# ServiceNow > ServiceNow: what the collector reads, how to connect it, its permissions, its certification by Atlantic Agentic Labs and its security posture. Built, not certified Built and tested against recorded and synthetic responses (version 1.0.0, 10 November 2026). Not yet run against the vendor's sandbox or a client environment. Reads incidents, changes, CMDB configuration items and published Knowledge articles from one ServiceNow instance, so operations agents can answer from the incident and change history. It reads in place, in your deployment; only ids, hashes and counts reach LightHouse. ## At a glance | Collector | ServiceNow, version `1.0.0` | | --------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | Reads | ServiceNow: ServiceNow Table API (incidents, changes, CMDB, Knowledge) ([the vendor's documentation](https://developer.servicenow.com/dev.do#!/reference/api/latest/rest/c_TableAPI)) | | Family | ITSM | | Kind | Tickets | | Ways to connect | OAuth approval, Access token | | Scopes | - Read: `snc_read_only` | | Read only | Yes, except: \[object Object] | | Vendor's API can move money | No | | Personal data | Contact, Content | | Hosts it may contact | `{instance}.service-now.com` | | Vendor API versions | Table API (/api/now/table) | | Lowest engine version | `0.46.0` | ## What it reads - **Incidents** (`incident`): number, short description, state, priority, impact, urgency, category, assignment group, configuration item, opened and resolved dates, close code, description, close notes. - **Changes** (`change_request`): type, state, risk, impact, assignment group, configuration item, start and end dates, and the description fields. - **CMDB** configuration items: `cmdb_ci`, or the one class you name in `cmdb_class` (for example `cmdb_ci_server`). - **Knowledge** (`kb_knowledge`): published articles only, the HTML body as text. - Only the objects you name in `objects` (`incidents`, `changes`, `cmdb`, `knowledge`). A whole instance is never the default. - Changes only: records are read by `sys_updated_on`, oldest first, paged by `sysparm_offset`, and only the fields named are asked for (`sysparm_fields`). ## How to connect 1. In ServiceNow, make either an OAuth client (the client-credentials grant, which the instance must allow) or an integration user holding `snc_read_only` and the read roles of the tables you will name. 2. In LightHouse, open **Setup and admin, Connectors**, choose **ServiceNow**, and fill in `objects` (and `cmdb_class` if needed). 3. Paste either the client id and secret, or the user name and password. Your browser seals it to your deployment; LightHouse never sees it. The credential is JSON in the variable the source names (`SERVICENOW_CREDENTIAL` by default): `instance_url` (`https://.service-now.com`) and either `client_id` and `client_secret`, or `username` and `password`. ## Permissions - **A read-only integration user** (`snc_read_only` and read roles on the tables named), or **an OAuth client** whose service account is read-only. ServiceNow does not tell a credential its own roles, so read-only is decided by those roles, not by anything the collector can check; the connection check says so. - **What the collector does:** `GET` requests to `/api/now/table/`, plus, for an OAuth client, one `POST` to `/oauth_token.do` for the access token. Its read-only test proves that on every change. - **One host:** every request goes to your instance and nowhere else. ## Limits - `instance_url` must be `https://.service-now.com`. - The query’s date is read in the user’s own time zone, which the collector cannot see, so the query is widened by a day and anything not newer than the cursor is dropped. A busy instance therefore re-reads up to a day of records on each pull; unchanged ones are not rewritten. - Pages of 1 to 10,000 rows (`page_size`, default 500). - References are read as display names for the few fields asked for; the rest of a record is not read. - Deletions are found by listing `sys_id`s every six hours; a deleted record is removed from the corpus then, not at once. ## Data handling - Incidents and changes name people (callers, assignees) and may hold personal data in their text. Documents carry the `label` you give the source. - Content is read in place, in your deployment. LightHouse receives ids, hashes and counts, never the records, and never opens the credential. - The raw bytes of each response are cached in your deployment, named by their SHA-256, so any passage can be traced to what was served. ## Troubleshooting | What you see | What it means | What to do | | ------------------------------------------------------------------ | ------------------------------------------------------------------ | ------------------------------------------------------------------ | | `credential variable 'SERVICENOW_CREDENTIAL' is not set` | The deployment holds no credential for this source | Connect ServiceNow again in LightHouse | | `instance_url is https://.service-now.com` | The URL is not a ServiceNow instance address | Use the instance’s own address | | `the servicenow credential has neither an OAuth client nor a user` | Neither pair of fields is complete | Give `client_id` and `client_secret`, or `username` and `password` | | `ServiceNow: no token (...)` | The OAuth client was refused, or the instance could not be reached | Check the client, and that the grant is allowed on the instance | | `cmdb_class is a CMDB table, cmdb_ci or cmdb_ci_` | `cmdb_class` names some other table | Name a CMDB class | | `HTTP 401` or `HTTP 403` | The user lacks a role on a table | Give the user the read role for that table | ## Certification Each entry is a run by Atlantic Agentic Labs, newest first. Only a run against the vendor’s sandbox or a client environment certifies a collector; a certification lasts six months, or less if the vendor publishes an API version the collector does not list. See [How collectors are certified](/collectors/certification/). | Date | Collector | Engine | Vendor API | Method | Expires | | ---------------- | --------- | -------- | -------------------------- | ----------------------------------- | -------------- | | 10 November 2026 | `1.0.0` | `0.46.0` | Table API (/api/now/table) | Fixtures only: built, not certified | Not applicable | ## Security posture From the collector’s last scan on the default branch. What each line means, and what blocks a release: [Security posture](/collectors/security/). | Last scanned | 10 November 2026 | | -------------------------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | Critical findings | 0 | | High findings | 0 | | Medium findings | 0 | | Low findings | 0 | | Info findings | 0 | | Release blocked | No | | Network allow-list check | Pass | | Read-only behavioural test | Pass | | SBOM (CycloneDX) | Produced | | Dependency licences | Pass | | Scanners | bandit 1.9.4, semgrep 1.181.1, pip-audit 2.10.1, osv-scanner 2.7.0, cyclonedx-py 7.5.0, pip-licenses 5.5.5, gitleaks repository job aal-secrets, hosts_check tools/hosts_check.py, read-only test pytest -m read_only | Source: https://docs.atlanticagenticlabs.com/collectors/catalogue/servicenow/