Skip to main content
Connect a ServiceNow instance to let CloudThinker agents review open incidents, change requests, problems, and CMDB configuration items, and make updates through your Approvals. The connection signs in with the username and password of a ServiceNow user, ideally a dedicated service account.

​
Prerequisites

  • A ServiceNow instance and its URL, in the form https://<instance>.service-now.com.
  • Permission to create users and assign roles in that instance, or an admin who can do it for you.
  • A service account that can sign in with a local ServiceNow password. If your instance sends people through SSO or requires MFA, the account must still be able to authenticate with its own password for API calls.
  • The Admin role in the CloudThinker workspace, which you need to add connections. See Roles.

​
Setup

1

Create a service account

In ServiceNow, open User Administration → Users and click New:
  • User ID: cloudthinker
  • Password: a strong, unique password
  • Active: checked
Turn on Web service access only if your instance shows it. The account can then call the API but can’t sign in to the ServiceNow UI.
2

Assign roles

On the user record, add the roles in Required permissions. Start with itil and cmdb_read.
3

Add the connection in CloudThinker

In the sidebar, click More → Workspace settings → Connections, stay on the Builtin Connections tab, and select ServiceNow. The form shows the field names exactly as below. Fill in:
  • SERVICENOW_INSTANCE_URL: your instance URL, such as https://acme.service-now.com
  • SERVICENOW_USERNAME: cloudthinker
  • SERVICENOW_PASSWORD: the password you set
Click Connect.Success state: Connect runs a connection test, and ServiceNow shows a Connected status. If the test fails, the connection shows an error with the reason instead. Run the verify prompt below to confirm the account itself can read records.
Testing on a personal developer instance? Its admin account works for a quick trial. Switch to a dedicated account before you connect a production instance.

​
Connection details

To reach another instance, such as a sub-production one, add it as a separate connection.

​
Required permissions

ServiceNow decides what the account sees through roles and table access rules (ACLs). Agents can only read and change what the account can.
For read-only use, ask your ServiceNow admin for a custom role with read access to the incident, change_request, problem, sys_user, sys_user_group, and cmdb_ci tables instead of itil. Agents can still investigate; any write fails at ServiceNow. Add read access to any other table you want agents to query or read the schema of, or those reads fail too.

​
Agent capabilities

Reads run without asking. Every change an agent makes goes through your workspace’s Approvals first. On the default Auto · Rules + AI · Ask me mode, AI judgment can let a safe change run without asking — and an Allow Rule can too, once CloudThinker turns on Rule enforcement for your workspace. Choose Manual to approve every change yourself.
Any table reads don’t ask first, so agents can read every table the account can, including HR or user records. Keep sensitive tables out of the account’s roles and ACLs.
Approving a change request also needs the account to be an approver on that change in ServiceNow. The itil role alone doesn’t make it one.

​
Use it with Resolve

ServiceNow plugs into Resolve. Under Resolve → Triggers & Outcomes → ServiceNow, the Create follow-up tickets outcome files a ServiceNow record for the remaining work when an incident wraps up. Set its Assignment group, for example Cloud Operations. ServiceNow can also send incidents to Resolve as a webhook signal.

​
Verify the connection

Expect a short table of incidents, or a clear “no open incidents” answer. A permission error means the account is missing itil or table read access.

​
Example prompts

Name a service, CI, or time window. ServiceNow tables can hold millions of rows, so narrow requests come back faster.

​
Troubleshooting

The username or password is wrong, the user is inactive, or the account is locked out. Sign in to ServiceNow as an admin, check the user record, reset the password if needed, and edit the connection.If the password is right, check whether SSO or MFA blocks password sign-in for this account. The account needs a local password that works for API calls.
The account lacks a role or ACL for that table. CMDB reads need cmdb_read. Incident, change, and problem reads need itil or an equivalent custom role. Add the role in ServiceNow and ask again; no reconnect needed.
The instance is in maintenance or asleep. Personal developer instances hibernate when idle: wake yours from the ServiceNow developer portal, then retry. Also check that your instance doesn’t block CloudThinker with an IP access rule. To allow CloudThinker through, add its egress IPs to that rule. These docs don’t publish CloudThinker’s egress IP list: ask your CloudThinker contact, or contact us.
Agents look records up by sys_id, not by numbers like INC0012345. If a lookup fails, ask for a search by number instead:
A wrong instance URL also shows up as “not found”, so check it matches your browser address.
The instance is rate limiting API calls. Wait a minute, ask a narrower question, and try again. Your ServiceNow admin can review the instance’s rate limit rules.

​
Security

  • Least privilege — grant only the permissions the agents need for your use case; start read-only and widen later.
  • Read-only by default — use read-only credentials unless you want agents to make changes through this connection.
  • Rotate credentials — rotate keys and tokens on your normal schedule; CloudThinker picks up the new value when you update the connection.
  • Revoke on offboarding — remove the credential at the provider when you delete a connection or a teammate leaves.
  • Dedicated service account: use an account made only for CloudThinker, with Web service access only on, so you can rotate or disable it without affecting a person.
  • Roles over admin: never connect a production instance with the admin role. itil plus cmdb_read covers incident, change, problem and CMDB work. Approving a change also needs the account set as an approver, and Any table reads need read access on each table.

Resolve Triggers & Outcomes

Turn on ServiceNow follow-up records and signals for incidents.

Approvals

Control which ServiceNow updates wait for a person.