id: wiz
name: Wiz
version: 1.0.0
description: "Wiz (CNAPP GraphQL API) — cloud security posture: list and read issues, update an issue's status, list vulnerability findings, and search cloud resources. OAuth2 client-credentials authentication; stdlib-only, no extra Python dependencies."
changelog: "1.0.0 — Initial release: list/get issues, update issue status, list vulnerabilities, list cloud resources."
category: cloud

# Per-instance configuration. Client credentials are exchanged at the auth URL
# for a bearer token used against the tenant GraphQL endpoint.
config_schema:
  properties:
    api_url:
      type: string
      description: "Wiz GraphQL API endpoint (e.g. https://api.us1.app.wiz.io/graphql)"
    auth_url:
      type: string
      description: "Wiz OAuth token URL"
      default: "https://auth.app.wiz.io/oauth/token"
    client_id:
      type: string
      description: "Wiz service account client ID"
    client_secret:
      type: string
      description: "Wiz service account client secret"
      x-soar-sensitive: true
  required:
    - api_url
    - client_id
    - client_secret

commands:
  - id: list_issues
    name: wiz-list-issues
    description: "List issues (optionally filtered by status and severity)."
    risk: read
    inputs_schema:
      properties:
        status: { type: string, description: "Status filter (OPEN, IN_PROGRESS, RESOLVED, REJECTED)" }
        severity: { type: string, description: "Severity filter (CRITICAL, HIGH, MEDIUM, LOW, INFORMATIONAL)" }
        first: { type: number, description: "Max issues (default 20)" }
      required: []
    outputs_schema: { properties: {} }
  - id: get_issue
    name: wiz-get-issue
    description: "Get a single issue by ID."
    risk: read
    inputs_schema:
      properties:
        issue_id: { type: string, description: "Issue ID" }
      required: [issue_id]
    outputs_schema: { properties: {} }
  - id: update_issue_status
    name: wiz-update-issue-status
    description: "Update an issue's status (e.g. resolve or reject)."
    inputs_schema:
      properties:
        issue_id: { type: string, description: "Issue ID" }
        status: { type: string, description: "OPEN, IN_PROGRESS, RESOLVED, or REJECTED" }
        note: { type: string, description: "Optional note" }
      required: [issue_id, status]
    outputs_schema: { properties: {} }
  - id: list_vulnerabilities
    name: wiz-list-vulnerabilities
    description: "List vulnerability findings."
    risk: read
    inputs_schema:
      properties:
        severity: { type: string, description: "Severity filter (CRITICAL, HIGH, MEDIUM, LOW)" }
        first: { type: number, description: "Max findings (default 20)" }
      required: []
    outputs_schema: { properties: {} }
  - id: list_cloud_resources
    name: wiz-list-cloud-resources
    description: "Search cloud resources by a text query."
    risk: read
    inputs_schema:
      properties:
        search: { type: string, description: "Free-text search over resource names" }
        first: { type: number, description: "Max resources (default 20)" }
      required: []
    outputs_schema: { properties: {} }

  - id: test_connection
    name: wiz-test-connection
    description: "Verify the token exchange and GraphQL access (used by the Test button)."
    risk: read
    inputs_schema:
      properties: {}
      required: []
    outputs_schema: { properties: {} }