wiz-api-interaction

Wiz GraphQL API Interaction

Overview

Wiz provides a GraphQL API for programmatic access to cloud findings, compliance status, and resource inventory. This skill covers authentication, query patterns, and response parsing.

Authentication

OAuth 2.0 Client Credentials Flow

Step 1: Get Access Token

curl -X POST https://auth.app.wiz.io/oauth/token \
  -H "Content-Type: application/x-www-form-urlencoded" \
  -d "grant_type=client_credentials" \
  -d "client_id=$WIZ_CLIENT_ID" \
  -d "client_secret=$WIZ_CLIENT_SECRET" \
  -d "audience=wiz-api"

Response:

{
  "access_token": "eyJhbGciOiJSUzI1NiIs...",
  "expires_in": 3600,
  "token_type": "Bearer"
}

Step 2: Use Token

All subsequent requests:

-H "Authorization: Bearer $ACCESS_TOKEN"

Token Management

#!/bin/bash

function get_wiz_token() {
  local client_id="$WIZ_CLIENT_ID"
  local client_secret="$WIZ_CLIENT_SECRET"

  curl -s -X POST https://auth.app.wiz.io/oauth/token \
    -H "Content-Type: application/x-www-form-urlencoded" \
    -d "grant_type=client_credentials&client_id=$client_id&client_secret=$client_secret&audience=wiz-api" \
    | jq -r '.access_token'
}

# Get fresh token (valid 1 hour)
TOKEN=$(get_wiz_token)

GraphQL Endpoint

https://api.app.wiz.io/graphql

Common Queries

Query Issues by Severity

Goal: Find all CRITICAL and HIGH severity issues in a project

query GetCriticalIssues($projectId: String!) {
  issues(
    filterBy: {
      project: [$projectId]
      status: [OPEN, IN_PROGRESS]
      severity: [CRITICAL, HIGH]
    }
    first: 100
  ) {
    nodes {
      id
      title
      description
      severity
      status
      createdAt
      sourceRule {
        id
        name
      }
      resource {
        id
        name
        type
        cloudProvider
      }
    }
    pageInfo {
      hasNextPage
      endCursor
    }
  }
}

Variables:

{
  "projectId": "proj-uuid-123"
}

Request:

curl -s -X POST https://api.app.wiz.io/graphql \
  -H "Authorization: Bearer $TOKEN" \
  -H "Content-Type: application/json" \
  -d '{
    "query": "query GetCriticalIssues($projectId: String!) { ... }",
    "variables": { "projectId": "proj-uuid-123" }
  }' | jq .

Query Compliance Framework Status

Goal: Get compliance posture for CIS AWS Benchmark

query ComplianceStatus($frameworkId: String!) {
  complianceFramework(id: $frameworkId) {
    id
    name
    description
    passedRequirements
    failedRequirements
    totalRequirements
    complianceScore
    requirements(first: 100) {
      nodes {
        id
        name
        status
        controls(first: 10) {
          nodes {
            id
            name
            result
            failingResources {
              id
              name
              type
            }
          }
        }
      }
    }
  }
}

Variables:

{
  "frameworkId": "framework-cis-aws"
}

Get Issue Details with Fix Information

query IssueDetail($issueId: ID!) {
  issue(id: $issueId) {
    id
    title
    description
    severity
    status
    createdAt
    updatedAt
    sourceRule {
      id
      name
      remediation
      description
      cweId
      cvssScore
    }
    resource {
      id
      name
      type
      cloudProvider
      properties {
        key
        value
      }
      relatedFindings(first: 10) {
        nodes {
          id
          title
          severity
        }
      }
    }
  }
}

Search Resources by Type and Provider

query SearchResources($type: String!, $provider: String!) {
  graphSearch(
    query: {
      type: ["CLOUD_RESOURCE"]
      where: {
        type: { EQUALS: [$type] }
        cloudProvider: { EQUALS: [$provider] }
      }
    }
    first: 100
  ) {
    nodes {
      id
      name
      type
      cloudProvider
      properties {
        key
        value
      }
      relatedIssues(first: 10) {
        nodes {
          id
          title
          severity
        }
      }
    }
    pageInfo {
      hasNextPage
      endCursor
    }
  }
}

Example: Search S3 buckets

{
  "type": "S3Bucket",
  "provider": "AWS"
}

Common Mutations

Resolve Finding

Goal: Mark an issue as RESOLVED with a note

mutation ResolveIssue($issueId: ID!, $status: IssueStatus!, $note: String!) {
  updateIssue(
    input: {
      id: $issueId
      patch: {
        status: $status
        note: $note
      }
    }
  ) {
    issue {
      id
      status
      note
      updatedAt
    }
  }
}

Request:

curl -s -X POST https://api.app.wiz.io/graphql \
  -H "Authorization: Bearer $TOKEN" \
  -H "Content-Type: application/json" \
  -d '{
    "query": "mutation ResolveIssue($issueId: ID!, $status: IssueStatus!, $note: String!) { ... }",
    "variables": {
      "issueId": "issue-uuid-123",
      "status": "RESOLVED",
      "note": "Fixed by updating S3 bucket encryption settings"
    }
  }'

Accept Risk

Goal: Mark issue as ACCEPTED_RISK with justification

mutation AcceptRisk($issueId: ID!, $note: String!, $expiresAt: String) {
  updateIssue(
    input: {
      id: $issueId
      patch: {
        status: ACCEPTED_RISK
        note: $note
        expiresAt: $expiresAt
      }
    }
  ) {
    issue {
      id
      status
      note
      expiresAt
    }
  }
}

Suppress Finding

Goal: Suppress false positive or expected issue

mutation SuppressFinding($issueId: ID!, $reason: String!) {
  updateIssue(
    input: {
      id: $issueId
      patch: {
        status: IGNORED
        note: $reason
      }
    }
  ) {
    issue {
      id
      status
    }
  }
}

Response Parsing

Extract Issue Summary

#!/bin/bash

QUERY='
query {
  issues(filterBy: { severity: [CRITICAL] }, first: 50) {
    nodes {
      id
      title
      severity
      sourceRule { name }
      resource { name }
    }
  }
}'

curl -s -X POST https://api.app.wiz.io/graphql \
  -H "Authorization: Bearer $TOKEN" \
  -H "Content-Type: application/json" \
  -d "{\"query\": \"$(echo $QUERY | sed 's/"/\\"/g')\"}" \
  | jq -r '.data.issues.nodes[] | "\(.severity) - \(.title) (\(.resource.name))"'

Compliance Report

#!/bin/bash

QUERY='
query {
  complianceFramework(id: "framework-cis-aws") {
    name
    passedRequirements
    failedRequirements
    requirements(first: 100) {
      nodes {
        name
        status
        controls { nodes { name result } }
      }
    }
  }
}'

curl -s -X POST https://api.app.wiz.io/graphql \
  -H "Authorization: Bearer $TOKEN" \
  -H "Content-Type: application/json" \
  -d "{\"query\": \"$(echo $QUERY | sed 's/"/\\"/g')\"}" \
  | jq '
    .data.complianceFramework |
    "CIS AWS Benchmark:\n  Passed: \(.passedRequirements)\n  Failed: \(.failedRequirements)\n  Score: \((.passedRequirements / (.passedRequirements + .failedRequirements) * 100 | round))\%"
  '

Pagination

GraphQL uses cursor-based pagination:

#!/bin/bash

function get_all_issues() {
  local project_id="$1"
  local cursor=""
  local has_next_page=true

  while [ "$has_next_page" = "true" ]; do
    local after=""
    if [ -n "$cursor" ]; then
      after="after: \"$cursor\""
    fi

    QUERY="query { issues(filterBy: { project: [\"$project_id\"] } first: 100 $after) { nodes { id title } pageInfo { hasNextPage endCursor } } }"

    response=$(curl -s -X POST https://api.app.wiz.io/graphql \
      -H "Authorization: Bearer $TOKEN" \
      -H "Content-Type: application/json" \
      -d "{\"query\": \"$QUERY\"}")

    # Parse results
    echo "$response" | jq '.data.issues.nodes[] | .id'

    # Check for more pages
    has_next_page=$(echo "$response" | jq '.data.issues.pageInfo.hasNextPage')
    cursor=$(echo "$response" | jq -r '.data.issues.pageInfo.endCursor')
  done
}

get_all_issues "proj-uuid-123"

Error Handling

Parse GraphQL Errors

response=$(curl -s -X POST https://api.app.wiz.io/graphql \
  -H "Authorization: Bearer $TOKEN" \
  -H "Content-Type: application/json" \
  -d '{"query": "..."}')

# Check for errors
if echo "$response" | jq -e '.errors' > /dev/null; then
  echo "GraphQL Error:"
  echo "$response" | jq '.errors[].message'
  exit 1
fi

Common Errors

Error	Cause	Solution
"UNAUTHENTICATED"	Invalid/expired token	Re-authenticate: get new token
"FORBIDDEN"	Insufficient scopes	Check token permissions
"Timeout"	Query too complex	Reduce pagination size or filter results
"Rate limiting"	Too many requests	Implement backoff

Complete Workflow Example

#!/bin/bash

# 1. Authenticate
TOKEN=$(curl -s -X POST https://auth.app.wiz.io/oauth/token \
  -d "grant_type=client_credentials&client_id=$WIZ_CLIENT_ID&client_secret=$WIZ_CLIENT_SECRET&audience=wiz-api" \
  | jq -r '.access_token')

# 2. Find critical issues
CRITICAL_QUERY='
query {
  issues(filterBy: { severity: [CRITICAL], status: [OPEN] }, first: 10) {
    nodes { id title resource { name } }
  }
}'

ISSUES=$(curl -s -X POST https://api.app.wiz.io/graphql \
  -H "Authorization: Bearer $TOKEN" \
  -H "Content-Type: application/json" \
  -d "{\"query\": \"$CRITICAL_QUERY\"}")

# 3. For each issue, get details and resolve if fixed
for issue_id in $(echo "$ISSUES" | jq -r '.data.issues.nodes[].id'); do
  echo "Processing issue: $issue_id"

  # Simulate fix verification
  RESOLVED_MUTATION="
  mutation {
    updateIssue(input: { id: \"$issue_id\" patch: { status: RESOLVED note: \"Fixed via automation\" } }) {
      issue { id status }
    }
  }"

  curl -s -X POST https://api.app.wiz.io/graphql \
    -H "Authorization: Bearer $TOKEN" \
    -H "Content-Type: application/json" \
    -d "{\"query\": \"$RESOLVED_MUTATION\"}" \
    | jq '.data.updateIssue.issue'
done

# 4. Report compliance status
COMPLIANCE_QUERY='
query {
  complianceFramework(id: "framework-cis-aws") {
    name passedRequirements failedRequirements
  }
}'

curl -s -X POST https://api.app.wiz.io/graphql \
  -H "Authorization: Bearer $TOKEN" \
  -H "Content-Type: application/json" \
  -d "{\"query\": \"$COMPLIANCE_QUERY\"}" \
  | jq '.data.complianceFramework'