ServiceNow

ServiceNow

This connector calls the REST APIs of one ServiceNow instance (https://<instance>.service-now.com/api): the Table API (/now/table/{table}) for incidents, change requests, problems, requests and requested items, knowledge articles, users, groups and any other table, the Aggregate API (/now/stats) for counts, the Service Catalog API (/sn_sc/servicecatalog) for ordering, the CMDB Instance API (/now/cmdb/instance) for a configuration item with its relationships, and the Attachment API. It works on every release and edition, including free personal developer instances.

Setup (about 10 minutes, by a ServiceNow admin)

1. Create an integration user: User Administration, Users, New. Give it a user ID and a strong password, tick Web service access only (it cannot log in to the UI), and leave Password needs reset unticked.
2. Give it the roles the work needs:
   • itil: read and write incidents, problems, change requests, requests, requested items and catalog tasks, and read the CMDB (the CMDB Instance API requires itil).
   • Knowledge: published articles are readable by the users the knowledge base's user criteria allow; knowledge is needed only to write articles.
   • snc_platform_rest_api_access: grant it when your instance restricts REST access to that role (REST API access policies); without the restriction it changes nothing.
   • rest_api_explorer is not needed for this connector; it only opens the REST API Explorer in the UI, which is handy for an admin to try a call.
   • For a read-only connector give snc_read_only together with itil: every write is then refused by the instance. Do not use admin.
3. Access is still decided by ACLs: a user with itil sees and changes what the instance's ACLs allow, and records it may not read are silently left out of lists rather than refused. If a list is unexpectedly empty, check the ACLs and the domain (domain separation) of the integration user.
4. In AnythingMCP set SERVICENOW_INSTANCE to the instance name only (dev123456 for https://dev123456.service-now.com), SERVICENOW_USERNAME and SERVICENOW_PASSWORD, and install. The install check lists one incident.

OAuth instead of a password: on the instance open System OAuth, Application Registry, New, Create an OAuth API endpoint for external clients, set the redirect URL to <your AnythingMCP URL>/api/mcp-oauth/callback (on AnythingMCP Cloud: https://cloud.anythingmcp.com/api/mcp-oauth/callback) and save. In AnythingMCP open the connector, switch Authentication to OAuth 2.0, enter the client ID and secret, authorization URL https://<instance>.service-now.com/oauth_auth.do and token URL https://<instance>.service-now.com/oauth_token.do, save and click Authorize with Provider. Whoever signs in is then the ServiceNow user for everyone using the connector, with that user's roles. ServiceNow's refresh tokens last 100 days by default (Refresh Token Lifespan on the registry); authorize again when they expire. Accounts with multi-factor sign-in must use OAuth, because Basic auth cannot answer the second factor.

Encoded queries (query parameters, sysparm_query): conditions joined with ^ (AND) and ^OR, e.g. active=true^priority=1^assignment_group.name=Service Desk^ORDERBYDESCsys_updated_on. Operators: =, !=, LIKE, STARTSWITH, IN, ISEMPTY, ISNOTEMPTY, <, >, >=. Dates: opened_at>=javascript:gs.daysAgoStart(7). Dot-walking follows references ([email protected]). The easiest source is the UI: filter a list, right-click the breadcrumb, Copy query.

Values: with display_value true (default) results show labels and names; writes take stored values (state 2, sys_ids) unless input_display_value is true. Codes on a standard instance (check servicenow_list_choices when unsure, instances customise them):

• Incident state: 1 New, 2 In Progress, 3 On Hold (needs hold_reason), 6 Resolved, 7 Closed, 8 Canceled. impact and urgency: 1 High, 2 Medium, 3 Low; priority (1 Critical to 5 Planning) is calculated from them.
• Resolving (6) and closing (7) need close_code (Resolution code) and close_notes (Resolution notes); servicenow_resolve_incident and servicenow_close_incident send them. Resolved incidents close automatically after 7 days by default; a closed incident is read-only.
• Change request state: -5 New, -4 Assess, -3 Authorize, -2 Scheduled, -1 Implement, 0 Review, 3 Closed, 4 Canceled; type normal, standard, emergency.
• Problem state: 101 New, 102 Assess, 103 Root Cause Analysis, 104 Fix in Progress, 106 Resolved, 107 Closed.
• Requested item (RITM) state: -5 Pending, 1 Open, 2 Work in Progress, 3 Closed Complete, 4 Closed Incomplete, 7 Closed Skipped. Request (REQ) request_state: requested, in_process, closed_complete, closed_incomplete, closed_cancelled, closed_rejected.
• Knowledge workflow_state: draft, review, published, pending_retirement, retired, outdated.

Tools

• Incidents: servicenow_list_incidents, servicenow_get_incident (by number, gives the sys_id), servicenow_create_incident, servicenow_update_incident, servicenow_add_note (work note or customer comment on any task record), servicenow_resolve_incident, servicenow_close_incident.
• Changes: servicenow_list_change_requests, servicenow_get_change_request, servicenow_create_change_request, servicenow_update_change_request.
• Problems: servicenow_list_problems, servicenow_get_problem, servicenow_create_problem, servicenow_update_problem.
• Service catalog: servicenow_list_requests (REQ), servicenow_list_requested_items (RITM), servicenow_get_requested_item, servicenow_get_requested_item_variables (the answers of the order form), servicenow_search_catalog_items, servicenow_get_catalog_item, servicenow_order_catalog_item.
• Knowledge: servicenow_search_knowledge, servicenow_get_knowledge_article.
• People: servicenow_find_users, servicenow_find_groups, servicenow_list_group_members.
• CMDB: servicenow_find_configuration_items, servicenow_get_configuration_item (with relationships).
• Any table: servicenow_query_table, servicenow_get_record, servicenow_count_records, servicenow_list_choices, servicenow_update_record, servicenow_delete_record.
• Attachments: servicenow_list_attachments.

Safety: every tool that writes says so; show the user what will change and get a yes first. Customer comments (comments) are usually e-mailed to the caller. servicenow_delete_record installs switched off. Writes run the instance's business rules, workflows, SLAs and notifications exactly like a change in the UI, under the integration user's name; to record who asked, add it to the work note.

Paging and limits: lists return limit records (default 20, up to 1000 per call) and the total in _headers.x-total-count; ask for the next page with offset. Keep fields narrow: a full incident has more than 80 fields. ServiceNow may rate-limit REST calls per user (429); wait and retry once.

Common errors

• 401 User is not authenticated or User Not Authenticated: wrong user name or password, the user is locked out or inactive, or (OAuth) the token expired and must be authorized again.
• 403 Failed API level ACL Validation or Insufficient rights: the user lacks the role or ACL for that table or API, or the REST access policy blocks it.
• 404 No Record found: the sys_id does not exist in that table, or the ACLs hide it. A wrong table name answers 400 Invalid table.
• A personal developer instance that sleeps answers with a wake-up page instead of data: open it once in the browser at developer.servicenow.com. Instances unused for some days are released and their name stops resolving.

Custom domains: an instance served under its own host name (or servicenowservices.com) needs its base URL changed in the connector settings to https://<host>/api.