Connect ServiceNow

Last Updated: October 4, 2026

CMDBx connects to ServiceNow using OAuth 2.0 client credentials. Your ServiceNow administrator supplies a client ID and client secret for a dedicated integration identity. You do not need to enter a ServiceNow user's password.

Before you begin

You need permission to configure ServiceNow connections in CMDBx, the instance URL, and an inbound OAuth application in ServiceNow that supports the client credentials grant.

Ask your ServiceNow administrator to:

1. Enable the client credentials grant for the instance where supported, including glide.oauth.inbound.client.credential.grant_type.enabled.
2. Create an inbound OAuth application and map its OAuth Application User to a dedicated integration user.
3. Give that user the table and field permissions needed for the selected CI classes, relationships, and reference data. See ServiceNow Setup.
4. Provide the client ID, client secret, and any required OAuth scopes through your approved secret-sharing process.

Menu labels and availability depend on the ServiceNow release. See ServiceNow's client credentials documentation.

Connect an environment

1. Open the onboarding wizard or Settings > ServiceNow.
2. Select the Development, Test, or Production environment you want to connect.
3. Enter the instance name, OAuth client ID, and client secret.
4. Enter space-separated OAuth scopes only if your administrator requires them.
5. Test and save the connection. Saving tests authentication and CI read access before replacing the saved credentials.

CMDBx derives the token endpoint from the instance URL. There is no token URL or OAuth callback URL to enter. The instance must use HTTPS; custom domains need to be allowed by CMDBx support first.

Secrets are encrypted before storage and are never displayed when settings reload. A blank read secret keeps the saved secret only when the client and instance are unchanged. Enter a new secret when changing either.

Configure and run sync

Choose CI classes, filters, and schedule in Sync Config, then start an initial sync from Sync Status. Start with a focused scope and review CI and relationship counts before expanding it. Each CMDBx environment has its own connection.

See Sync Configuration and Multi-Environment Setup.

Optional write access

Governed remediation, change requests, and CSDM Workbench operations use separate write credentials:

1. Have the administrator create a separate OAuth application and integration user with the minimum permissions needed for approved writes.
2. Open Settings > ServiceNow > Write Access in the same environment.
3. Enter the write client ID, secret, and optional scopes, then save.
4. Test the saved connection. This authenticates and reads a CI without creating records; ServiceNow checks write permissions when an approved operation runs.
5. Validate an approved operation in a non-production instance before production use.

Read-only assessment environments cannot enable writes. Write credentials retain a separate expiry shown in settings; rotate them before that date. Access-token renewal is automatic and does not extend the stored write credentials' expiry.

Rotate or remove credentials

Save a replacement in settings. A failed authentication test leaves the existing connection intact. For planned rotation, pause affected jobs if they need to finish uninterrupted: running clients stop at their next request after replacement, while an already-dispatched request may finish.

Changing the ServiceNow instance clears its saved write credentials. Removing write credentials leaves ingestion available. Disconnect removes the environment connection and its data; use credential replacement for rotation.

For emergency revocation, also revoke the OAuth application in ServiceNow. Removing it from CMDBx does not revoke tokens already issued by ServiceNow.

Troubleshooting

See Connection Issues. When contacting support, include the error and instance details, never client secrets or access tokens.