Breadcrumbs

JSON Web Token Authentication

Last Updated: October 23, 2026

JSON Web Token (JWT) enables authentication by encoding claims within a digitally signed token, ensuring secure validation of user identity and permissions. Follow the steps in this article to send a JWT-encoded request in Postman.

Prerequisites

How to Enable JWT Webhook Authentication on D3 vSOC *

  1. Open the Web Config settings.

    wc-01-web-config.png

    1. Go to Global Settings.

    2. Select Application Settings.

    3. Select Web Config (under Feature Settings).

The EnableEnhanceWebhookAuthentication key in Web Config with its True and False options

  1. Set the EnableEnhanceWebhookAuthentication radio option to True.

  2. Select Save, which appears at the top of the panel after the change.

  • Ability to set up D3 webhook keys

Setting Up JWT Remote Command Keys for Data Ingestion *

  1. Establish a connection between D3 vSOC and the integration. On the integration's page, the connection must be switched on under Active and show the Passed status, as shown in the image below.

    The Wiz integration page with its connections, their Passed status and Active switch, and its commands

    Ensure the connection is shared with a specific site (the Site Name column), not only with all internal or client sites.

  2. In Configuration > Integrations, open the integration's event or incident intake command, such as Fetch Event.

  3. On the command's Settings tab, under WEBHOOK AUTHENTICATION, make sure API Key & JWT is switched on.

From this point, users can configure their JWT through either the Integrations module or the Data Ingestion module.

Setting Up JWT from the Integrations Module

  1. Select JSON Web Token (JWT).

    The WEBHOOK AUTHENTICATION section of an integration command, with the API Key and JWT switch and the API Key and JSON Web Token (JWT) options

  2. Set up the JWT in the window that opens.

    Group 30 (1).png

    1. Click the + button in the INTERNAL SITES or CLIENT SITES section.

    2. Select the Site to be used for the data ingestion job.

    3. Enter a unique Key Name.

    4. Click the Generate button.

The user will see a display similar to the following:

Group 31 (1).png

READER NOTE

If users click the + button in the ALL SITES section, then select Shared to All Internal Sites or Shared to All Client Sites for the Site field, the JWT will be shared with all corresponding sites. However, users must still select a specific site for data ingestion.

Group 37 (1).png
Users can add a JWT to share with all internal or client sites by clicking the + button in the ALL SITES section.

Group 36 (1).png
The Site field can be set to either Shared to All Internal Sites or Shared to All Client Sites.

Group 32 (1).png
The internal_jwt JWT is shared with all internal sites, but users must still select a specific internal site for data ingestion.

Group 33 (1).png
The client_jwt JWT is shared with all client sites, but users must still select a specific client site for data ingestion.

Setting Up JWT from the Data Ingestion Module

  1. Go to Configuration > Data Ingestion.

    The New menu on the Data Ingestion page with Schedule and Webhook

  2. Select New > Webhook.

  3. Configure the webhook data source.

    The New Webhook Data Source window with an integration and site chosen, JSON Web Token (JWT) selected under Authentication Method, and the JWT Keys panel with Generate a Key

    1. Select the integration to use, such as Wiz.

    2. Choose the Site into which the data will be ingested.

    3. Under Authentication Method, select JSON Web Token (JWT).

    4. Under JWT Keys, select Generate a Key.

  4. Enter a unique key name, optionally switch on Visible to All (Allow all users to view the key), then select Generate.

    di-wh-jwt-generate.png

The user will see a display similar to the following:

Group 40.png
Setting Up JWT Remote Command Keys for Integration Commands *

  1. Establish a connection between D3 vSOC and the integration. On the integration's page, the connection must be switched on under Active and show the Passed status, as shown in the image below.

    The Wiz integration page with its connections, their Passed status and Active switch, and its commands

    Ensure the connection is shared with a specific site (the Site Name column), not only with all internal or client sites.

  2. Select the desired integration command.

    For demonstration purposes, the Get Computers command will be used.

  3. On the command's Settings tab, under WEBHOOK AUTHENTICATION, make sure API Key & JWT is switched on, then select the JSON Web Token (JWT) button.

    The WEBHOOK AUTHENTICATION section of an integration command, with the API Key and JWT switch and the API Key and JSON Web Token (JWT) options

  1. Set up the JWT in the Setup JWT window.

    Frame 17.png

    1. Select + in the Remote Command section of the Setup JWT window.

    2. Select the connection created from step 1.

    3. Enter a unique Key Name.

    4. Select Add.

The user will see a display similar to the following:

Group 25 (1).png
Setting Up JWT Remote Command Keys for Utility Commands *

  1. On the command's Settings tab, under WEBHOOK AUTHENTICATION, make sure API Key & JWT is switched on, then select the JSON Web Token (JWT) button.

    The WEBHOOK AUTHENTICATION section of a utility command, with the API Key and JWT switch and the API Key and JSON Web Token (JWT) options

  1. Set up the JWT in the Setup JWT window.

    Frame 19.png

    1. Select + in the Remote Command section of the Setup JWT window.

    2. Enter a unique Key Name.

    3. Select Add.

The user will see a display similar to the following:

Group 24.png

READER NOTE

Each JWT Remote Command Key will have a unique Secret Key value used in generating the JWT encoding.

Setting Up and Sending a JWT-Encoded Request: Data Ingestion

Users can send an JWT-authenticated request to push data into D3 using the webhook data ingestion method to create D3 events.

READER NOTE

For clarity, the example below demonstrates how to send an JWT-authenticated request using Postman. However, this approach is intended only for testing purposes. In typical use cases, webhook ingestion is handled automatically through external software or scripts.

  1. Copy the request URL in vSOC.

    Group 23 (1).png

  2. In Postman, set the HTTP request method to POST, then paste the request URL in the designated field.

    Group 24 (2).png

  3. In vSOC, copy the request header key.

    Group 42 (1).png

  4. In Postman, click on the Headers tab, then paste the request header key under the Key column.

    Group 26 (1).png

  5. In vSOC, copy the object from the Header section.

    Group 45.png

  6. In jwt.io, click the JWT Encoder tab, then paste the object into the HEADER field.

    Group 46.png

  7. Remove the placeholder content within the curly braces to make the payload an empty object.

    Group 48.png

  8. In vSOC, copy the Secret Key.

    Group 47.png

  9. In jwt.io, paste the Secret Key, then copy the JSON web token.

    Group 49 (1).png

  10. In Postman, paste in the token under the Value column for the d3jwt key.

    Group 50.png

  11. Select the Body tab, choose the raw option, then paste sample request body data.

    Group 35.png

READER NOTE*

The request body data is derived from the raw sample available under the Outputs > Raw Data tab of Wiz’s Fetch Event command. Any D3 events created using this data are not real security events.

Group 36.png

Users can treat this as a template for structuring data pushed into D3 to create D3 events, specifically for Wiz’s Fetch Event command. For example, this demonstrates that the main event JSON path is data.nodes, which means that event data from Wiz should be within that path.

  1. Click the Send button to send the request.

    Group 51.png

RESULT

If the request is successful and the conditions for event creation are met, the ingested event can be viewed in D3 by going to Configuration > Data Ingestion and selecting the webhook card under the integration (for example, Wiz).

Setting Up and Sending a JWT-Encoded Request: Remote Command

  1. Copy the request URL in vSOC.

    Group 54.png

  2. In Postman, set the HTTP request method to POST, then paste the request URL in the designated field.

    Group 55.png

  3. In vSOC, copy the request header key.

    Group 3 (1).png

  4. In Postman, click on the Headers tab, then paste the request header key under the Key column.

    Group 4.png

  5. In vSOC, copy the object from the Header section.

    Group 56.png

  6. In jwt.io, click the JWT Encoder tab, then paste the object into the HEADER field.

    Group 57.png

  7. In vSOC, copy the payload.

    Group 59.png

  8. In jwt.io, paste the payload into the PAYLOAD field.

    Group 60.png

  9. Populate the PAYLOAD fields. For this demonstration, the completed payload is as follows:

    Group 61.png

READER NOTE*

  • Ensure the value of the payload's Username field matches the username of the user being granted access to the remote command key (user10 in this case).

    Group 62.png

    • By default, the creator is the only individual with access.

  • All payload data are case-sensitive.

  1. In vSOC, copy the Secret Key.

    Group 63.png

  2. In jwt.io, paste the Secret Key.

    Group 64.png

  3. In vSOC, copy the request body sample data.

    Group 65.png

  4. In Postman, select the Body tab, choose the raw option, then paste the sample request body data.

    Group 66.png

  5. Modify the highlighted request body values to match the payload precisely.

    Group 70.png

  6. In jwt.io, copy the encoded token.

    Group 71.png

  7. In Postman, click on the Headers tab, paste in the token, then send the request.

    Group 72.png

RESULT

A successful request will have the 200 OK status and valid return data with no errors.

Group 73 (1).png

Encoding Using an External Script

Users who prefer to perform JWT encoding outside a browser may do so using a script, provided they have access to the following:

  • A code editor, such as VS Code

  • Python installed on their device

  • Pip for installing Python packages

Use the following instructions to perform JWT encoding in a script.

  1. Create a new file in VS Code to contain the script.

  2. Copy and paste the code below in the file.

    Python
    import jwt  # Import the PyJWT library for encoding JSON Web Tokens

# Define the payload – this is the data that must be included in the token
payload = {
    "Timestamp": "",
    "Site": "",
    "Username": ""
}

# Define the JWT header – this specifies the algorithm and token type
jwt_header = {
    "alg": "HS256",
    "kid": "",
    "typ": "JWT"
}

# Secret key used to sign the token – must be known to both sender and receiver
secret_key = "a-string-secret-at-least-256-bits-long"

# Generate the JWT using the payload, secret key, and algorithm
jwt_token = jwt.encode(payload, secret_key, algorithm="HS256", headers=jwt_header)

# Convert to string if the result is in bytes (needed for older versions of PyJWT)
if isinstance(jwt_token, bytes):
    jwt_token = jwt_token.decode('utf-8')

# Output the signed JWT string
print(jwt_token)

  3. Open a new terminal and paste the command below to use pip to install the pyjwt package required for JWT encoding:

    pip install pyjwt

    Refer to PyJWT 2.10.1 documentation for more information.

  4. Copy the JWT header in vSOC and replace the jwt_header object in the script.

    replaceheader.gif

  5. Copy the payload from vSOC and replace the payload object in the script.

    replacepayload.gif

  6. Update the payload with the correct site and username to match the request body in Postman.

    Group 74.png

    The username in both the request body and payload must match the user being granted access to the remote command key.

    Group 75.png

  7. (Optional) Adjust the value of the Timestamp field in the script.

    Group 76.png

  8. Copy the secret key from vSOC and replace the secret_key value in the script.

    replacesecretykey.gif

  9. Click the down arrow beside the Group 78.png button in VS Code and select the Run Python File in Dedicated Terminal option.

    Group 77.png

  10. Once executed, copy the encoded JWT value printed in the terminal and paste it into Postman as the value for the d3jwt header key.

    Group 83 (1).png