnerability findings from these subscription external IDs. You can specify multiple values. If no values are provided, then returns results from all subscriptions. | | `variables.filterBy.assetId` | array | Optional | Filter only vulnerability findings on these asset IDs. You can specify multiple values. If no values are provided, then returns results from all asset IDs. | | `variables.filterBy.assetType` | string | Optional | The type of asset object to appear in the vulnerability report. If not specified, returns results for all asset types. | | `variables.filterBy.assetStatus` | array | Optional | Filter only vulnerability findings for assets with these statuses. You can specify multiple values. If no values are provided, then returns results for all asset statuses. | ### Input Example `{"output_format":"JSON"}` ### Output | **Parameter** | **Type** | **Description** | | ------------------------------------------------------ | -------- | ----------------------------------- | | `file` | object | CSV file when Output Format is CSV. | | `file.filename` | string | Name of the resource | | `file.file_data` | string | Response data | | `status_code` | number | HTTP status code of the response | | `reason` | string | Response reason phrase | | `data` | object | Response data | | `data.vulnerabilityFindings` | object | Response data | | `data.vulnerabilityFindings.nodes` | array | Response data | | `data.vulnerabilityFindings.nodes.id` | string | Response data | | `data.vulnerabilityFindings.nodes.portalUrl` | string | Response data | | `data.vulnerabilityFindings.nodes.name` | string | Response data | | `data.vulnerabilityFindings.nodes.CVEDescription` | string | Response data | | `data.vulnerabilityFindings.nodes.CVSSSeverity` | string | Response data | | `data.vulnerabilityFindings.nodes.score` | number | Response data | | `data.vulnerabilityFindings.nodes.exploitabilityScore` | number | Response data | | `data.vulnerabilityFindings.nodes.impactScore` | number | Response data | | `data.vulnerabilityFindings.nodes.dataSourceName` | object | Response data | | `data.vulnerabilityFindings.nodes.hasExploit` | boolean | Response data | | `data.vulnerabilityFindings.nodes.hasCisaKevExploit` | boolean | Response data | | `data.vulnerabilityFindings.nodes.status` | string | Response data | | `data.vulnerabilityFindings.nodes.vendorSeverity` | string | Response data | | `data.vulnerabilityFindings.nodes.firstDetectedAt` | string | Response data | | `data.vulnerabilityFindings.nodes.lastDetectedAt` | string | Response data | | `data.vulnerabilityFindings.nodes.resolvedAt` | object | Response data | | `data.vulnerabilityFindings.nodes.description` | string | Response data | ### Output Example `{"status_code":200,"response_headers":{"Date":"Sun, 30 Jul 2023 13:08:22 GMT","Content-Type":"application/json; charset=utf-8","Transfer-Encoding":"chunked","Connection":"keep-alive","content-security-policy":"default-src 'self';base-uri 'self';font-src 'self' https: data:;form-action 'sel...","cross-origin-embedder-policy":"require-corp","cross-origin-opener-policy":"same-origin","cross-origin-resource-policy":"same-origin","x-dns-prefetch-control":"off","x-frame-options":"SAMEORIGIN","strict-t...` ## Pull Audit Logs Retrieve a filtered set of audit log activities from Wiz based on criteria such as action, status, or user by providing variables in the JSON body. ### Endpoint - **Method:** `POST` ### Input | **Argument Name** | **Type** | **Required** | **Description** | | ------------------------------------- | -------- | ------------ | ------------------------------------------------------------------------------------------------------------------------------- | | `variables` | object | Optional | Parameter for Pull Audit Logs | | `variables.first` | number | Required | Use as a pagination argument to refine your results. Possible values `1-5000`. | | `variables.after` | string | Optional | Use as a pagination argument to refine your results. Use the value returned by `pageInfo.endCursor` from the previous response. | | `variables.filterBy` | object | Optional | Parameter for Pull Audit Logs | | `variables.filterBy.timestamp` | object | Optional | Parameter for Pull Audit Logs | | `variables.filterBy.timestamp.after` | string | Optional | DateTime in ISO 8601 format. | | `variables.filterBy.timestamp.before` | string | Optional | DateTime in ISO 8601 format. | | `variables.filterBy.action` | string | Optional | Filter by specific action name in Wiz. | | `variables.filterBy.search` | string | Optional | Filter by string matching ID or request ID. | | `variables.filterBy.status` | array | Optional | Filter by audit log event status. You can specify multiple values. | | `variables.filterBy.user` | array | Optional | Filter by specific user IDs or service account IDs. | | `variables.filterBy.userType` | array | Optional | Filter audit logs entries by the type of user. You can specify multiple values. | | `variables.filterBy.userAgent` | string | Optional | Filter by user agent. | | `variables.filterBy.sourceIP` | string | Optional | Filter audit log entries by source IP. | ### Input Example `{"variables":{"first":123,"after":"string","filterBy":{"timestamp":{"after":"string","before":"string"},"action":"string","search":"string","status":["string"],"user":["string"],"userType":["string"],"userAgent":"string","sourceIP":"string"}}}` ### Output | **Parameter** | **Type** | **Description** | | -------------------------------------------------------- | -------- | ----------------------------------------- | | `status_code` | number | HTTP status code of the response | | `reason` | string | Response reason phrase | | `data` | object | Response data | | `data.auditLogEntries` | object | Response data | | `data.auditLogEntries.nodes` | array | Response data | | `data.auditLogEntries.nodes.id` | string | Response data | | `data.auditLogEntries.nodes.action` | string | Response data | | `data.auditLogEntries.nodes.requestId` | string | Response data | | `data.auditLogEntries.nodes.status` | string | Response data | | `data.auditLogEntries.nodes.timestamp` | string | Response data | | `data.auditLogEntries.nodes.actionParameters` | object | Parameters for the Pull Audit Logs action | | `data.auditLogEntries.nodes.actionParameters.clientID` | string | Parameters for the Pull Audit Logs action | | `data.auditLogEntries.nodes.actionParameters.groups` | object | Parameters for the Pull Audit Logs action | | `data.auditLogEntries.nodes.actionParameters.name` | string | Parameters for the Pull Audit Logs action | | `data.auditLogEntries.nodes.actionParameters.products` | array | Parameters for the Pull Audit Logs action | | `data.auditLogEntries.nodes.actionParameters.role` | string | Parameters for the Pull Audit Logs action | | `data.auditLogEntries.nodes.actionParameters.scopes` | array | Parameters for the Pull Audit Logs action | | `data.auditLogEntries.nodes.actionParameters.userEmail` | string | Parameters for the Pull Audit Logs action | | `data.auditLogEntries.nodes.actionParameters.userID` | string | Parameters for the Pull Audit Logs action | | `data.auditLogEntries.nodes.actionParameters.userpoolID` | string | Parameters for the Pull Audit Logs action | | `data.auditLogEntries.nodes.userAgent` | object | Response data | | `data.auditLogEntries.nodes.sourceIP` | object | Response data | | `data.auditLogEntries.nodes.serviceAccount` | object | Response data | | `data.auditLogEntries.nodes.serviceAccount.id` | string | Response data | | `data.auditLogEntries.nodes.serviceAccount.name` | string | Response data | ### Output Example `{"status_code":200,"response_headers":{"Date":"Mon, 31 Jul 2023 06:44:55 GMT","Content-Type":"application/json; charset=utf-8","Content-Length":"922","Connection":"keep-alive","content-security-policy":"default-src 'self';base-uri 'self';font-src 'self' https: data:;form-action 'sel...","cross-origin-embedder-policy":"require-corp","cross-origin-opener-policy":"same-origin","cross-origin-resource-policy":"same-origin","x-dns-prefetch-control":"off","x-frame-options":"SAMEORIGIN","strict-transpor...` ## Rerun Report Initiate a rerun of an existing Wiz report with specified variables and receive the original report ID. ### Endpoint - **Method:** `POST` ### Input | **Argument Name** | **Type** | **Required** | **Description** | | -------------------- | -------- | ------------ | ------------------------------- | | `variables` | object | Optional | Parameter for Rerun Report | | `variables.reportId` | string | Required | The ID of the report to return. | ### Input Example `{"variables":{"reportId":"string"}}` ### Output | **Parameter** | **Type** | **Description** | | ---------------------------- | -------- | -------------------------------- | | `status_code` | number | HTTP status code of the response | | `reason` | string | Response reason phrase | | `data` | object | Response data | | `data.rerunReport` | object | Response data | | `data.rerunReport.report` | object | Response data | | `data.rerunReport.report.id` | string | Response data | ### Output Example `{"status_code":200,"response_headers":{"Date":"Sun, 30 Jul 2023 09:10:38 GMT","Content-Type":"application/json; charset=utf-8","Content-Length":"82","Connection":"keep-alive","content-security-policy":"default-src 'self';base-uri 'self';font-src 'self' https: data:;form-action 'sel...","cross-origin-embedder-policy":"require-corp","cross-origin-opener-policy":"same-origin","cross-origin-resource-policy":"same-origin","x-dns-prefetch-control":"off","x-frame-options":"SAMEORIGIN","strict-transport...` ## Update Issue Modify the status, due date, or notes of an existing issue in Wiz by providing the required variables. ### Endpoint - **Method:** `POST` ### Input | **Argument Name** | **Type** | **Required** | **Description** | | ------------------------------------- | -------- | ------------ | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | `variables` | object | Optional | Parameter for Update Issue | | `variables.issueId` | string | Required | The ID of the Wiz Issue to update. | | `variables.patch` | object | Optional | This object defines the specific Issue to update, identified by its Issue ID. | | `variables.patch.status` | string | Optional | Update the status of an Issue. Possible values depend on the type of Issue. OPEN - Issues that have not yet been addressed or remediated. IN\_PROGRESS - Issues that have been acknowledged and are being handled. The In-progress status can be manually set to indicate to colleagues that the Issue is being actively addressed. RESOLVED - Issues that have been fixed or are no longer considered an Issue by Wiz. REJECTED - Issues that have been marked to be ignored, either manually or through Ignore Rules. | | `variables.patch.resolutionReason` | string | Optional | Update the resolution reason of the Issue. Required if the updated status is set to RESOLVED or REJECTED. The possible values depend on the type of Issue and its status. | | `variables.patch.dueAt` | string | Optional | Update the estimated time to resolve the Issue. DateTime format yyyy-MM-dd'T'HH\:mm\:ss'Z' (ISO 8601 format). | | `variables.patch.note` | string | Optional | Update the note referenced on the Issue when updating the status to REJECTED. To update the note for all other situations, use the Update Issue Note API. | | `variables.patch.resolutionNote` | string | Optional | Update the resolution note of the Threat Detection Issue. resolutionNote can only be used when status is set to "RESOLVED". | | `variables.override` | object | Optional | Override fields for the Issue update. | | `variables.override.status` | string | Optional | Override the status of an Issue. | | `variables.override.resolutionReason` | string | Optional | Override the resolution reason of the Issue. | | `variables.override.dueAt` | string | Optional | Override the estimated time to resolve the Issue. DateTime format yyyy-MM-dd'T'HH\:mm\:ss'Z' (ISO 8601 format). | | `variables.override.note` | string | Optional | Override the note referenced on the Issue. | | `variables.override.resolutionNote` | string | Optional | Override the resolution note of the Threat Detection Issue. | ### Input Example `{"variables":{"issueId":"842ec39e-b907-4c32-b6e5-2c3dd9fd43c0","patch":{"status":"active","resolutionReason":"string","dueAt":"string","note":"string","resolutionNote":"string"},"override":{"status":"active","resolutionReason":"string","dueAt":"string","note":"string","resolutionNote":"string"}}}` ### Output | **Parameter** | **Type** | **Description** | | ----------------------------------------- | -------- | -------------------------------- | | `status_code` | number | HTTP status code of the response | | `reason` | string | Response reason phrase | | `data` | object | Response data | | `data.updateIssue` | object | Response data | | `data.updateIssue.issue` | object | Response data | | `data.updateIssue.issue.id` | string | Response data | | `data.updateIssue.issue.note` | string | Response data | | `data.updateIssue.issue.status` | string | Response data | | `data.updateIssue.issue.dueAt` | string | Response data | | `data.updateIssue.issue.resolutionReason` | string | Response data | ### Output Example `{"status_code":200,"response_headers":{"Date":"Mon, 31 Jul 2023 06:58:20 GMT","Content-Type":"application/json; charset=utf-8","Content-Length":"488","Connection":"keep-alive","content-security-policy":"default-src 'self';base-uri 'self';font-src 'self' https: data:;form-action 'sel...","cross-origin-embedder-policy":"require-corp","cross-origin-opener-policy":"same-origin","cross-origin-resource-policy":"same-origin","x-dns-prefetch-control":"off","x-frame-options":"SAMEORIGIN","strict-transpor...` # Response Headers | **Header** | **Description** | **Example** | | --------------------------------- | ------------------------------------------------------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | access-control-allow-credentials | HTTP response header: access-control-allow-credentials | true | | Connection | HTTP response header: Connection | keep-alive | | content-encoding | HTTP response header: content-encoding | gzip | | Content-Length | The length of the response body in bytes | 922 | | content-security-policy | HTTP response header: content-security-policy | default-src 'self';base-uri 'self';font-src 'self' https: data:;form-action 'self';frame-ancestors 'self';img-src 'self' data:;object-src 'none';script-src 'self';script-src-attr 'none';style-src 'self' https: 'unsafe-inline';upgrade-insecure-requests | | Content-Type | The media type of the resource | application/json; charset=utf-8 | | cross-origin-embedder-policy | HTTP response header: cross-origin-embedder-policy | require-corp | | cross-origin-opener-policy | HTTP response header: cross-origin-opener-policy | same-origin | | cross-origin-resource-policy | HTTP response header: cross-origin-resource-policy | same-origin | | Date | The date and time at which the message was originated | Mon, 31 Jul 2023 06:44:55 GMT | | etag | An identifier for a specific version of a resource | W/"39a-3Ewlc7Rs4iPo79RD3KDSYt1SJgE" | | origin-agent-cluster | HTTP response header: origin-agent-cluster | ?1 | | referrer-policy | HTTP response header: referrer-policy | no-referrer | | strict-transport-security | HTTP response header: strict-transport-security | max-age=15552000; includeSubDomains | | Transfer-Encoding | HTTP response header: Transfer-Encoding | chunked | | vary | HTTP response header: vary | Origin, Accept-Encoding | | x-content-type-options | HTTP response header: x-content-type-options | nosniff | | x-dns-prefetch-control | HTTP response header: x-dns-prefetch-control | off | | x-download-options | HTTP response header: x-download-options | noopen | | x-frame-options | HTTP response header: x-frame-options | SAMEORIGIN | | x-permitted-cross-domain-policies | HTTP response header: x-permitted-cross-domain-policies | none | | x-xss-protection | HTTP response header: x-xss-protection | 0 |