Skip to content

ServiceNow API Key

Service Name: ServiceNow

Service Description: ServiceNow is a cloud-based platform that provides IT service management (ITSM), IT operations management (ITOM), and IT business management (ITBM) solutions. It helps organizations automate and streamline their IT service operations, business workflows, and application development.

Service Address: https://www.servicenow.com/

Validation Type: API Auth

IP Allow list: IP restrictions can be configured at the instance level through Access Control Rules in ServiceNow.

Secret Access Scope: ServiceNow API keys grant programmatic access to ServiceNow instances and their resources, allowing users to interact with ServiceNow data and services through REST APIs.

Secret Revokement URL: https://docs.servicenow.com/bundle/tokyo-platform-administration/page/administer/security/task/t_RevokeOAuthTokens.html

Secret Example: a1b2c3d4-5e6f-7g8h-9i0j-k1l2m3n4o5p6

Suspicious Activity Investigation Instructions:

  • Review ServiceNow system logs for unusual API calls or access patterns
  • Check the "sys_audit" table for unauthorized modifications to records
  • Monitor for unusual data exports or bulk operations
  • Review OAuth token usage in the "oauth_token" table
  • Examine IP addresses and geolocation of API access attempts
  • Look for failed authentication attempts or brute force patterns

Mitigation Instructions:

  • Log in to your ServiceNow instance as an administrator
  • Navigate to System OAuth > Application Registry
  • Locate the application associated with the compromised API key
  • Click "Deactivate" to immediately disable the application and its associated

tokens

  • Generate a new API key if needed by creating a new OAuth application
  • Update any legitimate applications or integrations with the new API key
  • Consider implementing more restrictive access controls, such as IP restrictions
  • Review and update API access policies to follow the principle of least privilege
  • Enable enhanced logging for API activities to better monitor future usage