Wiz Integration

Connect Wiz to Capsule Security to inventory the AI agents and MCP servers Wiz discovers across your cloud environments and hosts.

Capsule reads from the Wiz API and syncs:

• AI agents - Agents Wiz discovers across your cloud environments and hosts
• MCP servers - MCP servers Wiz discovers across your cloud environments and hosts

Capsule only reads. It does not change anything in your Wiz tenant.

Sync runs once every 24 hours. The first sync pulls everything Wiz has discovered. Later syncs pull only what changed since the previous one.

Before you begin, ensure you have:

• A Wiz tenant where you can open and enable the Capsule integration
• A Capsule Security account with admin access

The credentials Wiz issues must carry the read:resources scope.

1. In Wiz, find the Capsule integration and enable it.

2. Wiz shows four values. Copy each one:

   • Client ID
   • Client Secret
   • Authentication URL
   • API Endpoint URL

The Authentication URL depends on your Wiz environment. Capsule accepts these three values:

The API Endpoint URL is the GraphQL endpoint of your Wiz tenant, for example https://api.us1.app.wiz.io/graphql. Capsule accepts only URLs of the form https://api.<region>.app.wiz.io/graphql, https://api.<region>.app.wiz.us/graphql or https://api.<region>.gov.wiz.io/graphql.

1. In the Capsule portal, go to Settings → Integrations.

2. Find Wiz and click Connect.

3. Enter the values from Step 1:

   • Client ID
   • Client Secret
   • Authentication URL: Select the URL for your environment.
   • API Endpoint URL: Paste the endpoint Wiz showed you. There is no default.

4. Capsule tests the connection as you type and reports success or the specific failure.

5. Click Save.

• The first sync begins automatically.
• Discovered AI agents and MCP servers appear in Inventory.

• Check that the Client ID and Client Secret match what Wiz shows, with no extra spaces.
• Check that the Authentication URL matches your Wiz environment from the table above.
• Check that the API Endpoint URL is the one Wiz showed for your tenant.
• Confirm the credentials carry the read:resources scope.

• Use the full GraphQL URL, including https:// and the /graphql path, for example https://api.us1.app.wiz.io/graphql.

• Sync runs once every 24 hours, so a resource Wiz discovered today can take up to a day to appear in Capsule.

For help with this integration:

• Email: support@capsule.security
• Include: Your tenant ID, integration status, and any error messages from the Capsule portal