> ## Documentation Index
> Fetch the complete documentation index at: https://docs.lumos.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Wiz

*This is a read-only integration that syncs data from Wiz.*

## After this article

You'll be able to connect Wiz to Lumos to sync Wiz users and roles for visibility and Access Reviews, including each user's last login activity.

## Capabilities

| Functionality | Type | Sync | Provision | Description |
| - | - | - | - | - |
| Users | Account | Yes | No | User accounts, with last login activity |
| Roles | Permission | Yes | No | User roles |

**Activity tracking:** supported. The Wiz connector tracks each user's last login activity.

## Required plan and roles

* **Wiz plan:** no minimum Wiz plan is required to connect this integration.
* **Service account:** create a Wiz service account of type **Custom Integration (GraphQL API)**. The connection uses its Client ID and Client Secret.
* **Scope:** the service account needs the `read:users` scope to sync users.
* **Authentication:** OAuth 2.0 Client Credentials flow, using the Client ID and Client Secret from the service account.
* **Permission scoping:** the connection is read-only. Lumos syncs from Wiz and does not write back.

## Read-only access vs provisioning

**Is read-only possible?** Yes. Wiz is a read-only integration. Lumos syncs users and roles from Wiz for visibility and Access Reviews and does not write back.

**What read-only requires.** A Wiz service account of type Custom Integration (GraphQL API), with the `read:users` scope, connected using its Client ID and Client Secret through the OAuth 2.0 Client Credentials flow. Follow the steps below.

**Watch out for.** There's no broader scope to grant by mistake, since `read:users` is the only scope this connector asks for and the connection is read-only by design. Getting the Tenant Data Center or Environment wrong can look like a credential error, so double check those against your actual Wiz region before assuming the Client ID or Secret is wrong.

## Instructions

**Phase 1: Gather credentials in Wiz**

1. **Client ID:** the client ID for the service account. The service account must be of type Custom Integration (GraphQL API) and must have the `read:users` scope.
2. **Client Secret:** the client secret for the same service account.
3. **Tenant Data Center:** the regional data center of your Wiz deployment. In the Wiz portal, click the user icon at the top right, open **Tenant Info**, then click **Data Center and Regions** on the left and copy your Tenant Data Center. Third-party developers should request this from their Wiz customer contact.
4. **Environment:** the Wiz deployment environment. Use `app.wiz.io` for Commercial (Standard) deployments, `app.wiz.us` for Gov (FedRAMP) deployments, or `gov.wiz.io` for Commercial AWS GovCloud deployments. The default is `app.wiz.io`.

**Phase 2: Connect in Lumos**

1. Find the Wiz card in your Lumos integrations (reconnect an existing card or add a new one).
2. Enter the Client ID, Client Secret, Tenant Data Center, and Environment.
3. Optionally set **Filter by WIZ Auth Provider**. When enabled, Lumos includes only users whose authentication provider type is WIZ. When disabled (the default), Lumos returns all users regardless of authentication provider type.
4. Click **Connect**.

## API Endpoints Used

<Note>
  The API endpoints this integration uses are available to logged-in Lumos customers. [Log in](/login) to view them.
</Note>

## Troubleshooting

**Invalid Client Credentials.** Confirm the Client ID and Client Secret are copied correctly, the service account is active, the required scope is granted, and the region endpoint is correct.

**OAuth Token Error.** Confirm the grant type is `client_credentials`, the service account is active, and no firewall blocks requests to `auth.app.wiz.io`.

**Users not syncing.** Confirm the service account has the `read:users` scope.

**Connection looks like an auth failure but credentials are correct.** An invalid Tenant Data Center can produce a malformed auth URL that reads like a credential error. Set the Tenant Data Center field to your actual Wiz region code (for example `us1`, `us2`, `eu1`, `eu2`, or a specific region such as `us53`) and reconnect.