403 Forbidden attaching file to kb_knowledge

[Mike Hashemi]

I am using a PowerShell script (see below) to create an article, then add an attachment. The article-creation piece works fine, but I am getting 403 Forbidden (User is unauthorized to write to record: kb_knowledge.<article sys_id>) when I try to attach a file.

The script is using the same account to create the article and to attach the file, and has both the admin and knowledge admin roles.

Any idea what is going on? We have a business rule that automatically moves articles created by this user from "draft" to "review", which triggers the Auto Publish workflow. The only thing I can think of is that, because the article is published, it cannot be modified, but I do not see anything in the API documentation (https://developer.servicenow.com/dev.do#!/reference/api/utah/rest/c_AttachmentAPI) about checking-out an article.

$cred = Get-Credential
$content = Get-Content -Path c:\it\test.html
$uri = "https://instance.service-now.com/api/now/table/kb_knowledge"
$method = "POST"
$base64AuthInfo = [Convert]::ToBase64String([Text.Encoding]::ASCII.GetBytes(("{0}:{1}" -f $cred.UserName, $cred.GetNetworkCredential().Password)))
$headers = @{
    'Authorization' = ('Basic {0}' -f $base64AuthInfo)
    'Accept'        = 'application/json'
    'Content-Type'  = 'application/json'
}

$tempObj = [PsCustomObject]@{
    text                = ($content | Out-String).Trim()
    sys_created_by      = 'serviceAccount'
    author              = '<serviceAccount sys_id>'
    active              = 'true'
    kb_knowledge_base   = '<kb sys_id>'
    topic               = 'General'
    short_description   = 'Testing Attachments'
    article_type        = 'text'
    kb_category         = '<category sys_id>'
    workflow_state      = 'draft'
    display_attachments = $true
}

$response = Invoke-WebRequest -Headers $headers -Method $method -Uri $uri -Body ($tempObj | ConvertTo-Json) -ErrorAction Stop
$result = ($response.Content | ConvertFrom-Json).result

If ($result.number) {
    $articleSysId = $result.sys_id
    $method = "POST"
    $tableName = 'kb_knowledge'
    $fileName = 'test.txt'
    $filePath = 'C:\it\test.txt'
    $uri = "https://instance.service-now.com/api/now/attachment/file?table_name=$tableName&table_sys_id=$articleSysId&file_name=$fileName"

    $headers = @{
        'Accept'       = 'application/json'
        'Content-Type' = 'text/plain'
    }

    # Read file content as binary
    $fileContent = [System.IO.File]::ReadAllBytes($filePath)

    # Convert the file content to Base64
    $fileContentBase64 = [System.Convert]::ToBase64String($fileContent)

    $response = Invoke-RestMethod -Uri $uri -Method $method -Headers $headers -Credential $cred -Body $fileContentBase64
}

[DrewW]

You said this

---

@Mike Hashemi wrote:

We have a business rule that automatically moves articles created by this user from "draft" to "review", which triggers the Auto Publish workflow.

---

So if you just turn of the BR then all you have to do is set the state to review.  It depends on how your instance is setup but for ours the publish workflow does not run more than once.  If you checkout the KBA the system creates a whole new KBA because of versioning.