Required ServiceNow Access

ServiceNow permissions are controlled by table and field ACLs, so the exact role names depend on the instance and installed applications. The configured account needs read access to:

  • sys_dictionary, for dynamic field and table discovery
  • The Table API for each scanned table
  • Fields needed for classification and metadata, including sys_id, sys_created_on, and sys_updated_on

The API operations used are:

  • GET /api/now/table/sys_dictionary
  • GET /api/now/table/{table}

Use ServiceNow ACLs to grant the smallest practical read-only scope. Avoid assigning broad administrative roles to the integration account.

To verify access manually, use the same credentials against a harmless one-record query:

curl --user 'discovery-reader:your-password' \
  --header 'Accept: application/json' \
  'https://your-instance.service-now.com/api/now/table/sys_dictionary?sysparm_query=name%3Dsys_user&sysparm_fields=name&sysparm_limit=1'

Configuration

The plugin accepts a JSON object containing config and an optional state object.

Configuration Fields

Field

Required

Type

Description

instanceUrl

Yes

string

ServiceNow instance base URL, such as https://your-instance.service-now.com

username

Yes

string

ServiceNow account with read access to dictionary metadata and scanned tables

password

Yes

string

Password for the ServiceNow account; marked writeOnly in the schema

tables

No

array of strings

Tables to classify and scan. When omitted or empty, tables are discovered dynamically

incrementalScanEnabled

No

boolean

Runner scheduling control. Defaults to false

Dynamic Discovery Example

{
  "config": {
    "instanceUrl": "https://your-instance.service-now.com",
    "username": "discovery-reader",
    "password": "your-password",
    "incrementalScanEnabled": true
  },
  "state": {
    "lastScanDate": ""
  }
}

Explicit Table Example

{
  "config": {
    "instanceUrl": "https://your-instance.service-now.com",
    "username": "discovery-reader",
    "password": "your-password",
    "tables": [
      "sys_certificate",
      "sys_kmf_module_crypto_spec",
      "u_crypto_inventory"
    ],
    "incrementalScanEnabled": true
  },
  "state": {
    "lastScanDate": "2026-07-28T12:00:00Z"
  }
}

Table availability and names vary by ServiceNow release, installed applications, and customizations. The table names above are illustrative; select tables that exist in the target instance.