# Wiz Integration

Connect Wiz to Capsule Security to inventory the AI agents and MCP servers Wiz discovers across your cloud environments and hosts.

## Overview

Capsule reads from the Wiz API and syncs:

- **AI agents** - Agents Wiz discovers across your cloud environments and hosts
- **MCP servers** - MCP servers Wiz discovers across your cloud environments and hosts


Capsule only reads. It does not change anything in your Wiz tenant.

### Sync schedule

Sync runs once every 24 hours. The first sync pulls everything Wiz has discovered. Later syncs pull only what changed since the previous one.

## Prerequisites

Before you begin, ensure you have:

- A Wiz tenant where you can open and enable the Capsule integration
- A **Capsule Security** account with admin access


The credentials Wiz issues must carry the `read:resources` scope.

## Step 1: Enable the Capsule Integration in Wiz

### Steps

1. In Wiz, find the Capsule integration and enable it.
2. Wiz shows four values. Copy each one:
  - **Client ID**
  - **Client Secret**
  - **Authentication URL**
  - **API Endpoint URL**


### Authentication URL

The Authentication URL depends on your Wiz environment. Capsule accepts these three values:

| Environment | Authentication URL |
|  --- | --- |
| Commercial | `https://auth.app.wiz.io/oauth/token` |
| FedRAMP | `https://auth.app.wiz.us/oauth/token` |
| GovCloud | `https://auth.gov.wiz.io/oauth/token` |


### API Endpoint URL

The API Endpoint URL is the GraphQL endpoint of your Wiz tenant, for example `https://api.us1.app.wiz.io/graphql`. Capsule accepts only URLs of the form `https://api.<region>.app.wiz.io/graphql`, `https://api.<region>.app.wiz.us/graphql` or `https://api.<region>.gov.wiz.io/graphql`.

## Step 2: Configure the Integration in Capsule

### Steps

1. In the Capsule portal, go to **Settings → Integrations**.
2. Find **Wiz** and click **Connect**.
3. Enter the values from Step 1:
  - **Client ID**
  - **Client Secret**
  - **Authentication URL**: Select the URL for your environment.
  - **API Endpoint URL**: Paste the endpoint Wiz showed you. There is no default.
4. Capsule tests the connection as you type and reports success or the specific failure.
5. Click **Save**.


### After setup

- The first sync begins automatically.
- Discovered AI agents and MCP servers appear in **Inventory**.


## Troubleshooting

### The connection test fails

- Check that the **Client ID** and **Client Secret** match what Wiz shows, with no extra spaces.
- Check that the **Authentication URL** matches your Wiz environment from the table above.
- Check that the **API Endpoint URL** is the one Wiz showed for your tenant.
- Confirm the credentials carry the `read:resources` scope.


### The API Endpoint URL is rejected

- Use the full GraphQL URL, including `https://` and the `/graphql` path, for example `https://api.us1.app.wiz.io/graphql`.


### New resources do not show up right away

- Sync runs once every 24 hours, so a resource Wiz discovered today can take up to a day to appear in Capsule.


## Support

For help with this integration:

- **Email**: support@capsule.security
- **Include**: Your tenant ID, integration status, and any error messages from the Capsule portal