---
title: "Search Wiz network exposures"
method: POST
path: "/api/v2/integrations/searchWizExposures"
tags: ["Integrations"]
---

# Search Wiz network exposures

`POST /api/v2/integrations/searchWizExposures`

## Request

- Base URL: `https://zeropath.com`
- URL: `https://zeropath.com/api/v2/integrations/searchWizExposures`
- Auth: API key in header `X-ZeroPath-API-Token-Id` and API key in header `X-ZeroPath-API-Token-Secret`

Find live Wiz network-exposure findings whose exposed entity name matches a substring (e.g. 'payments-api'). Defaults to `PUBLIC_INTERNET` exposures — the most common operator question is "what's reachable from the internet?". Wiz's network-exposure API does not accept project-scoped filters, so the search runs across the customer's whole Wiz tenant and filters by name server-side; bounded to a fixed-page scan with a `truncated` flag when more matches likely exist. Use to answer "what's exposed on host X?" or to investigate a SAST finding's live cloud blast radius. For pre-computed exposure data already attached to a ZeroPath finding, prefer `issues.get` (which returns `wizExposure.exposedURIs`).

## Request body

- WizSearchExposuresRequest
  - `organizationId` string: Organization whose Wiz credentials are used to query exposures. The official ZeroPath MCP server injects this from `ZEROPATH_ORG_ID` when configured.
  - `entityName` string, required: Case-insensitive substring matched against the name of each exposure's exposed entity (e.g. 'payments-api', 'redis-prod').
  - `exposureType` string[]: Optional Wiz network-exposure type filter. Defaults to ['PUBLIC_INTERNET'] which is the most common operator-relevant case.
  - `limit` integer: Maximum number of matching exposures to return. Defaults to 20.

## Response `200`

Matching Wiz network exposures.

- WizSearchExposuresResponse
  - `exposures` WizNetworkExposure[], required
    - `id` string, required
    - `exposedEntity` WizExposureEntity, required
      - `id` string, nullable, required
      - `name` string, nullable, required
      - `type` string, nullable, required
    - `sourceIpRange` string, nullable, required
    - `destinationIpRange` string, nullable, required
    - `portRange` string, nullable, required
    - `protocols` string[], required
    - `firstSeenAt` string, nullable, required
    - `type` string, required: Wiz exposure type (e.g. PUBLIC_INTERNET).
  - `truncated` boolean, required: True when Wiz had more matching exposures than the bounded server-side scan could examine; refine the entityName filter for more precise results.
  - `reason` 'ok', required: Always `ok` when the call succeeded; absence of matches is returned as an empty `exposures` array.

## Other responses

- `400`: Error Response
- `401`: Error Response
- `404`: Error Response

---

[API](https://skmtc.dev/zeropath/apis/zeropath-api.md) - [All operations](https://skmtc.dev/zeropath/apis/zeropath-api/llms.txt) - [OpenAPI document](https://skmtc.dev/zeropath/apis/zeropath-api/revisions/126e9c80ba0d?raw)