Development · Lesson

Scripted REST APIs

Quick answer

Where REST integrations let ServiceNow call out, Scripted REST APIs let ServiceNow be called. You define your own inbound endpoints, with custom paths, methods, query parameters and response shapes, so external systems integrate with exactly the contract you design, not raw table access.

Key takeaways

Anatomy
When to build one
Try it Yourself

Where REST integrations let ServiceNow call out, Scripted REST APIs let ServiceNow be called. You define your own inbound endpoints, with custom paths, methods, query parameters and response shapes, so external systems integrate with exactly the contract you design, not raw table access.

Anatomy

API, the service, with a base path like /api/x_acme/orders.
Resource, a method + relative path (e.g. GET /{id}) with a script.
Request / Response, request.pathParams, request.queryParams, request.body.data; build the reply on response.

// GET /api/x_acme/orders/{id}
(function process(request, response) {
  var id = request.pathParams.id;
  var gr = new GlideRecord('sc_request');
  if (!gr.get(id)) {
    response.setStatus(404);
    return { error: 'not found' };
  }
  return { number: gr.getValue('number'), state: gr.getValue('state') };
})(request, response);

Secure and version it. Scripted REST APIs honour ACLs and require authentication; scope them to a specific role. Put a version in the path (/v1/) from day one so you can evolve the contract without breaking existing callers.

When to build one

Use a Scripted REST API when the out-of-box Table API is too broad or the wrong shape, when you want to hide internal fields, aggregate data, or present a clean, documented contract to partners.

Want to learn this properly?

Our live, instructor-led ServiceNow Training covers this hands-on, with real projects and a certification path.

See the course Ask a question

Check your understanding

A Scripted REST API lets ServiceNow...
- A. Be called by external systems
- B. Only call out to others
- C. Run scheduled jobs
Show answer
A. Be called by external systems
It exposes inbound endpoints other systems consume.
Path parameters are read from...
- A. request.pathParams
- B. current
- C. g_form
Show answer
A. request.pathParams
request.pathParams holds URI path variables.
A good practice from day one is to...
- A. Version the path (/v1/)
- B. Disable authentication
- C. Return every field
Show answer
A. Version the path (/v1/)
Versioning lets the contract evolve without breaking callers.

Frequently asked questions

What does the term Scripted REST APIs refer to in ServiceNow?

Which systems are connected to Scripted REST APIs?

Use a Scripted REST API when the out-of-box Table API is too broad or the wrong shape, when you want to hide internal fields, aggregate data, or present a clean, documented contract to partners.