I have a requirement where an API key is stored in an external CCP vault (for example, CyberArk), and ServiceNow has a corresponding credential record in the discovery_credential table.
The actual API key is not stored in ServiceNow. Instead, the credential record contains the credential reference/ID, and during execution the MID Server resolves the secret from the vault and injects it into the REST request (Authorization header).
This setup works successfully in Flow Designer, where the credential is resolved automatically.
However, I now need to call the same API from a Script Include as part of a custom integration and I'm not sure what the recommended approach is.
If the credential were stored directly in ServiceNow, I could use credential provider APIs such as sn_cc.StandardCredentialsProvider. But since the secret resides in the external vault and only the credential reference exists in ServiceNow, I'm unsure how to retrieve or use it in script.
My questions are:
- How can I use a vault-backed credential from a Script Include?
- Is there a supported API to resolve the secret at runtime from the credential record?
- Should I be using a Connection & Credential Alias instead of directly accessing the credential?
- Does anyone have an example of making a REST call from script using a credential whose secret is stored in CyberArk/CCP?
Any guidance or best practices would be greatly appreciated.
