ServiceNow Setup Guide

ServiceNow terminology

Term

Description

User

An account that can log into ServiceNow. You will create a special user that represents the Asset Panda Pro integration.

Role

A user label that is referenced when an Access Control List (ACL) checks for it.

ACL (Access Control List)

A rule that gives permission for a role to read/write a certain table or field.

Table

Where ServiceNow stores records. For example, the Incident table stores every incident ticket while the User table stores every person.

Field

A column within a table. For example, the Incident table includes fields such as Short description or Priority.

Create the integration user

In the left navigation pane, click the search field and enter Users. Matching results are displayed.
Under User Administration, click Users. The Users page displays all user accounts on the ServiceNow instance.
Above the list, click New. The User - New record window is displayed.
For User ID, enter a short username (for example, adam).
Enter the First name and Last name for this account (for example: Adam Miller).
Enter an Email address for the account.
For Identity type, select Machine to identify that this account represents a system/integration, not a real person logging in.
Select Internal Integration User to confirm that the account is used only by another system calling in automatically.
Leave Active checked and leave Locked out unchecked.
Click Submit. The screen shows the saved user record and prompts you to set up the user's password.
Click Set Password, set a password, and confirm it.

The password should be long and can letters, numbers, and simple symbols, such as - and_ . Avoid & % ? = # — as these have special meaning in web addresses and can silently break the integration's login step.

Create a custom role

In the left navigation pane, click the search field and enter Roles.
Under User Administration, click Roles. The page displays all roles on the instance.
Click New.
For Name, enter integration_assetpanda_readonlyx .
Enter a short Description (for example, Read-only role for the Asset Panda integration).
Leave Elevated privilege unchecked.
Click Submit.

Temporarily enable security administration

ServiceNow hides the ability to create Access Control Lists (ACLs) from ordinary admin accounts. You must briefly elevate your session to unlock it. This does not change any settings permanently.

Click your profile picture/avatar icon and then select Elevate Roles. A popup displays the roles you are allowed to elevate to.
Select security_admin and then click OK.

If Elevate Roles is not displayed, your account does not have the security_admin role. To add it, return to the Users view, open your user account and then add the role.

Access Control (ACL) screen overview

All permissions you add are added in the ACL screen.

In the left navigation pane, click the search field and enter Access Control.
Under System Security, click Access Control (ACL). The Access Controls list shows all existing permission rules on the instance.
Click New.

If the New button is not available, ensure that you’ve temporarily assigned the System Administrator role.

Complete the following fields:

Field

Setting

Notes

Type

record

This permission refers to a piece of data.

Operation

read

Read permission prevents the changing, adding, or deleting of data.

Decision Type

Allow If

This rule grants access when its conditions are.

Name

Table name that you search for and select

Defines the table (for example, Asset, Incident, or User) this rule applies to.

Field

“-- None --” or one specific field

Leave as None to cover the whole table.

Pick a specific field to cover just that one column.

Requires role

Your custom role

Only users with this role have the configured access.

This setting is required.

Give access to the data tables

The following permissions give the integration access to assets, incident tickets, and user accounts. Repeat these six actions for each table.

Asset table

On the Access Controls list, click New.
Leave Type as record.
For Operation, select read.
Leave Decision Type as Allow If.
In the drop-down next to Name, enter asset.
From the results, click Asset [alm_asset].
Leave the second drop-down as -- None --.
Under Requires role, click Insert a new row.
Enter integration_assetpanda_readonlyx and click it when it appears below the box.
Click Submit at the top of the page. The page reloads and shows this information as a saved record.

Incident table

Repeat the previous procedure with the following exceptions:

In the drop-down next to Name, enter incident.
From the results, click Incident [incident].

User table

Repeat the previous procedure with the following exceptions:

In the drop-down next to Name, enter sys_user.
From the results, click User [sys_user].

Additional setup

Before Asset Panda Pro pulls any records, it asks ServiceNow the following questions about the Asset table:

“What other table does the Asset table build on top of?” This question is answered by the sys_db_object table, which is ServiceNow's internal directory listing every table that exists, and what each one is built from.
“What columns does the Asset table have, and what type is each one?” This question is answered by the sys_dictionary table, which is ServiceNow's internal directory that lists every field on every table, along with details like its name, data type, and whether it is required.

The integration reads data from these directories before it accesses Asset, Incident, or User data.

These tables need their own read permissions, like Asset, Incident, and User. If these permissions are not set, the integration fail with a permissions error.

Give access to sys_db_object

Whole-table permission

In the navigation pane, enter Access Control and select Access Control (ACL).
Click New.
Leave Type as record.
Click Operation and choose read.
Leave Decision Type as Allow If.
In the drop-down next to Name, enter sys_db_object and then click Table [sys_db_object].
Leave the second drop-down as -- None --.
Under Requires role, click Insert a new row, enter integration_assetpanda_readonlyx, and select it.
Click Submit.

Additional column permission: Extends table

Even with whole-table access granted, ServiceNow separately checks permission on individual columns before it allows a request. The integration asks sys_db_object for one column (super_class) that records what a table is built from.

Click New to start a new permission record.
Leave Type as record.
Click Operation and choose read.
Leave Decision Type as Allow If.
In the drop-down next to Name, enter sys_db_object and then click Table [sys_db_object].
In the second drop-down, enter extends. One matching result appears: Extends table. This is the on-screen name for the super_class column.
Click Extends table.
Under Requires role, click Insert a new row, enter integration_assetpanda_readonlyx, and select it.
Click Submit.

The Name field looks for fields by their plain-English label. If a search for a name like super_class, internal_type, or default_value comes back with No matches found, it means the label is worded differently. Try a plain guess, such as extends, type, or default, instead.

Give access to sys_dictionary

Whole-table permission

From the Access Control (ACL) list, click New.
Leave Type as record.
Click Operation and choose read.
Leave Decision Type as Allow If.
In the drop-down next to Name, enter sys_dictionary and then click Dictionary Entry [sys_dictionary].

Do not click Dictionary Entry Override [sys_dictionary_override].

Leave the second drop-down as -- None --.
Under Requires role, click Insert a new row, enter integration_assetpanda_readonlyx, and select it.
Click Submit.

Additional required column permissions

The sys_dictionary table has additional stricter protection built into ServiceNow on several of its individual columns. The integration's request specifically lists eight columns it wants information about.

For every row in the following table, do the following:

Click New on the Access Controls list.
Leave Type as record.
Click Operation and choose read.
Leave Decision Type as Allow If.
In the drop-down next to Name, enter sys_dictionary and then click Dictionary Entry [sys_dictionary].
In the second drop-down, enter the search text from the table for that row, and then click the matching Click result.
Under Requires role, click Insert a new row, enter integration_assetpanda_readonlyx, and select it.
Click Submit.

Internal computer name (for reference)

Search Text

Click

element

column name

Column name

column_label

column

Column label

internal_type

type

Type

Do not click Calculation Type or Reference Type.

max_length

max length

Max length

mandatory

Mandatory

reference

Reference

choice

Choice

default_value

default

Default value

Additional column permissions

The integration uses two columns to decide which record to look at, rather than to display information from. They are never displayed in the results, but are used to filter/search. ServiceNow requires permission on these columns.

Repeat the previous procedure for the following columns:

Internal computer name (for reference)

Search Text

Click

name

table

Table — two similar options also appear: “Choice table” and “Table reference.” Do not pick those; pick the plain word Table by itself.

active

Active

Verify all permissions

In the navigation pane, enter Access Control and select Access Control (ACL).
For Name, enter sys_dictionary. The permissions you created for that table are displayed.
Verify that one whole-table entry plus 10 column entries (11 total) are displayed. If the list does not show a Field column:
1. Right-click any column title (like Name or Operation).
2. Select Configure > List Layout.
3. Select Field and then click the arrow to move it to the right.
4. Click Save. Rows are displayed for each column for quick review.
Repeat the search-and-count check for the following tables:
- sys_db_object (one whole-table entry plus one entry for Extends table)
- alm_asset (one whole-table entry)
- incident (one whole-table entry)
- sys_user (one whole-table entry)

Assign the new role to the Integration User

In the navigation pane, enter Users, and select Users under User Administration.
Select the integration user you created previously (for example, adam).
Click the Roles tab for the user and then click Edit on the displayed panel. Available and assigned roles are displayed.
In the search field above the Available list, enter integration_assetpanda_readonlyx
Click the matching role to highlight it, then click the right arrow to move the role to the right.
Click Save.
On the user's page, review the Roles list.

If any unintended roles are added, click the check box next to the role, then select Actions on selected rows > Delete.

Register the OAuth application

You must register the OAuth application to define how Asset Panda Pro proves it is allowed to connect to the data.

In the navigation pane, enter Inbound Integrations.
Click the matching result (found under Machine Identity Console).
Click New. A question asks “What kind of OAuth application?” with clickable options.
Click New Inbound Integration Experience. You are prompted to select an access method.
Click OAuth - Resource Owner Password Credential Grant. Asset Panda Pro will connect using the integration user's plain username and password, rather than someone clicking allow in a browser.
Enter a descriptive Name (for example, adam-integration).
For Provider name, select the most appropriate option. This label for ServiceNow's own records does not change how the connection works. ServiceNow generates a Client ID and Client Secret on this screen.
Click the small eye icon next to Client secret to reveal it. Copy the Client ID and Client Secret somewhere safe, such as a password manager. Do not leave them only visible on your screen, and never share a screenshot containing them.
Leave Active checked.
Set the Auth scope (recommended but optional):
1. Under Auth scope, click Create auth scope. A note warns that a built-in option called useraccount grants access to everything the user could ever see. Do not choose this option.
2. For Name, enter assetpanda_readonly_scope and click Save.
3. On the main screen, ensure the new scope is selected under Auth scope.
4. For Limit authorization to the following APIs, enter table.
5. From the matching results, click Table API. Do not select Table Batch API or Table Builder Application.
6. Make sure Allow access only to APIs in selected scope is checked.
7. Click Save.
This process ensures that the OAuth key cannot be used for anything beyond reading data, in case any previous permissions were set incorrectly.

Test the integration

Perform the following tasks using a tool called curl (available by default on Mac and Linux terminals, and on Windows via PowerShell or the Command Prompt on recent versions).

Ask ServiceNow for a temporary access token

curl -X POST "https://<instance>.service-now.com/oauth_token.do" \ -d "grant_type=password" \ -d "client_id=<CLIENT_ID>" \ -d "client_secret=<CLIENT_SECRET>" \ -d "username=<integration_user>" \ -d "password=<PASSWORD>"

Replace everything inside <angle brackets> with your values from the previous procedures. If successful, ServiceNow replies with a block of text containing the access_token.

Use the token to read a record

curl -X GET "https://<instance>.service-now.com/api/now/table/alm_asset?sysparm_limit=1" \ -H "Authorization: Bearer <ACCESS_TOKEN>"

Replace <ACCESS_TOKEN> with the access_token value from the previous task. If everything was set up correctly, ServiceNow replies with asset data instead of an error message.

Repeat the command, changing alm_asset to incident, then to sys_user, to confirm that all three work.

Permission checklist

Table

Field

Usage

Asset [alm_asset]

-- None --

Read real asset records

Incident [incident]

-- None --

Read real incident records

User [sys_user]

-- None --

Read real user records

Table [sys_db_object]

-- None --

Look up a table's basic info

Table [sys_db_object]

Extends table

Look up what a table is built from