Skip to content

guides

Intended Documentation

ServiceNow Connector Setup (Beta)

Connect Intended to ServiceNow. Create a least-privilege integration user, paste your instance URL, username, and password, and run Test connection. HTTP Basic over HTTPS against the Table API. Beta until validated against your live instance.

intermediate3 min readpartial
PartialSource: codeValidated: 2026-07-09

ServiceNow Connector Setup (Beta)#

Connect Intended to ServiceNow so approved intents can create, update, and read incidents and create change requests through the real ServiceNow Table-API adapter (packages/execution-engine/src/adapters/servicenow.ts). Every write is Authority-Token-verified and ESCALATEs for approval under the starter policy.

This connector is Beta

The adapter is real and covered by hermetic (mocked-HTTP) tests that pass in CI with no live tenant. Live proof against your real ServiceNow instance is pending — treat ServiceNow as Beta, not GA. See the Capability Truth Matrix.

What the adapter does#

PropertyValue
Actionsservicenow.incident.create, servicenow.incident.update, servicenow.incident.read, servicenow.change.create
AuthHTTP Basic — Authorization: Basic base64(<username>:<password>)
Host validationHTTPS required; embedded credentials rejected. Note: the adapter does not pin a *.service-now.com suffix — any HTTPS baseUrl is accepted, so enter your real instance URL
Test connectionGET /api/now/table/sys_user?sysparm_limit=1

Writes hit the standard Table API (/api/now/table/incident, /api/now/table/change_request).

Provider-side steps#

1. Instance URL (baseUrl, required)#

Your instance URL, e.g. https://your-instance.service-now.com. Enter it exactly (no domain pin catches typos).

2. Integration user (username + password, required)#

  1. In ServiceNow, create a dedicated integration user (System Security → Users).
  2. Assign it a least-privilege role (below) — do not use admin.
  3. Use the user's username and password for HTTP Basic auth. Where your policy allows, prefer a service account with a rotated credential.

Least-privilege scope guidance#

  • Matrix scopes for this connector: incident:read, incident:write, change:write.
  • Grant the integration user roles/ACLs limited to:
    • incident table: create, read, write (for the three incident actions).
    • change_request table: create (for servicenow.change.create).
    • sys_user table: read (for the connection probe).
  • Do not grant admin or broad itil_admin when table-scoped ACLs suffice.

Fields to paste into the connect dialog#

Open Connectors → Connect a system → ServiceNow → Configure auth:

Field labelKeyRequiredValue
Instance URLbaseUrlYeshttps://your-instance.service-now.com
UsernameusernameYesThe integration user's username
PasswordpasswordYesThe integration user's password

Credentials are stored per-tenant, AES-256-GCM-encrypted, and never displayed back.

Run Test connection#

  1. Finish the connect wizard to store the credential.
  2. On the connector card, click Test connection.
  3. The adapter calls GET /api/now/table/sys_user?sysparm_limit=1. A green result means the Basic credentials are valid and the instance is reachable over HTTPS.

Next steps#

ServiceNow Connector Setup (Beta) | Intended