> ## Documentation Index
> Fetch the complete documentation index at: https://docs.lumos.com/llms.txt
> Use this file to discover all available pages before exploring further.

# ServiceNow ITSM

*This article covers the **ServiceNow (ITSM)** connector, which provides read-only identity and entitlement visibility plus ITSM ticket logging for AppStore access requests. To create, update, and delete ServiceNow accounts and role assignments, use [ServiceNow User Provisioning](/integrations/library/servicenow/servicenow-provisioning) instead. The two connectors use different OAuth redirect URLs (see Phase 1).*

## After this article

You will be able to connect ServiceNow to Lumos to sync users, their roles, and last login, and to log ITSM request tickets in ServiceNow when access is requested in the AppStore.

## Capabilities

| Functionality | Type | Sync | Provision | Description |
| - | - | - | - | - |
| Users | Account | Yes | No | User accounts from the `sys_user` table. Status mapping: active and not locked out → Active, inactive or locked out → Suspended, no longer returned → Deprovisioned. Last login synced from `last_login_time` |
| Roles | Permission | Yes | No | Granted and inherited ServiceNow roles (inherited via role and group) |

| AppStore | Offboarding | Access Reviews | License Management |
| - | - | - | - |
| Yes (ITSM ticket logging) | Yes | Yes | Yes |

## Required plan and roles

* **ServiceNow plan:** no minimum plan is required.
* **Connecting user:** the integration inherits the permissions of the user who connects it. Connect while logged into ServiceNow as a dedicated service account with the roles below, not your personal admin account.
* **Required roles** on the connecting user/service account:

| Role | Purpose |
| - | - |
| `user_admin` | Administer users, groups, locations, skills, and companies |
| `rest_service` | Allows calls over the REST API (grants the `tableapi` scope) |
| `catalog_admin` | Manage the Service Catalog application, including catalog categories and items |
| `sn_request_comments_write` | Write comments to requests (ITSM ticket logging) |
| `sn_request_write` | Create new requests (ITSM ticket logging) |
| Manage Incident API Scope | Access incident records via API |

* Some roles don't exist on every instance, for example `sn_request_comments_write` and `sn_request_write`. A role combination that has worked for ITSM is `user_admin`, `rest_service`, `catalog_admin`, and `itil`. A smaller subset without `itil` has also worked for some customers.
* **Read-only:** the ITSM connector is read-only for identity and entitlement information. Provisioning (create, update, delete accounts and role assignments) isn't available on this connector. Use [ServiceNow User Provisioning](/integrations/library/servicenow/servicenow-provisioning).

## Instructions

**Phase 1: Create an OAuth client in ServiceNow**

1. In ServiceNow, open the **Application Registry** and create a new application, choosing **Create an OAuth API endpoint for external clients**.
2. Set **Name** to `Lumos` and set the **Redirect URL** to `https://app.lumosidentity.com/integrations/servicenow_oauth2_callback`.
3. Leave all other settings as-is and save.
4. Copy the **Client ID** and **Client Secret**.

**Phase 2: Connect in Lumos**

1. Click the ServiceNow card in your Lumos integrations (reconnect an existing card or add a new one).
2. **Instance Subdomain:** from your login URL (`subdomain.service-now.com`), enter the `subdomain.service-now.com` value.
3. Enter the **ServiceNow Client ID** and **Client Secret** from Phase 1.
4. Click **Connect ServiceNow**. When the ServiceNow login pop-up appears, make sure you're logged in as the intended service account. The integration inherits that user's permissions.

**Phase 3: Configure ITSM logging**

1. In Lumos, go to your **ITSM settings**, choose **ServiceNow** in the dropdown, and click **Connect**.
2. Choose the sync you want to configure.
3. Specify the values: **Project** = `Request`, **Request Type** = `Requested Items`, **Resolve With** (e.g. `Closed Complete`).
4. Click **Save**. Lumos will then create an `sc_request` (state New) with a linked `sc_req_item` when access is requested in the AppStore, comment on the request item as approvals are decided, and resolve it with your Resolve With status when the request completes.

The ITSM entity hierarchy is Request (`sc_request`) → Requested Item (`sc_req_item`) → Catalog Task. Ticket state values map as `1` = New, `6` = Resolved, `7` = Closed.

## API Endpoints Used

<Note>
  The API endpoints this integration uses are available to logged-in Lumos customers. [Log in](/login) to view them.
</Note>

## Troubleshooting

**"Failed to forward OAuth callback to ICS" when connecting.** This generic message usually masks a 403 from ServiceNow: `Missing required api access scope: tableapi` on `GET /api/now/table/sys_user`, which Lumos calls immediately after OAuth to validate credentials. Grant the connecting service account `rest_service` (provides Table API access) and `user_admin`, then reconnect.

**403 Forbidden / insufficient permissions during sync.** Verify the connecting user holds every required role and has read access to `sys_user`, `sys_user_group`, `sys_user_role`, and `sys_user_has_role`. Testing with a full admin account can isolate whether the problem is role-based.

**Item field not set on request items.** Grant the `snc_platform_rest_api_access` role write access on `sc_req_item.cat_item`.

**A specific role (e.g. `security_admin`) never appears as an entitlement.** This is a ServiceNow platform limitation, not a sync bug. Elevated-privilege roles from the High Security plugin are hidden from any non-interactive session, so the connector's OAuth-based role listing gets a clean response with the record omitted. A custom read ACL on `sys_user_role` doesn't fix it. Workarounds are ServiceNow-side (a scripted REST endpoint running as an elevated user, or relaxed High Security settings).

**Incomplete or missing data.** Check active/inactive filter conditions, confirm the integration user can see the records in the ServiceNow UI, and review ACLs for row-level security.

**Connection or credential errors.** Confirm the instance subdomain format, that the instance is reachable from the internet (firewall rules for on-premise), that the OAuth application is active, and that the Client ID/Secret are correct. Regenerate credentials if issues persist. Reconnecting with valid credentials clears an integration error state.