docs(gcp-wif): add Cloud Asset API enablement as required step

cloud/integrations.mdx

@@ -18,7 +18,7 @@
   <Card title="Webhook" icon="webhook" href="#webhook">
 
   </Card>
   <Card title="Jira" icon="jira" href="#jira">
 
   </Card>
   <Card title="GitHub" icon="github" href="#github">
@@ -48,7 +48,7 @@
   <Card title="Cloudflare" icon="cloudflare" href="#cloudflare">
 
   </Card>
   <Card title="Fastly" icon="bolt" href="#fastly">
 
   </Card>
   <Card title="DigitalOcean" icon="digital-ocean" href="#digitalocean">
@@ -188,7 +188,7 @@
   },
 
   "finished": null,
   "failed_stopped": null
 }
 ```
 
@@ -276,8 +276,8 @@
     - `medium` — Medium severity count
     - `low` — Low severity count
     - `info` — Info severity count
   - `rescan_new_vulnerabilities` — New vulns since last scan, rescans only (integer)
   - `rescan_vulns_list` — List of new vulnerabilities, **max 15 items**, rescans only (array)
     - `Name` — Vulnerability name/title
     - `Severity` — Severity level (critical, high, medium, low, info)
     - `Count` — Number of instances found
@@ -385,7 +385,7 @@
     <Accordion title="Enumeration Finished" icon="circle-check">
 
 <Info>
 **Trigger:** When asset disocvery completes successfully
 
 **Type:** `finished`
 </Info>
@@ -442,7 +442,7 @@
   - `total_assets` — Total number of assets in inventory (integer)
   - `new_assets` — Number of newly discovered assets (integer)
   - `new_assets_list` — Details of newly discovered assets (array)
     - `host` — Hostname or domain name
     - `port` — Port number
     - `ip` — List of IP addresses associated with the host (array of strings)
   </Accordion>
@@ -506,7 +506,7 @@
 
 **Type:** `new_vuln`
 
 **Note:** This event is only triggered for rescans when comparing against previous results
 </Info>
 
 ```json New Vulnerability Alert Payload
@@ -575,7 +575,7 @@
 </Tip>
 
 <Note>
 If you configured severity filters (e.g., only Critical and High), only new vulnerabilities matching those severities will trigger this event and be included in the `rescan_vulns_list`.
 </Note>
     </Accordion>
 
@@ -586,7 +586,7 @@
 
 **Type:** `new_asset`
 
 **Configuration:** Can be enabled for disocvery, scan, or both based on your alerting configuration
 </Info>
 
 ```json New Asset Alert Payload
@@ -651,7 +651,7 @@
   - `total_assets` — Total number of assets in your inventory (integer)
   - `new_assets` — **Number of NEWLY discovered assets** (integer)
   - `new_assets_list` — **List of NEWLY discovered assets only** (array)
     - `host` — Hostname or domain name
     - `port` — Port number
     - `ip` — List of IP addresses associated with the host (array of strings)
   </Accordion>
@@ -667,7 +667,7 @@
 
 ## Ticketing Integrations
 
 The integrations under Ticketing support ticketing functionality as part of scanning and include support for Jira, GitHub, GitLab, and Linear. Navigate to [Scans → Configurations → Ticketing](https://cloud.projectdiscovery.io/scans/configs?type=reporting) to configure your ticketing tools.
 
 <img
   height="300"
@@ -676,9 +676,9 @@
 
 ### Jira
 
 ProjectDiscovery provides integration support for Jira to create new tickets when vulnerabilities are found.
 
 Provide a name for the configuration, the Jira instance URL , the Account ID, the Email, and the associated API token.
 
 Details on creating an API token are available [in the Jira documentation here.](https://support.atlassian.com/atlassian-account/docs/manage-api-tokens-for-your-atlassian-account/)
 
@@ -689,7 +689,7 @@
 Provide a name for the configuration, the Organization or username, Project name, Issue Assignee, Token, and Issue Label. The Issue Label determines when a ticket is created. (For example, if critical severity is selected, any issues with a critical severity will create a ticket.)
 
 - The severity as label option adds a template result severity to any GitHub issues created.
 - Deduplicate posts any new results as comments on existing issues instead of creating new issues for the same result.
 
 Details on setting up access in GitHub [are available here.](https://docs.github.com/en/authentication/keeping-your-account-and-data-secure/managing-your-personal-access-tokens)
 
@@ -701,7 +701,7 @@
 (For example, if critical severity is selected, any issues with a critical severity will create a ticket.)
 
 - The severity as label option adds a template result severity to any GitLab issues created.
 - Deduplicate posts any new results as comments on existing issues instead of creating new issues for the same result.
 
 Refer to GitLab's documentation for details on [configuring a Project Access token.](https://docs.gitlab.com/ee/user/project/settings/project_access_tokens.html#create-a-project-access-token)
 
@@ -756,7 +756,7 @@
   Click here to open the AWS integration configuration page in the ProjectDiscovery Cloud platform
 </Card>
 
 ProjectDiscovery's AWS integration allows the platform to automatically discover and monitor cloud assets across your AWS accounts. By connecting AWS to ProjectDiscovery, security teams and DevOps engineers gain continuous visibility into EC2 instances, S3 buckets, DNS records, and other resources without manual inventory. This integration leverages ProjectDiscovery's open-source **Cloudlist** engine to enumerate assets via AWS APIs. In short, it helps ensure no cloud asset goes unnoticed, enabling proactive security monitoring and easier management of your attack surface.
 
 <img
   src="/images/aws-integration.png"
@@ -768,7 +768,7 @@
 
 | Service                                               | Description                                   |
 | :---------------------------------------------------- | :-------------------------------------------- |
 | [EC2](https://aws.amazon.com/ec2/)                    | VM instances and their public IPs             |
 | [Route53](https://aws.amazon.com/route53/)            | DNS hosted zones and records                  |
 | [S3](https://aws.amazon.com/s3/)                      | Buckets (especially those public or with DNS) |
 | [Cloudfront](https://aws.amazon.com/cloudfront/)      | CDN distributions and their domains           |
@@ -776,8 +776,8 @@
 | [EKS](https://aws.amazon.com/eks/)                    | Kubernetes cluster endpoints                  |
 | [ELB](https://aws.amazon.com/elasticloadbalancing/)   | Load balancers (Classic ELB and ALB/NLB)      |
 | [ELBv2](https://aws.amazon.com/elasticloadbalancing/) | Load balancers (Classic ELB and ALB/NLB)      |
 | [Lambda](https://aws.amazon.com/lambda/)              | Serverless function endpoints                 |
 | [Lightsail](https://aws.amazon.com/lightsail/)        | Lightsail instances (simplified VPS)          |
 | [Apigateway](https://aws.amazon.com/api-gateway/)     | API endpoints deployed via Amazon API Gateway |
 
 By covering these services, ProjectDiscovery can map out a broad range of AWS assets in your account. (Support for additional services may be added over time.)
@@ -1001,7 +1001,7 @@
 
 **Step 4: Grant the WIF Role AssumeRole Permission**
 
 Allow the WIF role to assume scanner roles. Use a wildcard to cover all accounts, or list specific account ARNs.
 
 ```bash
 cat > assume-scanner-policy.json <<EOF
@@ -1155,9 +1155,9 @@
 
 #### API Setup
 
 You can set up the AWS integration entirely through the API. The process involves creating a cloudlist configuration, verifying it, and then using it to create an enumeration.
 
 The cloudlist configuration is a YAML array that must be **base64-encoded** before sending it to the API. Each connection method uses a different YAML structure, but the API calls are the same.
 
 **Configuration Format**
 
@@ -1165,9 +1165,9 @@
   <Accordion title="Single AWS Account (Access Key & Secret)">
     ```yaml
     - provider: aws
       aws_access_key: "AKIAIOSFODNN7EXAMPLE"
       aws_secret_key: "wJalrXUtnFEMI/K7MDENG/bPxRfiCYEXAMPLEKEY"
       aws_session_token: "optional-session-token"
       services:
         - ec2
         - route53
@@ -1178,10 +1178,10 @@
   <Accordion title="Multiple AWS Accounts (Assume Role)">
     ```yaml
     - provider: aws
       aws_access_key: "AKIAIOSFODNN7EXAMPLE"
       aws_secret_key: "wJalrXUtnFEMI/K7MDENG/bPxRfiCYEXAMPLEKEY"
       assume_role_name: "ProjectDiscoveryReadOnlyRole"
       account_ids:
         - "123456789012"
         - "987654321098"
       services:
@@ -1194,9 +1194,9 @@
   <Accordion title="Cross-Account Role (Role ARN)">
     ```yaml
     - provider: aws
       assume_role_arn: "arn:aws:iam::123456789012:role/ProjectDiscoveryRole"
       external_id: "your-external-id"
       assume_role_session_name: "projectdiscovery_role"
       services:
         - ec2
         - route53
@@ -1240,7 +1240,7 @@
 
 **Step 2: Create the Integration**
 
 Once verified, send the base64-encoded configuration to create a cloudlist config:
 
 ```bash
 curl -X POST https://api.projectdiscovery.io/v1/scans/config \
@@ -1299,9 +1299,9 @@
 |:---|:---|
 | [Cloud DNS](https://cloud.google.com/dns) | DNS zones and records |
 | [Kubernetes Engine](https://cloud.google.com/kubernetes-engine) | GKE cluster endpoints |
 | [Compute Engine](https://cloud.google.com/products/compute) | VM instances and public IPs |
 | [Cloud Storage](https://cloud.google.com/storage) | Buckets |
 | [Cloud Functions](https://cloud.google.com/functions) | Serverless function endpoints |
 | [Cloud Run](https://cloud.google.com/run) | Container service URLs |
 
 #### Enumeration Scope
@@ -1641,11 +1641,30 @@
 <Note>
 `YOUR_PROJECT_NUMBER` is the numeric project number, not the project ID. Find it with:
 ```bash
 gcloud projects describe YOUR_PROJECT_ID --format='value(projectNumber)'
 ```
 </Note>
 
-**Step 6: Get the Provider Resource Path**
+**Step 6: Enable the Cloud Asset API**
+
+The GCP org-level integration uses the Cloud Asset Inventory API (`cloudasset.googleapis.com`) for all discovery operations. This API must be enabled in the project where you created the service account and WIF pool.
+
+```bash
+gcloud services enable cloudasset.googleapis.com --project="YOUR_PROJECT_ID"
+```
+
+To verify it is enabled:
+
+```bash
+gcloud services list \
+  --project="YOUR_PROJECT_ID" \
+  --filter="name:cloudasset.googleapis.com" \
+  --format="value(name,state)"
+```
+
+The output should show `ENABLED`. If the command returns no output, the API is not enabled — run the enable command above.
+
+**Step 7: Get the Provider Resource Path**
 
 ```bash
 gcloud iam workload-identity-pools providers describe projectdiscovery-oidc \
@@ -1660,13 +1679,13 @@
 projects/123456789012/locations/global/workloadIdentityPools/projectdiscovery-pool/providers/projectdiscovery-oidc
 ```
 
-**Step 7: Configure in ProjectDiscovery**
+**Step 8: Configure in ProjectDiscovery**
 
 In the ProjectDiscovery platform, create a new GCP integration and select **Workload Identity Federation** as the authentication method. Provide:
 
 | Field | Value |
 |---|---|
-| **Workload Identity Provider** | Full provider path from Step 6 |
+| **Workload Identity Provider** | Full provider path from Step 7 |
 | **Service Account Email** | `pd-cloudlist-reader@YOUR_PROJECT_ID.iam.gserviceaccount.com` |
 | **Organization ID** | Your numeric org ID — leave empty for project-level enumeration |
 | **Project IDs (Optional)** | Limit discovery to specific projects |
@@ -1693,7 +1712,17 @@
 
 **"Google Cloud denied access" with Organization ID set**
 
-The service account does not have permissions at the org level. Ensure all four org-level roles are granted: `roles/cloudasset.viewer`, `roles/resourcemanager.organizationViewer`, `roles/resourcemanager.folderViewer`, and `roles/browser`. See the Organization-Level tab in the [Grant Permissions](#service-account-key) step for details.
+This error can have two causes:
+
+1. **Cloud Asset API not enabled** — The Cloud Asset Inventory API must be enabled in the project where your service account and WIF pool were created (the project number is visible in your Workload Identity Provider path). Check and enable it:
+   ```bash
+   # Check (use the project number from your WIF provider path)
+   gcloud services list --project="YOUR_PROJECT_NUMBER" --filter="name:cloudasset.googleapis.com" --format="value(name,state)"
+   # Fix
+   gcloud services enable cloudasset.googleapis.com --project="YOUR_PROJECT_NUMBER"
+   ```
+
+2. **Missing org-level IAM roles** — Ensure all required org-level roles are granted. See the Organization-Level tab in the [Grant Permissions](#service-account-key) step for details.
 
 **"GCP token exchange failed"** (WIF only)
 - Verify the Workload Identity Provider path is correct (check for typos)
@@ -1855,7 +1884,7 @@
 
    - If you only need specific services, you can further reduce actions. For example:
      - Virtual machines: `Microsoft.Compute/virtualMachines/read`, plus RG/subscription reads
      - Public IPs: `Microsoft.Network/publicIPAddresses/read`
      - Traffic Manager: `Microsoft.Network/trafficManagerProfiles/read`
      - Storage Accounts: `Microsoft.Storage/storageAccounts/read`
      - AKS Clusters: `Microsoft.ContainerService/managedClusters/read`
@@ -1878,9 +1907,9 @@
 
 
 
 ### Alibaba Cloud
 
 <Card title="Configure Alibaba Cloud Integration" icon="cloud" color="#FF6A00" href="https://cloud.projectdiscovery.io/assets/configure?provider=alibaba">
   Click here to open the Alibaba Cloud integration configuration page in the ProjectDiscovery Cloud platform
 </Card>
 
@@ -1891,13 +1920,13 @@
   style={{ width:"62%" }}
 />
 
 Supported Alibaba Cloud Services:
 
 - ECS Instances
 
 **Alibaba Integration Method**
 
 This guide details the secure, best-practice method for connecting to Alibaba Cloud using a dedicated RAM user with read-only permissions.
 
 1. **Create a RAM User for API Access:**
    - Navigate to the **RAM (Resource Access Management) console**. [Ref](https://ram.console.aliyun.com/manage/ak)
@@ -1915,11 +1944,11 @@
    - Select the **System Policy** type.
    - Search for and select the `AliyunReadOnlyAccess` policy and click **OK**. This is the official, managed policy for read-only access to all cloud resources.
 4. **Find Your Region ID and Connect:**
    - Identify the **Region ID** for the resources you plan to monitor. You can find the official list in the Alibaba Cloud documentation here: [Regions and zones](https://www.alibabacloud.com/help/en/doc-detail/40654.htm) (This link lists the specific IDs required for API configuration).
    - Use the credentials you have collected to fill in the fields in ProjectDiscovery:
      - **Alibaba Region ID**: The target region, for example, `us-east-1`.
      - **Alibaba Access Key**: The AccessKey ID from Step 2.
      - **Alibaba Access Key Secret**: The AccessKey Secret from Step 2.
    - Enter a unique **Integration Name** and click **Verify**.
 
 References:
@@ -1960,8 +1989,8 @@
   - Clusters with public IP addresses
 </Note>
 
 1. **Prepare Base64-Encoded Kubeconfig**
    - Your kubeconfig file is typically located at:
 
      ```
      ~/.kube/config
@@ -1971,11 +2000,11 @@
      ```
      cat ~/.kube/config | base64
      ```
    - Paste the output into the **Kubeconfig** field in the UI.
 
      > ⚠️ Ensure the entire content is copied without extra whitespace.
 2. **Specify Context (Optional)**
    - If your kubeconfig has multiple contexts, find them with:
 
      ```
      kubectl config get-contexts
@@ -1994,7 +2023,7 @@
 
 If your Kubernetes integration fails, the most common cause is cluster accessibility:
 
 - **Internal Clusters**: Clusters only accessible within private networks (VPN, internal VPCs) cannot be reached by ProjectDiscovery
 - **Firewall Restrictions**: Ensure your cluster's API server and services are accessible from the internet
 - **Network Policies**: Check that network policies allow external access to required endpoints
 - **Load Balancer Configuration**: Verify that external load balancers are properly configured and accessible
@@ -2025,7 +2054,7 @@
 - DNS and CDN assets
 
 <Note>
   Connecting a Cloudflare integration also enables **origin IP exposure** detection under [Misconfigurations](/api-reference/enumerations/list-enumeration-misconfigurations). When a hostname from your asset inventory resolves to the same IP as the origin behind one of your proxied Cloudflare records, it is flagged as an origin exposure finding.
 </Note>
 
 **Cloudflare Integration Methods:**
@@ -2064,7 +2093,7 @@
 
 ### Fastly
 
 <Card title="Configure Fastly Integration" icon="bolt" color="#FF282D" href="https://cloud.projectdiscovery.io/assets/configure?provider=fastly">
   Click here to open the Fastly integration configuration page in the ProjectDiscovery Cloud platform
 </Card>
 
@@ -2075,16 +2104,16 @@
   style={{ width:"65%" }}
 />
 
 **Fastly Integration Method**
 
 - Go to Fastly [account settings](https://manage.fastly.com/account/personal).
 - Under **API**, click **Create API token** if you don’t already have one.
 - Copy the API Key.
 - Now enter API Key in ProjectDiscovery Cloud Platform.
 - Give a unique Integration name and click **Verify**.
 
   <Tip>
     Tip: In Fastly's documentation and interfaces, "API Key" and "API Token" refer to the same thing. You can use the terms interchangeably throughout this guide.
   </Tip>
 
 References: