Wiz

The Wiz integration is an incoming channel: Wiz sends findings and asset events to Elastio, and when an event names an asset Elastio can hunt (an AWS S3 bucket, EC2 instance or EBS volume), Elastio can schedule a hunt for it.

You don’t create Wiz channels yourself. The first event from a new Wiz source creates one automatically, identified by the Wiz subscription or organization ID in the payload (wiz_source_id). Later events from the same source go to the same channel.

Authentication

The Wiz operations use a separate integration token issued by Elastio for inbound partner events. In the spec this is the bearerAuth scheme. It is sent the same way as a personal access token, Authorization: Bearer <token>, but it is a different credential. The gateway validates it and works out your tenant from it.

The examples below read it from $ELASTIO_WIZ_TOKEN. The spec doesn’t document an API operation that issues this token; contact Elastio to get one.

1. Point Wiz at Elastio

Get the integration token from Elastio.
In Wiz, set up an outbound webhook to this URL, sending the token as a Bearer token in the Authorization header:
```
https://acme.app.elastio.com/gateway/integration/v1/wiz/webhook
```
Send a test event from Wiz, then list your channels (below) to confirm the channel was created.

2. What Wiz sends

POST

/gateway/integration/v1/wiz/webhookReceive incoming Wiz event

Try it

Elastio stores the Wiz payload verbatim. You don’t normally call this yourself, but you can to test your token and network path.

curl -X POST "https://acme.app.elastio.com/gateway/integration/v1/wiz/webhook" \
  -H "Authorization: Bearer $ELASTIO_WIZ_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{"subscriptionId": "sub-abc123", "subscriptionName": "Production Wiz Org", "severity": "HIGH", "findings": []}'

import os, requests

BASE = "https://acme.app.elastio.com"
WIZ_HEADERS = {"Authorization": f"Bearer {os.environ['ELASTIO_WIZ_TOKEN']}"}

resp = requests.post(
    f"{BASE}/gateway/integration/v1/wiz/webhook",
    headers=WIZ_HEADERS,
    json={"subscriptionId": "sub-abc123", "subscriptionName": "Production Wiz Org", "severity": "HIGH", "findings": []},
    timeout=30,
)
resp.raise_for_status()
print(resp.json())

$Base = "https://acme.app.elastio.com"
$WizHeaders = @{ Authorization = "Bearer $env:ELASTIO_WIZ_TOKEN" }
$body = @{ subscriptionId = "sub-abc123"; subscriptionName = "Production Wiz Org"; severity = "HIGH"; findings = @() } | ConvertTo-Json
Invoke-RestMethod -Method Post -Uri "$Base/gateway/integration/v1/wiz/webhook" `
    -Headers $WizHeaders -ContentType "application/json" -Body $body

{
  "status": "received",
  "id": "8f14e45f-ceea-467a-a866-92405cc08e17",
  "scan_status": "scheduled",
  "scan_job_id": "07fb3384-93e5-5359-bd41-c9ed9d02d865"
}

scan_status tells you what happened next:

Value	Meaning
`scheduled`	Elastio scheduled a hunt; its job ID is in `scan_job_id`.
`not_scheduled`	The event names an asset Elastio can hunt, but no hunt was scheduled.
`unsupported`	The event doesn’t name an asset Elastio can hunt.

A 403 means the channel for this source is set to inactive.

3. Check your channels

GET

/gateway/integration/v1/wizList Wiz channels

Try it

Each channel reports activity for the last seven days. If scans_scheduled_last_7_days is lower than scannable_received_last_7_days, events are arriving but hunts aren’t being scheduled. Results page with page_token; the next token is in pagination.next_page_token.

curl "https://acme.app.elastio.com/gateway/integration/v1/wiz" \
  -H "Authorization: Bearer $ELASTIO_WIZ_TOKEN" \
  | jq '.configs[] | {id, name, wiz_source_id, status, total_received_last_7_days, scannable_received_last_7_days, scans_scheduled_last_7_days, last_received_at}'

resp = requests.get(f"{BASE}/gateway/integration/v1/wiz", headers=WIZ_HEADERS, timeout=30)
resp.raise_for_status()
for ch in resp.json().get("configs", []):
    print(ch["name"], ch["wiz_source_id"], ch["status"], ch.get("scans_scheduled_last_7_days"))

(Invoke-RestMethod -Uri "$Base/gateway/integration/v1/wiz" -Headers $WizHeaders).configs |
    Select-Object id, name, wiz_source_id, status, scans_scheduled_last_7_days, last_received_at

{
  "configs": [
    {
      "id": "550e8400-e29b-41d4-a716-446655440000",
      "tenant_name": "acme",
      "name": "Wiz Integration 1",
      "description": "Production Wiz organisation",
      "wiz_source_id": "sub-abc123",
      "status": "active",
      "created_at": "2026-02-19T10:00:00Z",
      "updated_at": "2026-02-19T10:00:00Z",
      "last_scan_asset_name": "gd-test-malware-01",
      "last_scan_asset_id": "arn:aws:s3:::gd-test-malware-01",
      "total_received_last_7_days": 5,
      "scannable_received_last_7_days": 2,
      "scans_scheduled_last_7_days": 2,
      "last_received_at": "2026-02-25T18:42:00Z"
    }
  ],
  "pagination": { "next_page_token": null, "prev_page_token": null, "total_count": 1 }
}

4. Rename or pause a channel

PUT

/gateway/integration/v1/wiz/{id}Update a Wiz channel

Try it

Change name, description or status. Only the fields you send change. Setting status to inactive makes Elastio reject events from that source with 403. Names must be unique; a clash returns 409.

WIZ_ID="550e8400-e29b-41d4-a716-446655440000"
curl -X PUT "https://acme.app.elastio.com/gateway/integration/v1/wiz/$WIZ_ID" \
  -H "Authorization: Bearer $ELASTIO_WIZ_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{"name": "Prod Wiz Org", "status": "inactive"}'

wiz_id = "550e8400-e29b-41d4-a716-446655440000"
resp = requests.put(
    f"{BASE}/gateway/integration/v1/wiz/{wiz_id}",
    headers=WIZ_HEADERS,
    json={"name": "Prod Wiz Org", "status": "inactive"},
    timeout=30,
)
resp.raise_for_status()

$WizId = "550e8400-e29b-41d4-a716-446655440000"
$body = @{ name = "Prod Wiz Org"; status = "inactive" } | ConvertTo-Json
Invoke-RestMethod -Method Put -Uri "$Base/gateway/integration/v1/wiz/$WizId" `
    -Headers $WizHeaders -ContentType "application/json" -Body $body

DELETE /gateway/integration/v1/wiz/{id} soft-deletes a channel. Events already stored are kept.

All endpoints

Wiz

5 operations in the reference →