> For the complete documentation index, see [llms.txt](https://developer.harness.io/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://developer.harness.io/continuous-delivery/use-continuous-delivery/cd-building-blocks/cd-steps/ticketing-systems/servicenow-api-permission.md).
# ServiceNow create, update, and approval API permissions
Permissions required for ServiceNow create, update, and approval steps in Continuous Delivery pipelines
This topic describes the permissions required for ServiceNow create, update, and approval steps. Make sure that you have the permissions required for the `ticket` and `getMetadata` APIs in addition to the permissions listed in the following sections.
***
## What you will learn from this topic
* How to identify the permissions required to [create ServiceNow tickets](#create-servicenow-tickets) and [update ServiceNow tickets](#update-servicenow-tickets)
* How to identify the permissions required for the [ServiceNow Approval step](#servicenow-approval-step)
* How to configure [minimum permissions for read-only access](#minimum-permissions-for-read-only-access-to-servicenow-tickets)
* How to debug permission errors using the [general debugging FAQs](#general-debugging-faqs)
***
## Before you begin
* **ServiceNow connector**: A Harness ServiceNow connector with credentials that map to a ServiceNow user or integration account. Go to [Connect to ServiceNow](https://developer.harness.io/docs/platform/connectors/ticketing-systems/connect-to-service-now) to create a connector.
* **Harness ServiceNow app (templates)**: If you create or update tickets from form templates, install the Integration for Harness Software Delivery Platform app from the ServiceNow store. Go to [Required ServiceNow integration app for Harness templates](/continuous-delivery/use-continuous-delivery/cd-building-blocks/cd-steps/ticketing-systems/create-service-now-tickets-in-cd-stages.md#required-servicenow-integration-app-for-harness-templates) to review the install requirement.
* **API baseline**: Grant the permissions required for the `ticket` and `getMetadata` APIs, then add the step-specific roles in the sections below.
***
## Create ServiceNow tickets
The permissions you need depend on whether you create the ticket without templates, from a form template, or from a standard template.
### Create a ServiceNow ticket without templates
Harness uses the following API to create a ServiceNow ticket without templates:
```bash
curl --location --request POST '{instance_url}/api/now/table/'\
--header 'Authorization: Basic {bearer token}' \
--header 'Content-Type: application/json' \
--data-raw '{
"description" : "sample incident"
}'
```
The `instance_url` is the ServiceNow URL provided in the ServiceNow connector. The `bearer token` is the token generated by the credentials provided in ServiceNow.
Required permission: `itil`.
### Create a ServiceNow ticket from form templates
Harness uses custom script APIs to create a ticket using form templates. Required permission: `itil`, `x_harne_harness_ap.integration_user_role`.
{% hint style="info" %}
**Harness app required for form templates**
This flow requires the Harness app to be installed in ServiceNow. Go to [Required ServiceNow integration app for Harness templates](/continuous-delivery/use-continuous-delivery/cd-building-blocks/cd-steps/ticketing-systems/create-service-now-tickets-in-cd-stages.md#required-servicenow-integration-app-for-harness-templates) to install the app.
{% endhint %}
### Create a ServiceNow ticket from standard templates
This path is supported only for change request ticket types.
{% hint style="info" %}
**Fields can be read-only without `change_manager`**
While fetching fields, if the `change_manager` permission is not available, Harness considers the `description`, `backout_plan`, `test_plan`, and `implementation_plan` fields as read-only instead of adhering to ServiceNow properties.
{% endhint %}
Required permission: `itil`.
Required role: `change_manager`.
Harness uses the following API to create a ServiceNow ticket from templates:
```bash
curl --location --request POST '{instance_url}/api/sn_chg_rest/change/standard/{sys_id}?backout_plan=ABORT&test_plan=TEST'\
--header 'Authorization: Basic {bearer token}' \
--header 'Content-Type: application/json' \
```
***
## Update ServiceNow tickets
The permissions you need depend on whether you update the ticket with or without templates.
### Update a ServiceNow ticket without templates
Harness uses the following API to update a ServiceNow ticket without templates:
```bash
curl --location --request PATCH '{instance_url}/api/now/table/' \
--header 'Authorization: Basic {bearer token}' \
--header 'Content-Type: application/json' \
--data-raw '{
"description" : "updated"
}'
```
The `instance_url` is the ServiceNow URL provided in the ServiceNow connector. The `bearer token` is the token generated by the credentials provided in ServiceNow.
Required permission: `itil`.
### Update a ServiceNow ticket from templates
Harness uses custom script APIs to update a ticket using form templates. Required permission: `itil_admin`, `x_harne_harness_ap.integration_user_role`.
{% hint style="info" %}
**Harness app required for form templates**
This flow requires the Harness app to be installed in ServiceNow. Go to [Required ServiceNow integration app for Harness templates](/continuous-delivery/use-continuous-delivery/cd-building-blocks/cd-steps/ticketing-systems/update-service-now-tickets-in-cd-stages.md#required-servicenow-integration-app-for-harness-templates) to install the app.
{% endhint %}
***
## ServiceNow Approval step
Harness uses the following API to get the fields of the ServiceNow ticket for which the approval or rejection criteria is specified in the Approval step.
```bash
curl --location --request GET '{instance_url}/api/now/table/' \
--header 'Authorization: Basic {bearer token}' \
```
The `instance_url` is the ServiceNow URL provided in the ServiceNow connector. The `bearer token` is the token generated by the credentials provided in ServiceNow.
Required permission: `itil`.
***
## Minimum permissions for read-only access to ServiceNow tickets
If your use case only requires reading tickets from ServiceNow to fetch ticket status for visibility without performing any create, update, or modify operations, your service account needs the following minimum permission:
**Required role**: `itil`
The `itil` role provides read-only access to ITSM tables and ticket data, including incident, change, and problem tables, without any write permissions. Use this configuration when you only need to monitor ticket status and do not want to perform write actions in ServiceNow.
***
## General debugging FAQs
The following questions cover common permission and access errors in the ServiceNow steps.
Why is apply from template selection blocked when using ServiceNow create/update step?
The connector provided is probably missing the `x_harne_harness_ap.integration_user_role` role permission. Another possible reason could be that the delegate might be down. Also, check if Integration for [Harness Software Delivery Platform app](https://store.servicenow.com/sn_appstore_store.do#!/store/application/de154a1e1b75851044cbdb58b04bcb11/1.0.2?referer=%2Fstore%2Fsearch%3Flistingtype%3Dallintegrations%25253Bancillary_app%25253Bcertified_apps%25253Bcontent%25253Bindustry_solution%25253Boem%25253Butility%25253Btemplate%26q%3Dharness\&sl=sh) is installed in your ServiceNow instance from the ServiceNow store before using templates to update ServiceNow tickets.
Why does updating a ServiceNow ticket from a template result in the error: Error in fetching issue 125c716edb61a910e9748c3b13961918 .Issue does not exist?
The selected ticket type might be different from the actual ticket.
How do you debug an ACL error?
Assuming that the integration user has all above mentioned roles for specific use cases, perform the following steps:
1. Identify the user or integration that Harness used as a connector. This could be a specific user, system account, or an integration like an API.
2. ServiceNow uses Access Control Lists (ACLs) to control what data a user can access and what they can do with that data. Check the ACLs for the table to which you are trying to insert or update. For example, Incident.
3. Ensure that the user or integration has the necessary roles to perform the action. This might involve checking their roles, groups, or specific ACL rules.
4. If the user or integration does not have the necessary permissions, update the ACLs. This could involve adding an ACL rule, or modifying an existing one.
5. Once the ACLs are updated, create the ServiceNow ticket again. If the insert is successful, the issue has been resolved.
6. ServiceNow has data restrictions on their UI. There can be various UI policies configured on ServiceNow that may not allow you to perform the operation directly on the UI even when it is possible via Harness. You can directly use the APIs listed above for debugging permission issues.
7. Check if the table, for example Change Request, has any scoped applications enabled. For details, go to [ServiceNow documentation](https://docs.servicenow.com/bundle/vancouver-application-development/page/build/applications/reference/r_TableApplicationAccessFields.html).
8. Check if there are any data policies written on the user's development instance on the table. For details, go to [ServiceNow documentation](https://docs.servicenow.com/bundle/vancouver-platform-administration/page/administer/field-administration/concept/c_DataPolicy.html).
9. When using custom tables (not Incident, Problem, Change Request, and Change Task in create or update using form templates), grant cross-scope privileges for the required table with templates (via the Harness app in ServiceNow store). For details, go to [Custom table support](/continuous-delivery/use-continuous-delivery/cd-building-blocks/cd-steps/ticketing-systems/create-service-now-tickets-in-cd-stages.md#custom-table-support).
Why do I still receive a permission access failure when user permissions look correct in the ServiceNow Access Analyzer?
Although the user which is being used for access to ServiceNow appears to have the proper permissions, teams may still be getting access errors regarding permissions to a table. (For example, messages to check permissions to the Incident Table). The cause of this may not have to do with the User Permissions, but actually has to do with the Rest API Access Policy.
Go to [ServiceNow documentation on Rest API Access Policies](https://www.servicenow.com/docs/bundle/yokohama-platform-security/page/integrate/authentication/concept/inbound-authentication-profile.html) to review how Rest API Access Policies work and how to adjust them.
***
## Next steps
* [Create ServiceNow tickets in CD stages](/continuous-delivery/use-continuous-delivery/cd-building-blocks/cd-steps/ticketing-systems/create-service-now-tickets-in-cd-stages.md): Create ServiceNow tickets from a pipeline step.
* [Update ServiceNow tickets in CD stages](/continuous-delivery/use-continuous-delivery/cd-building-blocks/cd-steps/ticketing-systems/update-service-now-tickets-in-cd-stages.md): Update ServiceNow tickets from a pipeline step.
* [Adding ServiceNow approval steps and stages](https://developer.harness.io/docs/platform/approvals/service-now-approvals/): Add ServiceNow approvals to your pipeline.
* [Connect to ServiceNow](https://developer.harness.io/docs/platform/connectors/ticketing-systems/connect-to-service-now): Create the ServiceNow connector used by these steps.
{% @harness-feedback/feedback %}