> ## Documentation Index
> Fetch the complete documentation index at: https://docs.stackone.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Connect Wiz with OAuth 2.0 (Client Credentials) – StackOne Hub

> Link a Wiz account in the StackOne Hub using OAuth 2.0 (Client Credentials). End-user guide to authorize the integration and start using Wiz actions.

> [!WARNING]
>
> You need a Wiz user with Write permission on service accounts. A user whose role is limited to some projects can create service accounts only on those projects, so use a tenant-wide user. StackOne only reads.

## Create the service account

A service account of type Custom Integration (GraphQL API) gives StackOne its own Client ID and Client Secret, with only the scopes you pick.

**1. Sign in to Wiz**

Sign in to your [Wiz account](https://app.wiz.io) as a user who can create service accounts.

<ul>
  <li>Navigate to **Settings** > **Access Management** > **Service Accounts**.</li>
  <li>Click **Add Service Account**.</li>
</ul>

**2. Name the service account and choose its type**

Fill in the first fields of the form.

<ul>
  <li>**Name**: `StackOne Integration`</li>
  <li>**Type**: select **Custom Integration (GraphQL API)**</li>
</ul>

**3. Leave Projects empty**

Leave **Projects** empty so the service account sees the whole tenant.

<ul>
  <li>Wiz lets you limit a service account to up to 50 projects. A limited account can miss users and roles outside those projects, and Wiz does not let you change the projects after you create the account.</li>
</ul>

**4. Leave the expiration empty**

Leave **Expiration** empty.

<ul>
  <li>If you set a date, the connection stops working when the service account expires.</li>
</ul>

**5. Choose the API scopes**

Under **API Scopes**, select only these scopes.

<ul>
  <li>`read:users` lists and reads Wiz users and the roles assigned to them.</li>
  <li>`read:service_accounts` lists service accounts.</li>
  <li>`read:projects` lists projects.</li>
  <li>If a roles action returns an access denied message, the message lists the scopes that allow it. Add the narrowest `read:` scope it lists, not `read:all`.</li>
  <li>StackOne never writes, so do not select `read:all` or any `admin:`, `create:`, `write:`, `update:` or `delete:` scope.</li>
</ul>

**6. Copy the Client ID and Client Secret**

Click **Add Service Account**. The dialog shows the **Client ID** and the **Client Secret**. Copy both and store them securely for use later.

<ul>
  <li>The Client Secret is shown once. Copy it before you click **Finish**.</li>
  <li>Paste the Client ID into the **Client ID** field in StackOne Hub.</li>
  <li>Paste the Client Secret into the **Client Secret** field in StackOne Hub.</li>
</ul>

## Find your API Endpoint URL

The **API Endpoint URL** is the GraphQL address of your Wiz tenant. It depends on the data center that hosts your tenant.

<ul>
  <li>Click your profile icon in the top right of the Wiz portal, then click **Tenant Info**.</li>
  <li>Shortcut: [Tenant Info in Wiz](https://app.wiz.io/tenant-info/general)</li>
  <li>Copy the **API Endpoint URL** from the **General** tab.</li>
  <li>Format: `https://api.{data center}.app.wiz.io/graphql`</li>
  <li>Example: `https://api.us1.app.wiz.io/graphql`</li>
  <li>Wiz can show the address without `/graphql` at the end. Paste it as shown, because both forms work.</li>
  <li>Paste the address into the **API Endpoint URL** field in StackOne Hub.</li>
  <li>Wiz for Gov tenants have a different address. Copy yours exactly as **Tenant Info** shows it.</li>
  <li>To build the address yourself, open the **Data Center and Regions** tab of **Tenant Info** to see your data center, for example `us1`.</li>
</ul>

## Check your Authentication URL

The **Authentication URL** is where StackOne exchanges the Client ID and Client Secret for an access token.

<ul>
  <li>On the **General** tab of **Tenant Info**, read the **Authentication URL**.</li>
  <li>Standard value: `https://auth.app.wiz.io/oauth/token`</li>
  <li>If yours is the same, leave the **Authentication URL** field empty in StackOne Hub. If Wiz shows a different address, paste it into the field.</li>
</ul>

## Revoke access

To stop StackOne from reading your Wiz tenant, delete the service account.

<ul>
  <li>Navigate to **Settings** > **Access Management** > **Service Accounts**.</li>
  <li>Find the service account you created for StackOne and delete it.</li>
  <li>The connection then fails until you create a new service account and connect again.</li>
</ul>

## Linking the Account from the Hub

**1. Navigate to the Hub**

Use one of the three [Linking Account Methods](https://docs.stackone.com/connect/managing-connectors/linking-accounts.md) to access the Hub.

**2. Fill out the fields**

Fill out the following fields using details from your provider:

<ul>
  <li>**Client ID**</li>
  <li>**Client Secret**</li>
  <li>**API Endpoint URL**</li>
  <li>**Authentication URL** (Optional)</li>
</ul>

**3. Connect**

<ul>
  <li>Click **Connect**</li>
  <li>If applicable, the provider will redirect you to a sign-in or authorization page. Complete the provider's authorization flow.</li>
  <li>Once authorization is successful, you will see a confirmation popup</li>
</ul>

If the account linking is successful, you will see the newly linked account on your [Accounts](https://app.stackone.com/accounts) page.


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.