Skip to main content
You need a Wiz user with Write permission on service accounts. A user whose role is limited to some projects can create service accounts only on those projects, so use a tenant-wide user. StackOne only reads.

​
Create the service account

A service account of type Custom Integration (GraphQL API) gives StackOne its own Client ID and Client Secret, with only the scopes you pick.

1

Sign in to Wiz

Sign in to your Wiz account as a user who can create service accounts.

  • Navigate to Settings > Access Management > Service Accounts.
  • Click Add Service Account.
2

Name the service account and choose its type

Fill in the first fields of the form.

  • Name: StackOne Integration
  • Type: select Custom Integration (GraphQL API)
3

Leave Projects empty

Leave Projects empty so the service account sees the whole tenant.

  • Wiz lets you limit a service account to up to 50 projects. A limited account can miss users and roles outside those projects, and Wiz does not let you change the projects after you create the account.
4

Leave the expiration empty

Leave Expiration empty.

  • If you set a date, the connection stops working when the service account expires.
5

Choose the API scopes

Under API Scopes, select only these scopes.

  • read:users lists and reads Wiz users and the roles assigned to them.
  • read:service_accounts lists service accounts.
  • read:projects lists projects.
  • If a roles action returns an access denied message, the message lists the scopes that allow it. Add the narrowest read: scope it lists, not read:all.
  • StackOne never writes, so do not select read:all or any admin:, create:, write:, update: or delete: scope.
6

Copy the Client ID and Client Secret

Click Add Service Account. The dialog shows the Client ID and the Client Secret. Copy both and store them securely for use later.

  • The Client Secret is shown once. Copy it before you click Finish.
  • Paste the Client ID into the Client ID field in StackOne Hub.
  • Paste the Client Secret into the Client Secret field in StackOne Hub.

​
Find your API Endpoint URL

The API Endpoint URL is the GraphQL address of your Wiz tenant. It depends on the data center that hosts your tenant.

  • Click your profile icon in the top right of the Wiz portal, then click Tenant Info.
  • Shortcut: Tenant Info in Wiz
  • Copy the API Endpoint URL from the General tab.
  • Format: https://api.{data center}.app.wiz.io/graphql
  • Example: https://api.us1.app.wiz.io/graphql
  • Wiz can show the address without /graphql at the end. Paste it as shown, because both forms work.
  • Paste the address into the API Endpoint URL field in StackOne Hub.
  • Wiz for Gov tenants have a different address. Copy yours exactly as Tenant Info shows it.
  • To build the address yourself, open the Data Center and Regions tab of Tenant Info to see your data center, for example us1.

​
Check your Authentication URL

The Authentication URL is where StackOne exchanges the Client ID and Client Secret for an access token.

  • On the General tab of Tenant Info, read the Authentication URL.
  • Standard value: https://auth.app.wiz.io/oauth/token
  • If yours is the same, leave the Authentication URL field empty in StackOne Hub. If Wiz shows a different address, paste it into the field.

​
Revoke access

To stop StackOne from reading your Wiz tenant, delete the service account.

  • Navigate to Settings > Access Management > Service Accounts.
  • Find the service account you created for StackOne and delete it.
  • The connection then fails until you create a new service account and connect again.

​
Linking the Account from the Hub

1

Navigate to the Hub

Use one of the three Linking Account Methods to access the Hub.
2

Fill out the fields

Fill out the following fields using details from your provider:
  • Client ID
  • Client Secret
  • API Endpoint URL
  • Authentication URL (Optional)
3

Connect

  • Click Connect
  • If applicable, the provider will redirect you to a sign-in or authorization page. Complete the provider’s authorization flow.
  • Once authorization is successful, you will see a confirmation popup

If the account linking is successful, you will see the newly linked account on your Accounts page.