Wiz package v1.0.0

Provisional credential design: no Wiz authentication reference was retrieved in this review. Earlier third-party connector documentation corroborated OAuth2 client credentials and bearer authentication; it does not verify the vendor contract. Before enabling, confirm the scheme, auth endpoint, grant, audience, exact API scopes, project scoping, lifetime and revocation behavior against Wiz documentation.

If that contract is confirmed, store the complete Authorization header value, including the documented scheme, for a service account restricted to these reads in the customer's secret manager. An external deployment process must own service-account setup, token issuance and renewal. Keep client credentials under separate vault references; the executor injects the stored access-token header and does not perform OAuth or token renewal.

Require provider permissions that reject mutations and executor controls that restrict queries to the types registered here. Do not store write-scoped credentials under this reference or enable the R0 registrations without both controls. The exact vendor scopes that satisfy these requirements remain unverified.

Renew before the confirmed expiry and refuse expired or rejected values. Do not assume that deleting or deactivating an account stops issuance or invalidates captured tokens without vendor confirmation. Treat captured material as live until confirmed expiry or revocation.

The deployment must restrict vault access and keep credential material only in executor memory for the call, out of logs, traces, diagnostics and crash reports. These are requirements awaiting deployment verification, not completed custody checks.

Draft package: no first-party operation contract has been verified. On 2026-09-21, docs.wiz.io returned HTTP 429 on every retrieval attempt and integrate.wiz.io was unreachable. The retrieved Fortinet FortiSOAR Wiz.io connector documentation is a third-party source. It corroborates the regional GraphQL endpoint shape (https://api.<region>.app.wiz.io), service-account OAuth client credentials with a separate auth endpoint, and issue/vulnerability query shapes. It does not establish Wiz's operation contracts. Before promotion, verify every query field, input type, and permission against Wiz documentation and the tenant's GraphQL schema introspection.

Replace wiz-api.invalid with the tenant's regional API host shown in Wiz console settings. Update every endpoint, resource locator, and network allowlist entry together; allowlists match exactly.

Every registered capability uses POST /graphql. Request bodies select the operation, so a different capability name does not restrict a mutation on that shared URL. Two controls are required for these R0 reads: use a service-account token with read-only scopes, and enforce query-only bodies targeting only the types named in each capability description. The provider scopes must reject mutations. The deployment must enforce the type restriction, for example through executor body inspection. Do not enable the capabilities at R0 if either control is absent.

The removed wiz.issues.update and wiz.projects.update registrations remain excluded. This format does not restrict request bodies, so either write registration would admit every mutation permitted by a write-scoped token. Any future write capability needs a separately reviewed control that restricts the actual mutation, such as an executor body allowlist.

An external process creates the service account with minimum scopes, exchanges its client id and secret at the separate Wiz auth endpoint, and stores and renews the complete header value defined in the credential note. The package performs no account creation or token issuance.

All GraphQL mutations are excluded, including updateIssue, deleteIssue, updateProject, deleteProject; service-account creation, rotation, and deletion; SAML, SSO, and authentication settings; cloud connector onboarding and offboarding for subscriptions, projects, and organization-wide connections; automation and integration changes that may send finding data to third parties; reports scheduled for external delivery; and user or role management.

Re-review on 2026-10-29: the web reader returned HTTP 403 for the API guide on docs.wiz.io. The llms.txt URL, win.wiz.io and integrate.wiz.io were inaccessible through that tool. The wiz-sec GitHub organization and its charts repository were readable, but no first-party query contract for these four reads was retrieved. The earlier HTTP 429 result is historical. All four operations, exact read-only scopes, token lifetime and revocation behavior remain unverified against Wiz documentation. Do not enable this draft.