Skip to content

ServiceNow Onboarding

This guide outlines the steps required to connect your ServiceNow instance to SailPoint Entro. The integration operates in read-only mode, using a ServiceNow API Access Token to authenticate through the Table API and Attachment API.

Prerequisites

Before starting the onboarding process, ensure you have:

  • ServiceNow Admin permissions

  • Access to the System Web Services and User Administration modules

  • An active Worker Group (Connector) in SailPoint Entro

  • The ServiceNow domain URL (for example, https://<yourDomain\>.service-now.com)

Configuration Steps

  1. Create an Inbound Authentication Profile

    In ServiceNow, go to All > System Web Services > API Access Policies > Inbound Authentication Profile.

    1. Select New.

    2. Choose Create API Key Authentication Profiles.

    3. Enter a name for the profile (for example, Entro Profile).

    4. Select the lock icon to open Auth Parameter selection.

    5. Select the magnifying glass and select the parameter that corresponds to the Auth Header (for example, x-sn-apikey).

    6. Select Submit.

      API key authentication profile named Entro Profile

  2. Create an Integration User

    Go to All > User Administration > Users.

    1. Select New.

    2. Fill in User ID (for example, Entro User) and optionally fill in the details.

    3. Mark the user as Active and Internal Integration User.

    4. Select Submit.

    5. Enter the user you just created.

    6. Below, in Roles, select Edit... and add the following roles:

      • itil - read access to incidents, problems, change requests, and CMDB records.

      • snc_read_only - enforces read-only behavior across the user's assigned roles.

      • knowledge - read access to knowledge articles, knowledge bases, and article feedback (kb_knowledge, kb_knowledge_base, kb_feedback).

      • personalize_dictionary - optional, allows discovery and scanning of custom tables (sys_dictionary, sys_db_object).

    7. Select Save.

    8. In the user details screen, select Update.

    Tip

    Knowledge Base access also depends on User Criteria. The knowledge role grants table-level read, but ServiceNow additionally gates each article through the knowledge base's "Can Read" user criteria. To scan a knowledge base, the Integration User must be included in that base's Can Read criteria, either directly, via a group, or through a global Can Read criteria. Articles in bases where the user is not in the Can Read set will not be returned, even with the knowledge role assigned.

    Tip

    Scanning custom tables may require additional roles per table. Consult your ServiceNow admin or SailPoint Entro Support for further assistance.

    ServiceNow user record with Active and Internal Integration User selected

    Roles assigned to the integration user

  3. Create ACL for Journal Data Scanning

    Scanning journal data (work notes and comments) requires an explicit ACL. Journal entries live in the sys_journal_field table, which ServiceNow keeps restricted by default. The itil role does not grant read access to it through the Table API. To scan journals, go to All > System Security > Access Control (ACL).

    1. Select New and create the Journal scanning ACL:

      • Type - Record

      • Operation - read

      • Name - sys_journal_field (leave the field portion empty to cover the whole table)

      • Under Requires role, add the role assigned to your Integration User (for example, itil, or a dedicated role you create for the integration)

      • Select Submit

      Access Control record for sys_journal_field read access

    If there is no New button on the Access Control (ACL) list, the security_admin role is not in use. Admins do not hold it by default - it has to be elevated for the session:

    1. Select your profile icon in the top-right corner of ServiceNow.

    2. Select Elevate role.

      ServiceNow profile menu with Elevate role

    3. Check the security_admin option and select Update.

      Elevate role dialog with security_admin selected

    Elevated privileges end when you sign out. Refresh the Access Control (ACL) list and the New button will be available.

  4. Create REST API Auth Scopes

    Go to All > System Web Services > API Auth Scopes > REST API Auth Scope.

    1. Select New and create the first scope for the Table API:

      • Name the API Auth Scope (for example, Entro Access Table API)

      • REST API - Table API

      • Auth Scope - create new entro-auth-scope

      • Uncheck Apply auth scope to all HTTP methods in this API

      • Select Submit

      REST API auth scope for the Table API

    2. Repeat for the Attachment API:

      • Name the API Auth Scope (for example, Entro Access Attachment API)

      • REST API - Attachment API

      • Auth Scope - select entro-auth-scope created earlier

      • Uncheck Apply auth scope to all HTTP methods in this API

      • Select Submit

      REST API auth scope for the Attachment API

  5. Create an API Access Token

    Go to All > System Web Services > API Access Policies > REST API Key.

    1. Select New.

    2. Name - Enter a name for the API key (for example, Entro integration).

    3. User - Assign the Integration User created earlier in step 2.

    4. Auth Scope - Select the entro-auth-scope from the previous step.

    5. Select Submit.

    6. Reopen the created API Key and select the lock icon next to Token.

    7. Copy the token and store it securely.

      REST API key assigned to the integration user and entro-auth-scope

  6. Create REST API Access Policies

    Go to All > System Web Services > REST API Access Policies.

    1. Create a new policy for the Table API:

      • Name the API Access Policy (for example, Entro Table API Access Policy)

      • REST API - Table API

      • Uncheck Apply to all methods

      • Under Inbound Authentication Profiles, select the profile from Step 1

      • Select Submit

      Table API access policy using the Entro Profile

    2. Repeat for the Attachment API:

      • Name the API Access Policy (for example, Entro Attachment API Access Policy)

      • REST API - Attachment API

      • Uncheck Apply to all methods

      • Under Inbound Authentication Profiles, select the profile from Step 1

      • Select Submit

      Attachment API access policy using the Entro Profile

    3. Create a BasicAuth authentication profile:

      1. Go to All > System Web Services > API Access Policies > Inbound Authentication Profiles.

      2. Select New.

      3. Select Create standard http authentication profiles.

      4. Give the new profile a name (like BasicAuth) and make sure that Basic Auth is selected as the Type.

      5. Select Submit.

    4. Add the new profile to all the REST API Access Policies:

      1. Go to All > System Web Services > REST API Access Policies.

      2. Select the Table API policy.

      3. In the Inbound authentication profiles at the bottom, add the new BasicAuth auth profile to the list (in addition to the SailPoint Entro auth profile).

      4. Do the same for the Attachments API policy.

  7. Connect ServiceNow to SailPoint Entro

    In the SailPoint Entro Dashboard, go to Management > Accounts & Integrations > Add New Account (top right) > ServiceNow.

    Fill in the integration form using the details from ServiceNow:

    • Environment - Integration's name

    • Display Name - Friendly display name for the integration (optional)

    • ServiceNow URL - for example, https://<yourDomain\>.service-now.com

    • Access Token - Paste the token copied from the API Access Token step

    • Worker Group - Select the connector to handle the integration

    Select Connect.

  8. Validation

    After connecting, SailPoint Entro automatically:

    • Validates the token and API scope configuration

    • Confirms read access to Table and Attachment APIs

    • Begins secret scanning of records and attachments

    When successful, the integration status will display Verified in the SailPoint Entro Console.