;}%20.st6{fill:url(%23SVGID_00000021089067129159788970000008246765442136188072_);}%20.st7{fill:url(%23SVGID_00000117639240116366130650000015074833605515028638_);}%20.st8{opacity:0.4;fill:url(%23SVGID_00000101781798616409025840000016567063639337360777_);}%20.st9{opacity:0.4;fill:url(%23SVGID_00000052086836598721292040000002033117744178971046_);}%20.st10{opacity:0.4;fill:url(%23SVGID_00000159460939004760751800000002448009281983951536_);}%20.st11{opacity:0.4;fill:url(%23SVGID_00000013177830667419993080000017721442101626521532_);}%20.st12{opacity:0.4;fill:url(%23SVGID_00000152235521444854938490000006526001119318383285_);}%20.st13{opacity:0.4;fill:url(%23SVGID_00000119823135212293698520000012774889010992664993_);}%20%3c/style%3e%3cg%3e%3cpolygon%20class='st2'%20points='134.78,14.22%20114.31,48.21%20101.33,69.75%20158.22,69.75%20177.97,36.95%20191.67,14.22%20'/%3e%3cpolygon%20class='st3'%20points='227.55,69.75%20186.61,69.75%20101.33,69.75%20129.78,119.02%20158.16,119.02%20228.61,119.02%20256,119.02%20'/%3e%3cpolygon%20class='st3'%20points='136.93,132.47%20116.46,167.93%2073.82,241.78%20130.71,241.78%20144.9,217.2%20180.13,156.18%20193.82,132.46%20'/%3e%3cpolygon%20class='st3'%20points='121.7,131.95%20101.23,96.49%2058.59,22.63%2030.15,71.91%2044.34,96.49%2079.57,157.5%2093.26,181.22%20'/%3e%3cpolygon%20class='st2'%20points='64.81,131.95%2025.15,131.21%200,130.74%2028.44,180.01%2066.73,180.72%2093.26,181.21%20'/%3e%3cpolygon%20class='st2'%20points='165.38,181.74%20184.58,216.46%20196.75,238.47%20225.19,189.2%20206.66,155.69%20193.83,132.46%20'/%3e%3c/g%3e%3c/svg%3e)
Windmill HubWiz
Monitoring Service accountQuery Wiz cloud security findings, issues and inventory from any Windmill script, flow or app.
Set up in 3 steps
Create a service account
In the Wiz portal, open Settings then Service Accounts, and create one with the scopes your scripts need. Copy its client id and secret.
Add the resource in Windmill
Open Resources, add a resource of type wiz, and fill client_id, client_secret and api_endpoint — the GraphQL host for your tenant, shown alongside the service account.
Run your first script
Fork any script below and read before writing anything.
Scripts
Building blocks, if none of the projects above fit. Fork one, run it, or call it as a step inside your own flow.
New Issues
Update Issue
List Vulnerability Findings
List Projects
List Issues
List Configuration Findings
List Cloud Resources
Get Vulnerability Finding
Get Project
Get Issue
Execute GraphQL Query
Create Issue Note
Trigger flows from Wiz
Wiz is not only a destination. These inbound paths are supported today.
New issues (scheduled poll)
The New Issues trigger script polls Wiz and returns the issues created since its last run. To run it, open a flow, add a trigger and choose Scheduled Poll, then pick the trigger script and an interval. Windmill puts the script first in the flow with a loop after it, so the steps you add run once per new item. The cursor is saved per flow: two flows polling the same source each get every item, and test runs keep a cursor of their own.
Resource type
The shape of the credential every script on this page expects.
| Field | Type | Required | What it is |
|---|---|---|---|
| api_endpoint | string | Yes | Tenant-specific GraphQL endpoint, e.g. https://api.us1.app.wiz.io/graphql (the region is shown in the portal under Settings > Service Accounts / API documentation). |
| audience | string | No | OAuth token audience. Optional — defaults to wiz-api. Some older tenants use beyond-api (check Settings > Service Accounts). |
| auth_url | string | No | OAuth token endpoint. Optional — defaults to https://auth.app.wiz.io/oauth/token (commercial). Gov tenants use https://auth.gov.wiz.io/oauth/token. |
| client_id | string | Yes | Service account Client ID from Settings > Service Accounts. |
| client_secret | string | Yes | Service account Client Secret. Shown only once at creation. |
Questions
Why an API endpoint field?
Wiz gives each tenant its own GraphQL host by region. Every call is built from it, so a wrong endpoint fails before the credentials are checked.
Why a client pair and not a token?
The scripts exchange them for a short-lived token on each run, so nothing expires in the resource.
Are my credentials stored on the hub?
Never. They live only in your own Windmill workspace, encrypted at rest.