Restrict the API access to only GET Method

[Lucky1]

Hello all,

Good day!

I got a task to create a table API on task table and then create a user for this where I can use this account for authentication.

So, the user should be able to only Get the task data, like Incident or Change requests or Catalog tasks data but he should not be able to update or delete the data in those tables.

(the user should only be able to read the data but not modify it)

So, can someone provide me the steps to achieve this please?

Regards,

Lucky

[Ankur Bawiskar]

@Lucky1 

Ideally I won't recommend using Table API as it will allow that user to read everything

For your current requirement you will have to check each task extended table level READ ACL and see what role is present and give that role to that API user.

Example: incident, change table please check table level READ ACL

But remember if that user satisfies any OOTB table level WRITE ACL because of the role you gave earlier user can edit, you can't restrict that

I will recommend using Scripted REST API which gives you more control on what can be seen and retrieved or updated.

If my response helped please mark it correct and close the thread so that it benefits future readers.

[Lucky1]

Hello ANkur,

Thanks for the response.

Will this work?

CORS Rules | ServiceNow Developer

Regards,

Lucky

[Ankur Bawiskar]

@Lucky1 

you can check but I haven't used it.

I still recommend using Scripted REST API over table API

If my response helped please mark it correct and close the thread so that it benefits future readers.

[Lucky1]

Ok Ankur,

Let me check and get back.

Thank you once again.

Regards,

Lucky