ServiceNow REST API: Inbound and Outbound

ServiceNow REST integrations

Connect ServiceNow to the rest of your stack over REST.

Quick answer

ServiceNow REST works both ways. Inbound, the Table API exposes every table with no code: GET or POST /api/now/table/incident with sysparm_query for an encoded filter, sysparm_limit and offset to paginate, sysparm_fields to trim the payload and sysparm_display_value to choose sys_ids or labels. Outbound, a REST Message defines the endpoint, method, headers and auth for a flow or script to call.

Key takeaways

Inbound: the Table API
Useful query parameters
Other inbound APIs
Outbound: REST Messages
Authentication & accounts

ServiceNow integrates with the outside world mostly over REST, and it works both directions: other systems call ServiceNow's APIs, and ServiceNow calls theirs. Knowing the inbound Table API, outbound REST Messages, and the auth model covers the large majority of integration work.

Inbound: the Table API

The built-in Table API exposes every table as REST with no code, full CRUD over HTTP:

# Read the 5 newest active incidents
GET /api/now/table/incident?sysparm_query=active=true&sysparm_limit=5
Authorization: Bearer <token>
Accept: application/json

# Create one
POST /api/now/table/incident
{ "short_description": "API-created", "urgency": "2" }

Note sysparm_query, it's the same encoded query syntax as a list breadcrumb.

Useful query parameters

sysparm_query

Encoded query filter.

sysparm_limit / _offset

Page size and offset, always paginate large pulls.

sysparm_fields

Return only named fields, smaller, faster payloads.

sysparm_display_value

true / false / all, sys_ids vs display values.

sysparm_exclude_reference_link

Drop the reference link objects for cleaner JSON.

Other inbound APIs

Beyond the Table API: the Import Set API (post into a staging table + transform), the Aggregate API (counts/stats), Attachment API, and Scripted REST APIs for custom endpoints when the generic Table API isn't the right contract.

Outbound: REST Messages

To call an external API, define a REST Message (endpoint, method, headers, auth) and invoke it from a flow or script. This is how ServiceNow posts to Slack, queries a CMDB source, or triggers a pipeline.

Authentication & accounts

Secure endpoints with OAuth 2.0 (preferred) or basic auth for simple internal cases. Integration accounts must be dedicated service users with least-privilege roles, never a personal admin login. An over-privileged integration account is a top security finding.

Prefer IntegrationHub for real integrations

For anything beyond a simple call, retries, pagination, transforms, pre-built connectors, use IntegrationHub spokes inside Flow Designer rather than hand-rolling every REST Message. Reserve raw REST Messages for endpoints no spoke covers.

Common mistakes

Not paginating, so large pulls time out, use sysparm_limit + offset.
Requesting display values when you need sys_ids (or vice versa).
Integration accounts with admin instead of least privilege.
Hand-building a REST Message where a spoke already exists.