audit
Inspect ServiceNow audit configuration and change history for tables and fields. Check field-level settings, table-level audit status, and retrieve historical changes with configurable time windows.
Instructions
Inspect ServiceNow audit posture (table/field config) and audit trail.
IMPORTANT: sys_audit is one of the largest tables on the platform.
Every action keeps a default 90-day window for that reason. Override
window_days (or since on history) only when you genuinely
need older rows - wider windows cause slow queries and can time out.
Args: action: 'check_field' | 'check_fields' | 'check_table' | 'history' | 'describe'. table: ServiceNow table name (required for all actions except 'describe'). field: Field name (required for 'check_field'). fields_csv: Comma-separated field names (required for 'check_fields', 1..50). sys_id: 32-char record sys_id (required for 'history'). since: YYYY-MM-DD cutoff (history only; overrides window_days). window_days: Audit-trail/positive-control window (defaults to 90). limit: Row cap for 'history' (defaults to settings.max_row_limit).
Input Schema
| Name | Required | Description | Default |
|---|---|---|---|
| action | Yes | ||
| table | No | ||
| field | No | ||
| fields_csv | No | ||
| sys_id | No | ||
| since | No | ||
| window_days | No | ||
| limit | No |
Output Schema
| Name | Required | Description | Default |
|---|---|---|---|
| result | Yes |