ServiceNow

Built, not certified Built and tested against recorded and synthetic responses (version 1.0.0, 10 November 2026). Not yet run against the vendor's sandbox or a client environment.

Reads incidents, changes, CMDB configuration items and published Knowledge articles from one ServiceNow instance, so operations agents can answer from the incident and change history. It reads in place, in your deployment; only ids, hashes and counts reach LightHouse.

At a glance

Collector	ServiceNow, version 1.0.0
Reads	ServiceNow: ServiceNow Table API (incidents, changes, CMDB, Knowledge) (the vendor's documentation)
Family	ITSM
Kind	Tickets
Ways to connect	OAuth approval, Access token
Scopes	Read: snc_read_only
Read only	Yes, except: [object Object]
Vendor's API can move money	No
Personal data	Contact, Content
Hosts it may contact	{instance}.service-now.com
Vendor API versions	Table API (/api/now/table)
Lowest engine version	0.46.0

What it reads

• Incidents (incident): number, short description, state, priority, impact, urgency, category, assignment group, configuration item, opened and resolved dates, close code, description, close notes.
• Changes (change_request): type, state, risk, impact, assignment group, configuration item, start and end dates, and the description fields.
• CMDB configuration items: cmdb_ci, or the one class you name in cmdb_class (for example cmdb_ci_server).
• Knowledge (kb_knowledge): published articles only, the HTML body as text.
• Only the objects you name in objects (incidents, changes, cmdb, knowledge). A whole instance is never the default.
• Changes only: records are read by sys_updated_on, oldest first, paged by sysparm_offset, and only the fields named are asked for (sysparm_fields).

How to connect

1. In ServiceNow, make either an OAuth client (the client-credentials grant, which the instance must allow) or an integration user holding snc_read_only and the read roles of the tables you will name.
2. In LightHouse, open Setup and admin, Connectors, choose ServiceNow, and fill in objects (and cmdb_class if needed).
3. Paste either the client id and secret, or the user name and password. Your browser seals it to your deployment; LightHouse never sees it.

The credential is JSON in the variable the source names (SERVICENOW_CREDENTIAL by default): instance_url (https://<instance>.service-now.com) and either client_id and client_secret, or username and password.

Permissions

• A read-only integration user (snc_read_only and read roles on the tables named), or an OAuth client whose service account is read-only. ServiceNow does not tell a credential its own roles, so read-only is decided by those roles, not by anything the collector can check; the connection check says so.
• What the collector does: GET requests to /api/now/table/<table>, plus, for an OAuth client, one POST to /oauth_token.do for the access token. Its read-only test proves that on every change.
• One host: every request goes to your instance and nowhere else.

Limits

• instance_url must be https://<instance>.service-now.com.
• The query’s date is read in the user’s own time zone, which the collector cannot see, so the query is widened by a day and anything not newer than the cursor is dropped. A busy instance therefore re-reads up to a day of records on each pull; unchanged ones are not rewritten.
• Pages of 1 to 10,000 rows (page_size, default 500).
• References are read as display names for the few fields asked for; the rest of a record is not read.
• Deletions are found by listing sys_ids every six hours; a deleted record is removed from the corpus then, not at once.

Data handling

• Incidents and changes name people (callers, assignees) and may hold personal data in their text. Documents carry the label you give the source.
• Content is read in place, in your deployment. LightHouse receives ids, hashes and counts, never the records, and never opens the credential.
• The raw bytes of each response are cached in your deployment, named by their SHA-256, so any passage can be traced to what was served.

Troubleshooting

What you see	What it means	What to do
credential variable 'SERVICENOW_CREDENTIAL' is not set	The deployment holds no credential for this source	Connect ServiceNow again in LightHouse
instance_url is https://<instance>.service-now.com	The URL is not a ServiceNow instance address	Use the instance’s own address
the servicenow credential has neither an OAuth client nor a user	Neither pair of fields is complete	Give client_id and client_secret, or username and password
ServiceNow: no token (...)	The OAuth client was refused, or the instance could not be reached	Check the client, and that the grant is allowed on the instance
cmdb_class is a CMDB table, cmdb_ci or cmdb_ci_<class>	cmdb_class names some other table	Name a CMDB class
HTTP 401 or HTTP 403	The user lacks a role on a table	Give the user the read role for that table

Certification

Each entry is a run by Atlantic Agentic Labs, newest first. Only a run against the vendor’s sandbox or a client environment certifies a collector; a certification lasts six months, or less if the vendor publishes an API version the collector does not list. See How collectors are certified.

Date	Collector	Engine	Vendor API	Method	Expires
10 November 2026	1.0.0	0.46.0	Table API (/api/now/table)	Fixtures only: built, not certified	Not applicable

Security posture

From the collector’s last scan on the default branch. What each line means, and what blocks a release: Security posture.

Last scanned	10 November 2026
Critical findings	0
High findings	0
Medium findings	0
Low findings	0
Info findings	0
Release blocked	No
Network allow-list check	Pass
Read-only behavioural test	Pass
SBOM (CycloneDX)	Produced
Dependency licences	Pass
Scanners	bandit 1.9.4, semgrep 1.181.1, pip-audit 2.10.1, osv-scanner 2.7.0, cyclonedx-py 7.5.0, pip-licenses 5.5.5, gitleaks repository job aal-secrets, hosts_check tools/hosts_check.py, read-only test pytest -m read_only