> ## Documentation Index
> Fetch the complete documentation index at: https://zeropath.com/docs/llms.txt
> Use this file to discover all available pages before exploring further.

# UVM Integration

> Push ZeroPath scanner results to Wiz Universal Vulnerability Management

## Overview

ZeroPath can push scanner results directly to Wiz Universal Vulnerability Management (UVM), allowing you to view and manage ZeroPath findings alongside your other Wiz security data.

## Prerequisites

Before setting up UVM integration, ensure you have:

* Wiz UVM enabled in your Wiz account
* The necessary Wiz API permissions (see [Required Permissions](#required-permissions))

### Enabling Wiz UVM

If Wiz UVM is not already enabled on your account:

1. Navigate to your Wiz dashboard
2. Go to **Settings → Preview & Migration Hub**
3. Enable **Universal Vulnerability Management (UVM)**

## How It Works

Once configured, ZeroPath automatically uploads scanner results to your Wiz UVM dashboard:

1. ZeroPath scans your repositories and identifies security findings
2. Both SAST and SCA findings are formatted for Wiz UVM compatibility
3. Results are automatically pushed to your Wiz instance, with repository and commit links pointing to the correct host (including GitHub Enterprise Server instances)
4. View and manage findings in your Wiz UVM interface

### Severity Ratings

For SAST, IaC, and secrets findings, the severity shown in Wiz depends on whether ZeroPath has assessed the finding:

* **Assessed findings** carry the composite rating shown on the ZeroPath dashboard (impact multiplied by exploitability confidence). Findings rated informational on that composite scale are not exported.
* **Unassessed findings** — those where no ZeroPath validator has produced an exploitability confidence — are always exported. They carry ZeroPath's pre-validation severity estimate for the detected vulnerability class, banded on the standard CVSS scale. Their description in Wiz explicitly states that ZeroPath has not assessed the finding and that the severity shown is an impact estimate, not a confirmation that the issue is exploitable. Omitting these findings would incorrectly mark them as resolved in your Wiz tenant, since Wiz treats absence from an upload as resolution.
* **SCA findings** carry CVSS-based severity ratings.

If a scan produces SCA findings but no SAST findings (for example, when all SAST findings are filtered by score or policy), the SCA results are still exported to Wiz. When all findings in a category have been resolved, enriched into Wiz-native findings, or otherwise removed, ZeroPath sends an empty replacement to the corresponding Wiz data source to resolve any previously exported copies — this keeps your Wiz dashboard free of stale ZeroPath findings.

The uploaded results appear in your Wiz UVM dashboard, allowing you to:

* View ZeroPath findings alongside other Wiz security data
* Use Wiz's workflow and remediation features
* Correlate application security findings with infrastructure context

## Required Permissions

For UVM integration, your Wiz API credentials need:

```
create:external_data_ingestion
read:system_activities
read:sast_findings
read:iac_configuration_finding
read:vulnerabilities
```

These permissions allow ZeroPath to:

* Upload scanner results to Wiz UVM (`create:external_data_ingestion`)
* Verify upload status (`read:system_activities`)
* Enrich the findings your Wiz-native scanners already track instead of adding a second copy —
  `read:sast_findings` for SAST, `read:iac_configuration_finding` for IaC, and
  `read:vulnerabilities` for SCA

The enrichment read scopes are **optional** for exporting findings. SAST and IaC enrichment
require **both** `read:sast_findings` and `read:iac_configuration_finding`: if either is missing,
both categories are exported as separate ZeroPath findings. SCA enrichment is independent and
requires `read:vulnerabilities`.

## Troubleshooting

### Scanner Results Not Appearing in Wiz

* **Verify UVM is enabled**: Confirm that Wiz UVM is active in Settings → Preview & Migration Hub
* **Check API permissions**: Ensure your Wiz API credentials have the `create:external_data_ingestion` permission
* **Review integration status**: Check the integration status in ZeroPath settings to ensure the connection is active
* **Check for sync delays**: Results may take a few minutes to appear in Wiz after a scan completes

### Upload Errors

* **Verify API endpoint**: Ensure the Wiz API endpoint is correctly configured in your integration settings
* **Check credentials**: Confirm your Client ID and Client Secret are valid and have not expired
* **Review rate limits**: If you're uploading large volumes of findings, you may encounter Wiz API rate limits. Rate-limited uploads are reported separately from failures in your scan logs — the log message will indicate "rate-limited" rather than "failed", and the findings will be exported on the next scan


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.