Query ServiceNow records with filtering, field selection, pagination, and sorting

Get the structure and field information for a ServiceNow table

Retrieve complete details of a specific record by sys_id

Look up user details by email or username

Find assignment group details by name or sys_id

Search for configuration items (CIs) in the CMDB

Get complete information about a specific configuration item

Show parent and child relationships for a CI

List discovery schedules and their run status

List MID servers and verify they are healthy

List Event Management events (em_event), newest first. Defaults to unprocessed events (state Ready or Error); pass state "all" for every event. For the alerts operators act on, use list_alerts.

Get CMDB data quality metrics (completeness of server and network CI data)

View service dependencies and related CIs for impact analysis

Search ServiceNow using plain English (experimental)

Update a record using natural language (experimental, requires WRITE_ENABLED=true)

List all configured ServiceNow instances (multi-instance / multi-customer support)

Switch the active ServiceNow instance for this session

Get the currently active ServiceNow instance name and URL

[CMDB Write] Create a relationship between two CMDB Configuration Items

Analyze the downstream impact of a Configuration Item change or outage

[CMDB Write] Trigger a ServiceNow Discovery scan for network/infrastructure

Return full field schema for a ServiceNow table using sys_dictionary — includes field types, reference targets, mandatory/unique flags, and parent table. More accurate than get_table_schema for empty tables or custom tables.

Diagnose the connected service account's effective access to one or more tables BEFORE attempting operations. Returns per-table readable/writable flags plus a status that distinguishes WHY access failed: "not_installed" (Invalid table — the table does not exist, e.g. plugin/app not installed), "no_access" (403 — table exists but ACL denies this account), "empty" (readable but zero rows — truly empty or ACL row filtering), or "accessible". Also returns the account's current user and assigned roles. Read is probed with a sysparm_limit=1 GET; write is probed non-destructively with an empty PATCH to a reserved all-zero sys_id (404=writable, 403=denied) — no record is ever created or modified. Useful to check whether a plugin is installed and to avoid "User Not Authorized" retries.

Report the health of Vulnerability Response data integration runs (sn_vul_integration_run) over a recent window. Surfaces failed runs and — critically — silent stalls where no runs occurred at all (e.g. an NVD/Qualys feed quietly failing with 503/429). Returns success/failure counts, the most recent success and failure timestamps, recent run details, and actionable alerts.

Create a new incident record (requires WRITE_ENABLED=true)

Get full details of an incident by number (e.g. INC0012345) or sys_id

Update fields on an existing incident (requires WRITE_ENABLED=true)

Resolve an incident with resolution code and notes (requires WRITE_ENABLED=true)

Close a resolved incident (requires WRITE_ENABLED=true)

Add an internal work note to any ITSM record (requires WRITE_ENABLED=true)

Add a customer-visible comment to any ITSM record (requires WRITE_ENABLED=true)

Create a new problem record (requires WRITE_ENABLED=true)

Get full details of a problem by number (PRB...) or sys_id

Update fields on an existing problem (requires WRITE_ENABLED=true)

Resolve a problem with root cause and resolution notes (requires WRITE_ENABLED=true)

Create a new change request (requires WRITE_ENABLED=true)

Get full details of a change request by number (CHG...) or sys_id

Update fields on a change request (requires WRITE_ENABLED=true)

List change requests with optional filtering by state or query

Move a change request to "Requested" state for approval (requires WRITE_ENABLED=true)

Close a change request with close code and notes (requires WRITE_ENABLED=true)

[Write] Schedule a Change Advisory Board (CAB) meeting

Get details of any task record by number or sys_id

Update fields on a task record (requires WRITE_ENABLED=true)

List tasks assigned to the currently configured user

Mark a task as complete (requires WRITE_ENABLED=true)

List all knowledge bases available in the instance

Search knowledge base articles by keyword

Get the full content of a knowledge article by number (KB...) or sys_id

Create a new knowledge article (requires WRITE_ENABLED=true)

Update a knowledge article (requires WRITE_ENABLED=true)

Publish a draft knowledge article (requires WRITE_ENABLED=true)

[Write] Retire a knowledge article (mark as outdated)

List available service catalog items

Search the service catalog for items matching a keyword

Get full details of a catalog item including its variables

Create a new service catalog item (requires WRITE_ENABLED=true)

Update an existing catalog item (requires WRITE_ENABLED=true)

Order a service catalog item (requires WRITE_ENABLED=true)

Create an approval rule that automatically generates approval requests when a record matches given conditions (requires WRITE_ENABLED=true). Uses the sysapproval_rule table.

List approvals pending for the currently configured user

List approval requests with optional filters

Approve a pending approval request (requires WRITE_ENABLED=true)

Reject a pending approval request (requires WRITE_ENABLED=true)

Get SLA breach status for a specific task or incident

List active SLA records with optional filters

[Write] Add a form variable to a service catalog item

[Write] Create a UI policy for a catalog item form

List service catalog requests (sc_request). Supports filtering by state and requested_for user.

Get a service catalog request (sc_request) by number or sys_id, including its requested items

List requested items (sc_req_item) for a given request or catalog item

Get a requested item (sc_req_item) by number or sys_id, including its fulfillment tasks

Cancel an open service catalog request (requires WRITE_ENABLED=true)

Update a requested item — stage, assignment, or work notes (requires WRITE_ENABLED=true)

List users with optional search filter

Create a new user account (requires WRITE_ENABLED=true)

Update a user account (requires WRITE_ENABLED=true)

List groups with optional search filter

Create a new assignment group (requires WRITE_ENABLED=true)

Update a group (requires WRITE_ENABLED=true)

Add a user to a group (requires WRITE_ENABLED=true)

Remove a user from a group (requires WRITE_ENABLED=true)

List saved reports in the instance (latest release: /api/now/reporting)

Get the definition and metadata of a saved report

Run a grouped aggregate (COUNT, SUM, AVG) query on any table (latest release: /api/now/stats/{table})

Get time-bucketed trend data for a table (useful for monthly/weekly trend charts)

Get Performance Analytics widget data (requires PA plugin; latest release: /api/now/pa/widget/{sys_id})

Export raw table data as structured JSON for use in external reports

Retrieve system log entries for debugging or auditing

List scheduled jobs and their run schedules

Get full details of a scheduled job by sys_id or name

Create a new scheduled script execution job (requires WRITE_ENABLED=true)

Update a scheduled job (requires WRITE_ENABLED=true)

Immediately execute a scheduled job on-demand (requires WRITE_ENABLED=true)

Create a new saved report on any table (requires WRITE_ENABLED=true)

Update an existing saved report definition (requires WRITE_ENABLED=true)

Read scheduler history aggregates by job classification and time window (sys_scheduler_job_history), not individual job success/failure logs. job_sys_id and status filters are unsupported.

[Write] Schedule a report for recurring email delivery

[Write] Create a Key Performance Indicator from ServiceNow data

List ATF test suites in the instance

Get details of a test suite including test count

Execute an ATF test suite (requires ATF_ENABLED=true)

List ATF test cases, optionally filtered by suite

Get details of a specific test case

Execute a single ATF test (requires ATF_ENABLED=true)

Get the results of a test suite run

List individual test results within a suite run

Get ATF Failure Insight data — metadata changes between last successful and failed run (role changes, field value changes)

Ask a natural language question and get structured ServiceNow data (ServiceNow NLQ API)

Semantic AI-powered search across KB, catalog, incidents (ServiceNow AI Search)

Generate an AI summary of any record using Now Assist (latest release: sn_assist/skill/summarize)

Get AI-powered resolution suggestion for an incident based on similar past incidents

Use Predictive Intelligence to predict category, assignment group, and priority (latest release: LightGBM algorithm)

List Virtual Agent topics available in the instance (latest release: streaming VA API)

Invoke an Agentic Playbook — context-aware AI agents that complete tasks autonomously

List VA topics exposed to Microsoft Copilot 365 via Custom Engine Agent integration

Generate AI-drafted work notes for a record based on its current context

List available Predictive Intelligence solutions (classification/similarity models)

List business rules (requires SCRIPTING_ENABLED=true)

Get full details and script body of a business rule (requires SCRIPTING_ENABLED=true)

Create a new business rule (requires SCRIPTING_ENABLED=true). ServiceNow supports ES2021 async/await in scripts.

Update a business rule (requires SCRIPTING_ENABLED=true)

List script includes (requires SCRIPTING_ENABLED=true)

Get full script body of a script include (requires SCRIPTING_ENABLED=true)

Create a new script include (requires SCRIPTING_ENABLED=true)

Update a script include (requires SCRIPTING_ENABLED=true)

List client scripts (requires SCRIPTING_ENABLED=true)

Get full details and script body of a client script (requires SCRIPTING_ENABLED=true)

List update sets (changesets) (requires SCRIPTING_ENABLED=true)

Get details of an update set (requires SCRIPTING_ENABLED=true)

Commit an update set (requires SCRIPTING_ENABLED=true)

Publish/export an update set to XML for deployment (requires SCRIPTING_ENABLED=true)

Create a new client script (onLoad, onChange, onSubmit, onCellEdit) (requires SCRIPTING_ENABLED=true)

Update an existing client script (requires SCRIPTING_ENABLED=true)

List UI Policies for a table (field visibility, mandatory, read-only rules) (requires SCRIPTING_ENABLED=true)

Get full details and conditions of a UI Policy (requires SCRIPTING_ENABLED=true)

Create a new UI Policy to control field behavior dynamically (requires SCRIPTING_ENABLED=true)

List UI Actions (buttons, context menus, related links) for a table (requires SCRIPTING_ENABLED=true)

Get full details and script of a UI Action (requires SCRIPTING_ENABLED=true)

Create a new UI Action (button or link) on a form (requires SCRIPTING_ENABLED=true)

Update an existing UI Action (requires SCRIPTING_ENABLED=true)

List Access Control rules (ACLs) — who can read/write/create/delete records (requires SCRIPTING_ENABLED=true)

Get full details of an ACL rule including its script and role requirements (requires SCRIPTING_ENABLED=true)

Create a new ACL rule to control access to a table or field (requires SCRIPTING_ENABLED=true)

Update an existing ACL rule (requires SCRIPTING_ENABLED=true)

Create a new agile story/user story (requires WRITE_ENABLED=true)

Update an agile story (requires WRITE_ENABLED=true)

List agile stories with optional sprint or state filter

Create a new epic (requires WRITE_ENABLED=true)

Update an epic (requires WRITE_ENABLED=true)

List epics with optional product, theme or state filter

Create a scrum task (sub-task of a story) (requires WRITE_ENABLED=true)

Update a scrum task (requires WRITE_ENABLED=true)

List scrum tasks, optionally filtered by story

Create a new HR Service Delivery case (requires WRITE_ENABLED=true)

Get full details of an HR case by number (e.g. HRCS0001234) or sys_id

Update fields on an existing HR case (requires WRITE_ENABLED=true)

List HR cases with optional filters (status, subject person, service)

Close an HR case with resolution notes (requires WRITE_ENABLED=true)

List available HR services (Onboarding, Offboarding, Benefits, Payroll, etc.)

Get details of a specific HR service including its tasks and SLAs

Get the HR profile for a user (employment details, department, manager)

Update HR profile fields for a user (requires WRITE_ENABLED=true)

List HR tasks associated with an HR case

Create a task within an HR case (requires WRITE_ENABLED=true)

Get the full activity log and journal entries for an HR case

Create an employee onboarding case with all standard tasks. [Write]

Create an employee offboarding case with exit tasks. [Write]

Get HR lifecycle events for an employee (promotions, transfers, leaves)

List available HR document templates (offer letters, contracts, policies)

Create a new Customer Service case (requires WRITE_ENABLED=true)

Get full details of a CSM case by number (e.g. CS0001234) or sys_id

Update fields on an existing CSM case (requires WRITE_ENABLED=true)

List CSM cases with optional filters (account, contact, state, priority)

Close a CSM case with resolution details (requires WRITE_ENABLED=true)

Get details of a customer account including contacts and open cases count

List customer accounts with optional search filter

Get details of a customer contact (name, account, phone, email)

List contacts for an account or search across all contacts

Get SLA details and remaining time for a CSM case

List products and services available in the CSM catalog

Create a Security Operations incident (requires WRITE_ENABLED=true)

Get full details of a security incident by number or sys_id

Update a security incident record (requires WRITE_ENABLED=true)

List security incidents with filters (severity, state, category)

List vulnerability entries from the Vulnerability Response module

Get details of a specific vulnerability entry including CVSS score and affected CIs

Update a vulnerability entry (state, risk acceptance notes, remediation date) (requires WRITE_ENABLED=true)

Query threat intelligence data — IOCs, threat actors, and campaigns

List Security Incident Response playbooks. These are Process Automation Designer definitions (sys_pd_process_definition) shipped in the sn_si_aw scope, e.g. the Malware / Phishing / Failed Login templates.

Start a Security Incident Response playbook (a Process Automation Designer definition in the sn_si_aw scope) against a security incident, the same way the SIR Analyst Workspace does: sn_playbook.PlaybookExperience.triggerPlaybook(). Schedules a one-time server script, so it requires SCRIPTING_ENABLED=true. Skips if that playbook is already queued or in progress on the incident. Set wait_seconds to poll for the resulting execution (sys_pd_context). [Scripting]

Get security posture dashboard — open incidents by severity, vulnerability counts, mean time to resolve

Create a Vulnerability Response scan (sn_vul_scan) for a set of CIs or Vulnerable Items and hand it to the active scanner integration, the same way the "Initiate Scan" / "Rescan" actions do. Needs an active scanner (sn_vul_scanner, e.g. Qualys/Tenable/Rapid7) unless initiate=false, which leaves a Draft scan to launch from the UI. Runs as a server script in a run-once job (SCRIPTING_ENABLED) because the scan state and target links are not writable through the Table API. [Write]

List Flow Designer flows with optional filter by name, category, or active status

Get full details of a Flow Designer flow including its actions and trigger

Trigger a Flow Designer flow with optional input parameters (requires WRITE_ENABLED=true)

Get the status and details of a specific flow execution

List recent executions of a flow with status (completed, error, running)

List available subflows that can be reused across flows

Get full details of a subflow including its inputs, outputs, and actions

List reusable Flow Designer action instances available in the environment

Get details of a Process Automation Designer playbook or process

List Process Automation Designer playbooks and processes

Create a new Flow Designer flow. [Write]

Create a new reusable subflow. [Write]

Create a custom Flow Designer action. [Scripting]

Set active=true on a flow or subflow after verifying its type. This metadata update does not compile or perform the Flow Designer publish lifecycle. [Write]

Execute a flow in test mode with sample inputs. [Write]

Get detailed error logs for failed flow executions

List all Service Portal configurations available in the instance

Create a new Service Portal configuration (requires WRITE_ENABLED=true)

Create a new page inside a Service Portal (requires WRITE_ENABLED=true)

Get full configuration details of a Service Portal by sys_id or URL suffix

List pages that belong to a Service Portal

Get details of a specific Service Portal page including its layout

List Service Portal widgets with optional search by name or category

Get full source code (HTML, CSS, client/server scripts) of a Service Portal widget

Create a new Service Portal widget with template, CSS, and scripts (requires WRITE_ENABLED=true and SCRIPTING_ENABLED=true)

Update an existing Service Portal widget's source code (requires WRITE_ENABLED=true and SCRIPTING_ENABLED=true, including metadata-only updates)

List instances of a specific widget placed on portal pages

List Next Experience (UI Builder) applications

Get configuration details of a Next Experience application

List pages within a Next Experience (UI Builder) application

List Service Portal themes (color palettes, CSS variables)

Get full details of a Service Portal theme including CSS variables

List outbound REST Message configurations (integrations with external APIs)

Get full configuration of an outbound REST Message including its endpoints

List HTTP methods (functions) defined within a REST Message

Create a new outbound REST Message definition (requires WRITE_ENABLED=true)

List Transform Maps used for importing data into ServiceNow tables

Get details of a Transform Map including its field mappings

Request a Transform Map run on an Import Set by creating a sys_import_set_run record; whether this starts the transform is not verified (requires WRITE_ENABLED=true; also SCRIPTING_ENABLED=true when the map runs scripts or targets a protected platform table such as sys_*/sp_*)

List field-level mappings within a Transform Map

List Import Sets with optional filter by state or staging table

Get details of a specific Import Set including row count and transform status

Insert a row into an Import Set staging table (a table extending sys_import_set_row) for later transformation (requires WRITE_ENABLED=true)

Upload and parse one .xlsx worksheet, create an Import Set, insert its staging rows, and optionally request a Transform Map run (transform start is not verified). Requires WRITE_ENABLED=true. The original workbook is attached to the Import Set for auditability; formulas and sys_* columns are rejected.

List Import Set data source definitions (file/JDBC/REST loaders)

List registered event definitions in the ServiceNow event registry

Get details of a specific registered event definition

Register a new custom event in the event registry (requires SCRIPTING_ENABLED=true)

Fire a custom ServiceNow event for a specific record (requires WRITE_ENABLED=true)

List recent event log entries (fired events and their processing status)

List OAuth application registry entries (client applications that can authenticate)

List connection and credential aliases used by integrations

List outbound SOAP Message configurations (sys_soap_message). Endpoints live on each function, not the message.

Get full configuration of a SOAP Message including its functions/operations

List SOAP Message Functions (operations) for a given SOAP Message

Create a new outbound SOAP Message definition in sys_soap_message (requires WRITE_ENABLED=true). The endpoint URL is set per function via create_soap_message_function.

Add a SOAP function (operation) to an existing SOAP Message in sys_soap_message_function (requires WRITE_ENABLED=true)

List email notification definitions (sysevent_email_action)

Get full details of an email notification definition including template and conditions

Create a new email notification definition (requires WRITE_ENABLED=true)

Update an existing email notification (requires WRITE_ENABLED=true)

List outbound email log entries to track sent/failed emails

Get full details of an email log entry including body and headers

List attachments associated with a specific record

Get metadata (name, type, size) of a specific attachment by its sys_id

Delete an attachment from a record (requires WRITE_ENABLED=true)

Upload a base64-encoded attachment to a ServiceNow record (requires WRITE_ENABLED=true). Useful for adding files, screenshots, or documents to incidents, changes, etc.

List email notification templates used by notifications

List user subscriptions to notifications (who has opted in/out)

[Write] Send emergency broadcast notification to users or groups

[Write] Schedule a notification for future delivery

List Performance Analytics (PA) indicators (KPIs) available in the instance

Get details of a specific Performance Analytics indicator including its formula

Get current scorecard data for a PA indicator — returns current value, target, trend direction

Get historical time-series data for a PA indicator to identify trends

List PA breakdowns (dimensions) available for segmenting indicator data

List Performance Analytics dashboards

Get details of a PA dashboard including its widgets/tabs

List homepage dashboards (CMS content pages used as homepages)

List Performance Analytics data collection jobs and their schedules

Get details of a Performance Analytics collection job

Create a new Performance Analytics dashboard (requires WRITE_ENABLED=true)

Update an existing PA dashboard (requires WRITE_ENABLED=true)

Analyze data quality and field completeness for a ServiceNow table — returns percentage of non-empty values per field

Get total record count for a ServiceNow table with optional filters

Compare record counts across multiple ServiceNow tables or time periods — useful for capacity planning

Get live instance performance diagnostics: JVM memory, semaphore pools (concurrency/queue depth), and cluster node status — the data behind the Performance homepage (/stats.do)

Get historical transaction performance as a time series (transaction count, avg/max response time, SQL time, business rule time per bucket) from the transaction log — chartable data for instance performance trends, replacing the legacy Performance dashboard graphs

Get a ServiceNow system property value and metadata by name

Create or update a ServiceNow system property value. [Write]

List system properties with optional filtering

Delete a system property by name. [Write]

Search system properties by name, value, or description

Retrieve multiple system property values in a single call

Create or update multiple system properties in a single operation. [Write]

Export system properties matching a query to a JSON object (useful for environment snapshots)

Import (create or update) system properties from a JSON object. [Write]

Validate a property value against its declared type constraints without saving

List all unique property categories with their record counts

Get audit history of changes to a system property

Get the currently active Update Set for the session

List Update Sets by state (in progress, complete, ignore)

Create a new Update Set and optionally switch to it. [Scripting]

Switch the active Update Set context to a specified Update Set. [Scripting]

Mark an Update Set as complete (ready for migration). [Scripting]

Preview all changes contained in an Update Set

Read-only SCA scan for an Update Set. Inventories script-bearing changes and returns normalized, exact-version component metadata with hashed evidence only; source code is never returned.

Get the XML export payload for an Update Set (as used in migration). [Scripting]

Ensure an active Update Set exists; create one automatically if none is in progress. [Scripting]

Create a new Virtual Agent conversation topic. [Write]

Update a Virtual Agent topic properties. [Write]

Get Virtual Agent topic details including intent and trigger phrases

List all Virtual Agent topics with category and status details

Get conversation history for a Virtual Agent session

List recent Virtual Agent conversations

List Virtual Agent topic categories

List IT assets with optional filtering by state, class, or assigned user

Get full details of an IT asset including financial and lifecycle data

Create a new IT asset record. [Write]

Update an IT asset record. [Write]

Retire an IT asset (mark as disposed/retired). [Write]

List software license records with compliance status

Get license compliance summary — purchased vs. installed vs. in use counts

List asset maintenance and support contracts

Track asset lifecycle events and stage transitions

Analyze software license usage and recommend optimizations

List discovered software installations with publisher, version, and license status

Get full details of a discovered software installation

List the normalized software product catalog (publisher, product type)

List SAM Pro effective license position (ELP) records — owned vs. used rights per product

Aggregate license-compliance dashboard: over-licensed vs. under-licensed counts, total potential savings, total true-up cost

List normalized software discovery models (raw discovery output before/after normalization)

List software models — specific version/edition entitlement units of a product (license type, EOL date, install count)

Get full details of a software model (rights, consumption rules, EOL date, lifecycle stage)

List software lifecycle reports — current/upcoming EOL/EOS phase, install count, and CVE exposure per product

Get full lifecycle report details for one product (all phase dates, CVE breakdown, owners)

List software lifecycle master data — publisher-provided phase entries (GA/EOL/EOS/EOES) per product/version, with risk rating

List Discovery run history (discovery_status) — state, duration, and progress per scan, newest first

Get one Discovery run by sys_id or number (DIS...), including full status fields

List per-device Discovery results (discovery_device_history) — classification, resulting CI, and issue count. Use to answer "why was this server not discovered?"

List Discovery log entries (discovery_log) — sensor/probe messages with result codes, newest first

List Discovery IP ranges (discovery_range_item) — which IP ranges/networks are scanned

List Discovery credential METADATA (name, type, order, MID scope) — secret fields are never returned

List MID Server issues (ecc_agent_issue) — detected problems with source, occurrence count, and last-detected time

List MID Server extension contexts (ecc_agent_ext_context) — e.g. MID Web Server, ACC Websocket Endpoint — with status and error_message. Key for troubleshooting ACC listener setup: a missing "ACC Websocket Endpoint" context means agents get handshake 404s.

Inspect the ECC Queue (ecc_queue) — the job/result bus between the instance and MID Servers. Useful for debugging Discovery, integrations, and ACC data flow. Payload is excluded by default (can be very large); set include_payload to fetch it. CAUTION: payloads can contain sensitive data (command output, host details, credential references) — request them only when needed and handle the output accordingly.

MID Server health summary — status, version, last refresh, open issues, extension contexts (web server / ACC listener), and output-queue backlog sample

List ACC (Agent Client Collector) agents and their status. Requires the ACC plugin

List ACC monitoring/check policies. Requires the ACC plugin

List ACC check definitions. Requires the ACC plugin

List Event Management alerts (em_alert) with operational filters. Defaults to alerts that are not Closed, most severe first.

Get one alert by number or sys_id, with its recent history (em_alert_history) and related tasks (incident/change/problem links).

Operational overview of open alerts: counts by severity, by state, acknowledged vs not, and the top sources. Read-only.

Acknowledge an alert (sets acknowledged=true, exactly like the "Acknowledge" list action), optionally with a work note. Already-acknowledged alerts are reported, not re-written. [Write]

Close an alert (state=Closed, like the "Close" action; also acknowledges it when evt_mgmt.alert_ack_on_close is true), optionally with a work note. Refuses alerts that are already Closed. [Write]

Assign or annotate an alert. Allowed fields: assigned_to, assignment_group, work_notes, maintenance, short_description, description, kb. Use acknowledge_alert / close_alert for state changes. [Write]

List DevOps pipeline configurations registered in ServiceNow

Get details of a specific DevOps pipeline

List recent application deployments tracked in ServiceNow

Get details and status of a specific deployment

Create a change request linked to a DevOps deployment for change governance. [Write]

Record a deployment event in ServiceNow for audit and velocity tracking. [Write]

Get deployment frequency, failure rate, and lead time metrics for a pipeline

List scoped applications (custom apps) installed in the instance

Get full details of a scoped application by sys_id or scope name

Create a new scoped application in App Studio (requires WRITE_ENABLED=true). The scope prefix must be unique and follow the pattern x__.

Update an existing scoped application (requires WRITE_ENABLED=true)

Predict the risk level of a change request using historical ML analysis

Run anomaly detection on operational metrics (alert volume, incident trends, etc.)

Forecast incident volume for the next N days based on historical trends

Trigger training of the incident classification ML solution. [Write]

Trigger training of the change risk prediction ML model. [Write]

Trigger training of an anomaly detection model for a specific table/field. [Write]

Get accuracy, training status, and metrics for a trained ML solution

Get training run history and accuracy trends for an ML solution over time

Analyse Virtual Agent NLU performance — conversation completion rates and fallback metrics

Identify process bottlenecks using analysis of task durations and reassignment patterns

List UI Builder pages and their route configurations

Get details of a specific UI Builder page including layout and child elements

Create a new UI Builder page with route registration. [Write]

Update an existing UI Builder page. [Write]

Delete a UI Builder page. [Write]

List available UI Builder components (macroponents) in the instance

Create a custom UI Builder component (macroponent). [Scripting]

Update a UI Builder component. [Scripting]

List UI Builder data brokers (data sources for pages)

Create a UI Builder data broker to feed data to a page. [Scripting]

List legacy Agent Workspace definitions (sys_aw_master_config), not Configurable Workspace UX applications

Get a legacy Agent Workspace definition and up to 50 of its sys_aw_list configurations

Create inactive legacy Agent Workspace metadata only. Does not provision a Configurable Workspace or its pages. Configure lists separately. [Write]

Create a legacy sys_aw_list configuration under an existing Agent Workspace. query maps to the condition column. Does not update existing lists or configure UX lists. [Write]

Register a new route (URL path) in a UX app. [Write]

Create a new UX Experience (app shell) configuration. [Write]

List sys_sg_mobile_application definitions, not installed client usage. This model has no active column.

Get details of a specific mobile app configuration

Create a name-only sys_sg_mobile_application metadata record. Does not provision an installable mobile app, branding, navigation or screens. [Write]

List native sys_sg_screen metadata. Historical applet name retained; scope is an application scope, not a mobile application ID.

Create base sys_sg_screen metadata only. Does not configure a screen subtype, data item, navigation or app association. [Write]

List sys_sg_screen_m2m_ui_element mappings, not complete mobile layout definitions. Historical tool name retained.

Link an existing screen to an existing UI element. Creates only an M2M mapping, not a full layout or screen. [Write]

UNSUPPORTED: offline configuration requires a validated Mobile App Builder workflow. No state-table writes are performed. [Write]

UNSUPPORTED: push delivery requires a validated notification workflow. No queue insert or delivery is performed. [Write]

UNSUPPORTED: no validated mobile session telemetry source is configured. Returns an error rather than invented usage counts.

Search for platform artifacts by name, type, or scope (business rules, scripts, widgets, etc.)

Validate an artifact for best practices, security issues, and performance concerns

Clone a platform artifact to a new name/scope. [Scripting]

Pre-validate an update set or app before deployment — check for conflicts and missing dependencies

Rollback a deployment by reverting an update set. [Write]

List deployment history — committed update sets and app installs over time

Create a solution package from selected update sets for distribution. [Write]

Run server-side JavaScript on the instance and return what it returns. The script runs in the global scope inside a run-once Scheduled Script Execution (ServiceNow has no REST endpoint that runs scripts synchronously), so it executes when the instance scheduler picks the job up, normally within seconds. End the script with return <value>; to get a value back (JSON-serialisable; max ~3.5 KB). [Scripting]

Import CI data into CMDB CI classes using a safe field allowlist. [CMDB Write]

Analyse data quality for a table — completeness, duplicates, stale records

List USEM Vulnerable Items (sn_vul_vulnerable_item). Filter by state, minimum risk score, CMDB CI, or assignment group. Returns curated fields ordered by descending risk score.

Get full details of a single Vulnerable Item by sys_id or VI number (e.g. "VIT0010003").

List USEM Remediation Tasks across BOTH backing tables: sn_vul_remediation_task and sn_vul_vulnerability (the task-based group the rule engine actually creates RTs in — sys_class label "Remediation Task", number prefix VUL). Each record carries a source_table marker. Filter by state or assignment group; ordered by descending risk score.

Get full details of a single Remediation Task by sys_id or number. Looks in both backing tables: a VUL-prefixed number targets sn_vul_vulnerability (the rule-engine RT), anything else is tried as task_number on sn_vul_remediation_task first, then as number on sn_vul_vulnerability. The result includes a source_table marker.

List Vulnerability Groups (sn_vul_vulnerability) — the task-based remediation entity (sys_class label "Remediation Task", number prefix VUL). Filter by state, minimum risk score, or assignment group. Ordered by descending risk score. Use add_vi_to_remediation_task to add members and the SLA tools (record_type=vg) for TTR status.

Get full details of a single Vulnerability Group by sys_id or VUL number (e.g. "VUL0000103").

Create a Vulnerability Group / Remediation Task (sn_vul_vulnerability). Being task-based it accepts assignment_group, assigned_to and state. [Write — requires WRITE_ENABLED=true]

Update a Vulnerability Group by sys_id — state transitions, (re)assignment, target date, etc. [Write — requires WRITE_ENABLED=true]

List NVD entries (sn_vul_nvd_entry). Filter by CVE id substring or minimum CVSS v3 base score.

Look up a single NVD entry by exact CVE id (e.g. "CVE-2018-1002203").

Summarize the USEM posture: Vulnerable Item counts by state, Remediation Task counts by state, and the highest-risk open Vulnerable Items. Uses the aggregate (stats) API for exact counts.

Create a Remediation Task (sn_vul_remediation_task). [Write — requires WRITE_ENABLED=true]

Update a Remediation Task by sys_id (state, assignee, group, target date, etc.). [Write — requires WRITE_ENABLED=true]

Create a Vulnerable Item (sn_vul_vulnerable_item) with the vulnerability reference intact. A before business rule clears the vulnerability reference on REST inserts, which silently disables the "Link to Remediation Tasks" automation; this tool re-applies the reference via PATCH after insert and verifies it stuck. Requires both vulnerability and cmdb_ci so the remediation-task rule engine can group the item. ServiceNow regenerates short_description as " detected on " on insert, so a value passed here cannot be used to tag items or to select them later (e.g. in a remediation task rule condition) — use source instead; the result reports overwritten fields. [Write — requires WRITE_ENABLED=true]

List the VI ↔ Remediation Task links in the "Remediation Task Item" m2m (sn_vul_m2m_vul_group_item). Give remediation_task (VUL number or sys_id of the sn_vul_vulnerability group) to list its member Vulnerable Items, or vulnerable_item (VIT number or sys_id) to list the Remediation Tasks it belongs to. Exactly one of the two.

Diagnose why a Vulnerable Item is (not) grouped into a Remediation Task. Returns the VI's grouping preconditions (vulnerability and cmdb_ci references, is_in_group), its m2m links with each task's auto_vi_refresh, the active remediation task rules (sn_sec_rem_task_rule), and an ordered diagnosis: empty vulnerability → no active rule → rule/condition mismatch or auto_vi_refresh=false on the existing task.

Associate a Vulnerable Item with a remediation group via the "Remediation Task Item" m2m (sn_vul_m2m_vul_group_item). The group is an sn_vul_vulnerability record that backs the remediation task. [Write — requires WRITE_ENABLED=true]

List USEM/Vulnerability Response automation rules and configs of a given type (assignment, remediation_task, remediation_target, risk_calculator, calculator_rule, risk_field, risk_score_weight, calculator_config, classification, classification_rule, exception_rule, exception_config, rollup, approval, auto_close, exclusion). Ordered by execution order where the table has one, otherwise by a natural key. Optionally filter by active state or an extra encoded query.

Get the full definition of a single USEM/VR rule by sys_id.

Create a USEM/VR automation rule. Provide the rule_type and a fields object matching that table allowlist (e.g. name/rule_name, active, order, condition, assignment_group, ttr_max). Every field is read back after the write; a value ServiceNow did not store fails with FIELDS_NOT_SAVED. remediation_task with assignment_type 5 (Group by field) also needs assignment_group_fields — a field path on the finding that matches one of field_1..6 (e.g. "assignment_group"). The Table API cannot write that field, so it is set by a run-once server script and additionally requires SCRIPTING_ENABLED=true. Create rules inactive and enable them with set_usem_rule_active after checking them. [Write — requires WRITE_ENABLED=true; admin-level config change]

Update a USEM/VR automation rule by sys_id with a fields object restricted to that table allowlist. Every field is read back after the write; a value ServiceNow did not store fails with FIELDS_NOT_SAVED. Setting remediation_task assignment_group_fields runs a run-once server script and requires SCRIPTING_ENABLED=true. [Write — requires WRITE_ENABLED=true; admin-level config change]

Enable or disable a USEM/VR rule (convenience toggle of the active flag). Not supported for rule types without an active flag (exception_rule, exception_config, calculator_config, risk_field, risk_score_weight) — use update_usem_rule for those. [Write — requires WRITE_ENABLED=true; admin-level config change]

Explain how a USEM Risk Calculator computes its score: returns the calculator group (sn_sec_calculator_group), its calculator rules, each rule’s weighted risk fields (sn_sec_calculator_risk_field), and the score→weight bands for the target table (sn_sec_calculator_risk_score_weight) in one call. Use this to answer "why is the risk score N?". Accepts a sys_id or exact calculator name.

List the USEM/VR integration catalog (sn_sec_int_integration) — the available security data feeds such as NVD, Qualys, Tenable, Red Hat. Returns name, id, source and type.

List configured integration implementations/instances (sn_sec_int_impl) — the operational units that carry the active flag, default flag and validation status. Use this to see which feeds are actually enabled.

List Vulnerability Integration Runs (sn_vul_integration_run) with detail. Filter by source (e.g. "NVD"), state, substate ("success"/"failed"), or a recent day window. Ordered newest first. For a quick health rollup use get_integration_health instead.

Get full detail of a single Vulnerability Integration Run by run number (VINTRUNxxxx) or sys_id, including performance metrics and any fatal_error_message.

List integration log entries (sn_vul_integration_log) for troubleshooting — error and recommendation messages, optionally scoped to a single run. Ordered newest first.

List USEM/VR integration parameters. scope="definition" returns the parameter catalog (sn_sec_int_config: label, type, mandatory, default) optionally filtered by integration; scope="instance" returns the configured values per implementation (sn_sec_int_impl_config). Secret-like values (passwords, tokens, API keys) are masked and encrypted password_value columns are never returned.

Enable or disable an integration implementation (sn_sec_int_impl) by sys_id. This turns a security data feed on or off. [Write — requires WRITE_ENABLED=true; admin-level change]

List the SLA (Time-To-Remediate) status of Vulnerable Items, Remediation Tasks, or Vulnerability Groups. Filter by ttr_status (no_target/in_flight/approaching/past_due/target_met), breaches only, an upcoming-due window, or assignment group. Ordered by soonest target date.

Get the SLA (TTR) detail for a single Vulnerable Item, Remediation Task, or Vulnerability Group by number or sys_id: status, target date, applied rule, breach flag and days remaining/overdue. For task-based Vulnerability Groups, task_sla instances are also available via get_sla_details.

Get both SLA views for a task-based Vulnerability Group (sn_vul_vulnerability) by VUL number or sys_id: the built-in TTR status (target date, breach, days remaining) AND any attached task_sla instances (definition, stage, breached, percentage, time left). Use this for groups; VI/RT (which are not task-based) use get_remediation_sla.

Set the remediation commitment / target date on a Vulnerable Item (remediation_commitment_dt_tm) or Remediation Task (ttr_target_date). [Write — requires WRITE_ENABLED=true]

List Vulnerability Response notification definitions (sysevent_email_action) scoped to the VR table family (sn_vul_* / sn_sec_*). Use the generic create_notification/update_notification tools to modify them.

List approval records (sysapproval_approver) for Vulnerability Response items — exception, risk-acceptance and false-positive requests whose approval drives a VR state transition. Defaults to pending (state=requested). Each row shows the source record class and number.

List Vulnerability Response exception requests (sn_sec_exception_change_approval) — False Positive, Risk Acceptance and Exception/Deferral requests raised against vulnerable items or groups. Shows request_type, the target record, the desired state/substate if approved, the approval_state, requester and reason. Approve/reject via act_on_vr_approval (find the approver rows with list_vr_approvals).

Approve or reject a Vulnerability Response approval (sysapproval_approver) by sys_id, which advances the attached workflow and transitions the underlying VR record. Rejection requires a comment. [Write — requires WRITE_ENABLED=true]

List Audit Engagements (sn_audit_engagement) — the top-level audit project record. Filter by state or engagement type. Ordered by most recently updated.

Get full details of a single Audit Engagement by sys_id or number (e.g. "ENG0000104").

List Control Tests (sn_audit_control_test) — the record of testing a Control within an audit engagement; this is the real "audit result" (there is no sn_audit_result table). Filter by control, test plan, or design/operation effectiveness.

Get full details of a single Control Test by sys_id or number (e.g. "CTR0000153").

Summarize the Audit Management posture: Engagement counts by state, Control Test counts by design/operation effectiveness, and the highest-priority-issue open engagements.

List GRC Entities (sn_grc_profile) — the "thing being assessed" (business unit, vendor, application, process, etc.). No number/state field on this table; filter by class or CI.

Get full details of a single GRC Entity by sys_id.

Create a GRC Entity (sn_grc_profile). profile_class must be a valid sys_id from sn_grc_profile_class (e.g. Business Unit, Vendor, Application — use list_grc_entities with no filter or query_records on sn_grc_profile_class to discover valid classes). owned_by is dictionary-mandatory but not enforced by the REST API (the Entity is created with no owner if omitted) — set it to avoid an unowned Entity. [Write — requires WRITE_ENABLED=true]

Update a GRC Entity by sys_id. [Write — requires WRITE_ENABLED=true]

List Compliance Policies (sn_compliance_policy). Filter by state or category.

Get full details of a single Compliance Policy by sys_id or number (e.g. "POL0010200").

Create a Compliance Policy (sn_compliance_policy). kb_knowledge_base, approval_method, and article_template are dictionary-mandatory on this table; the platform silently defaults them (to the standard policy KB / "manual" approval / the standard article template) if omitted, so omitting them will NOT fail the create — but pass them explicitly if you need a specific knowledge base, approval method, or template. [Write — requires WRITE_ENABLED=true]

Update a Compliance Policy by sys_id. [Write — requires WRITE_ENABLED=true]

List Compliance Controls (sn_compliance_control). Filter by state, category, or the Entity (profile) it protects.

Get full details of a single Compliance Control by sys_id or number (e.g. "CTRL0020012").

Create a Compliance Control (sn_compliance_control). implementation_statement is dictionary-mandatory on this table but not enforced by the REST API (it is left blank if omitted) — pass it to describe how the control is actually implemented. [Write — requires WRITE_ENABLED=true]

Update a Compliance Control by sys_id. NOTE: state is not in the allowed field set — confirmed live that REST writes to it are silently ignored (HTTP 200 but the value never persists); only the "Attest" button in the ServiceNow UI can actually move a Control into the attest state and trigger assessment generation. [Write — requires WRITE_ENABLED=true]

List Control Objectives (sn_compliance_policy_statement) — sits between Policy and Control. No number field on this table; filter by state or category.

Get full details of a single Control Objective by sys_id.

List Policy Exceptions (sn_compliance_policy_exception). Filter by state.

Get full details of a single Policy Exception by sys_id or number (e.g. "PER0000106").

List GRC Issues (sn_grc_issue) — the generic finding/gap record used for compliance gaps and audit findings. Filter by state, Entity, or classification.

Get full details of a single GRC Issue by sys_id or number (e.g. "IPT0011010").

Create a GRC Issue (sn_grc_issue). [Write — requires WRITE_ENABLED=true]

Update a GRC Issue by sys_id. [Write — requires WRITE_ENABLED=true]

Summarize the Compliance posture: Policy/Control/Issue counts by state, and the highest-risk open Policy Exceptions.

List Risks (sn_risk_risk) — the quantitative risk register entry. Filter by state, related Entity, or category. Ordered by most recently updated.

Get full details of a single Risk by sys_id or number (e.g. "RK0020310").

Create a Risk (sn_risk_risk). NOTE: impact/likelihood/score are NOT settable here — confirmed live that a business rule always overwrites them regardless of client input (see list_risk_criteria to inspect the scale; scoring appears to require the platform's risk assessment workflow, not direct field writes). [Write — requires WRITE_ENABLED=true]

Update a Risk by sys_id. NOTE: impact/likelihood/score are not in the allowed field set — confirmed live that they are unconditionally recalculated by a business rule on write. [Write — requires WRITE_ENABLED=true]

List the Risk Statement library (sn_risk_definition) — reusable risk descriptions referenced by Risk records.

Get full details of a single Risk Statement by sys_id.

List the Impact/Likelihood/Score scale (sn_risk_criteria) used by Risk records — 5 rows per type, ordered. Reference only: impact/likelihood/score are NOT settable via create_risk/update_risk (confirmed to be recalculated by a business rule regardless of client input) — use this tool to understand the scale a Risk's calculated values fall on, not to prepare a write.

Summarize the Risk posture: Risk counts by state, and the highest-scored open risks.

List GRC Indicators (sn_grc_indicator, KRI/KPI) — periodic pass/fail metrics measuring a Control or Risk (item) for a given Entity. Filter by entity, category, or last result.

Get full details of a single GRC Indicator by sys_id or number (e.g. "IND0020021").

Create a GRC Indicator (sn_grc_indicator). item is the sys_id of an EXISTING Compliance Control (sn_compliance_control) or Risk (sn_risk_risk) record — both extend the same base table, so their own sys_id is used directly, no separate lookup needed. entity MUST be the specific Entity already associated with that item (e.g. the Control/Risk's own profile field) — confirmed live that a validation business rule rejects (HTTP 403) any entity that isn't the one the item is actually scoped to. [Write — requires WRITE_ENABLED=true]

Update a GRC Indicator by sys_id. entity/item are intentionally not updatable here — changing either risks the same entity/item validation failure confirmed on create; recreate the Indicator instead if it needs to measure a different Control/Risk or Entity. [Write — requires WRITE_ENABLED=true]

List Indicator Results (sn_grc_indicator_result) — individual pass/fail collection events for an Indicator. Empty on dev400464 at verification time (2026-07-12); included for instances where indicator collection has run.

Get full details of a single Indicator Result by sys_id.

Summarize Indicator posture: counts by category and by last-result pass/fail.

Resolve a natural-language request into a ServiceNow table + encoded query and (optionally) run it. Maps keywords to common tables (incident, change_request, problem, sc_request, sn_vul_vulnerable_item, cmdb_ci, sys_user, …), then infers conditions for priority (P1/critical/high), open vs closed state, "assigned to me"/unassigned, and time windows (today, yesterday, this/last week, this/last month, last N days). Conditions whose field does not exist on the resolved table are dropped and reported in unmatched_intents. Returns the interpretation (table, encoded_query, conditions) plus matching records. Set execute=false to preview the query without running it, or pass table to override resolution.

Search the public ServiceNow Store catalog by keyword (no instance auth needed). Returns listing_id values usable with get_store_app_versions.

Get version history with release notes (new features / bug fixes) for a Store app from the public Store API. Release notes are not stored in any instance table — this is the only programmatic source. Use search_store_apps to find the listing_id.

Compare the installed version of a scoped app (from sys_scope on the instance) against the public Store version history, and return the release notes of every newer version. For upgrade planning of Store apps (VR, ACC Framework, ...), whose lifecycle is independent of platform upgrades. Provide either listing_id, or store_query / nothing to search by app name.

List Data Management Policies, optionally for one exact table.

Get a Data Management Policy and the archive rules for its table.

Create an inactive Data Management Policy. Existing policies for the table are rejected. [Write]

List archive rules, optionally for one exact table.

Create an inactive archive rule under an existing Data Management Policy. retain_references can only be chosen at creation. [Write]

Create an inactive destroy rule for archived data. retention_days must be at least one day. [Write]

List Table Cleanup Rules (Auto Flush), optionally for one exact table.

Create an inactive Table Cleanup Rule for a Data Management Policy. It deletes live records only after explicit activation. [Write]

Activate or deactivate an archive rule. Activation requires confirmation and an active Data Management Policy. [Write]

Activate or deactivate a destroy rule. Activation requires confirmation; it permanently deletes eligible archived records. [Destructive]

Activate or deactivate a Table Cleanup Rule. Activation requires confirmation; matching live records are permanently deleted. [Destructive]