# Wiz Adapter

The Wiz adapter translates Wiz API issue records to the normalized ACDL
[`PolicyCheckResult`](../../schemas/policy_check_result.schema.json) schema
(engine: `"wiz"`), mirroring the Checkov adapter pattern.

## What Wiz is

[Wiz](https://www.wiz.io/) is a cloud security SaaS platform that
continuously scans CSPM / CWPP / KSPM findings across AWS, Azure, GCP and
Kubernetes. It exposes a GraphQL/REST API for fetching issue records.

## Adapter behaviour

`wiz_adapter.py <wiz_issues.json> <contract-id>` reads a JSON file of Wiz
issue records (the shape returned by the Wiz `issues` GraphQL query /
list endpoint) and emits a list of `PolicyCheckResult` dicts:

| Wiz field        | PolicyCheckResult field                                   |
|------------------|------------------------------------------------------------|
| `id` / `control.id` | `ruleId`                                               |
| `severity`       | `severity` (mapped `CRITICAL/HIGH/MEDIUM/LOW/INFO`)        |
| `status`         | `result` (`OPEN→fail`, `RESOLVED→pass`, `IN_PROGRESS/DISMISSED→skipped`) |
| `title` / `control.name` | `message`                                            |
| `entity.id`      | `resourceRef` + `evidence.resource`                       |
| `entity.{name,cloudPlatform,subscriptionId}` | `evidence.*`                |

The adapter is read-only against a local JSON fixture; the pipeline is
responsible for fetching from Wiz (when configured) and writing the file.

## Offline / degraded behaviour (D-052)

When Wiz is not configured the pipeline passes an empty issues payload (or
simply does not invoke the adapter). The adapter degrades gracefully:

- an empty `issues` list → the adapter emits a single `WIZ_NOT_CONFIGURED`
  `PolicyCheckResult` with `result: "skipped"` so the confidence policy
  input stays non-empty (and does not falsely inflate the score).

`is_configured()` returns `True` only when the `WIZ_API_TOKEN`
environment variable is set; the pipeline uses it to decide whether to
fetch and invoke the adapter at all.

## Configuration

| Env var          | Required | Purpose                                          |
|-----------------|----------|--------------------------------------------------|
| `WIZ_API_TOKEN`  | yes      | Bearer token for the Wiz REST API. When unset, `is_configured()` returns `False`. |
| `WIZ_ENDPOINT`   | no       | Wiz API endpoint (defaults to `https://api.wiz.io` when implemented). |

## Schema path

The output records validate against
[`schemas/policy_check_result.schema.json`](../../schemas/policy_check_result.schema.json)
(`engine: "wiz"` was added to the enum in Phase 23).