servicenow v1.0.0

The pack names a reference, never a secret. Installing a pack registers capabilities and makes them governable; registration is not connectivity. The credential is created at the provider and held in the client's own secret manager under the reference the pack names, and deployment testing is still required to show the credential path works and cannot be bypassed.

Reference

secret-ref-servicenow-oauth-token

Custody

customer_vault

Injection

header (Authorization)

An OAuth2 access token for the customer's own ServiceNow instance, held in the client's own secret manager. The stored material must be the complete Authorization header value (scheme included): 'Bearer ' followed by the access token. An external deployment process obtains the token from the instance and renews it when it expires — storing the OAuth client credentials under this reference does not make the HTTP injector perform OAuth: the injector injects the stored value verbatim, so refresh ownership (including any refresh-token grant the deployment chooses to use) sits entirely with that external process. Access tokens expire and can be revoked at the instance; an expired or revoked value fails closed. The token's access is the token user's access — grant the user the minimum roles (for example itil for the incident and change tables) that make these capabilities work, and nothing more. Executor hygiene: the value must live only in executor memory for the lifetime of a call, must never be written to logs, traces or diagnostics, and must not appear in crash dumps; a deployment that cannot meet that bar must not enable the pack.

• servicenow-instance (api, pii): https://servicenow-instance.invalid/api/now

The endpoint host 'servicenow-instance.invalid' is a reserved non-production placeholder (an RFC 2606 reserved TLD): substitute the customer's instance host before enabling, in every endpoint, in the resource locator and in every egress allowlist entry. The allowlist matches exactly, so endpoints and allowlist must be substituted together, and substitution is a required deployment step — the reserved host being allowlisted does not make an unsubstituted pack safe to enable. The pack does not create the OAuth application or mint tokens: an external deployment process registers the OAuth client with the instance admin, obtains access tokens from the customer's own instance, and stores and renews the complete header value described in the credential note. The Table API enforces the calling user's ACLs and roles, so a capability works only if the token's user (for example an itil user) is permitted the operation; the registration records the endpoint, not the instance's authorization decision. Removed capability, as a documented exclusion: servicenow.change_request.approve. Approving a change request by PATCHing the record's approval field was considered and removed — the retrieved Table API documentation establishes PATCH /now/table/{tableName}/{sys_id} as a generic name-value update but does not establish that setting the change_request record's approval field performs a workflow approval; change approvals run through approval records and the Change Management REST API's approval operation, each a different registration requiring its own review, and this pack registers neither. Nothing in this pack approves a change. Further documented exclusions, from the retrieved Table API documentation: DELETE /now/table/{tableName}/{sys_id} exists in the API and is deliberately not registered — a supported review outcome is removing what the integration is not ready for, and incident or change deletion is not part of this pack; PUT /now/table/{tableName}/{sys_id} also exists, and only PATCH is registered for updates; POST inserts one record per call — multiple-record insertion is not supported by the Table API. The Attachment API, Stats API, Import Set API and Service Catalog API (order_now) are separate ServiceNow APIs this pack does not register — reading sc_cat_item returns catalog content and orders nothing. AAES has not been certified by ServiceNow; the endpoints here are a reviewable default, not a vendor guarantee.

Review completed: 2026-09-21 · Reviewer: aaes-eng (an opaque id that resolves internally to the responsible reviewer)

• https://www.servicenow.com/docs/bundle/zurich-api-reference/page/integrate/inbound-rest/concept/c_TableAPI.html (retrieved 2026-09-21)

A pack review is not a vendor or examiner attestation. A retrieval date says when a source page was read; it does not by itself establish what the page said then. No pack is vendor-endorsed, and none has been connectivity-tested against a live vendor tenant.