Flow Designer - Ask For Approval Action - How to Access Created Approval

aen612 · ‎06-10-2024

I need to access a group approval record that was created in Flow Designer using the 'Ask For Approval' action in a following step.

I'm creating a group approval record (sysapproval_group) in a flow using the 'Ask For Approval' action. Calling a subflow to create the approval with Wait For Completion = false (I need to create multiple approvals simultaneously, each group approval has no impact on another). After the group approval is created I need to update the corresponding automatically created individual approvals (sysapproval_approver) with some instructions in a custom field.

I'm not sure how to look up the group record. Using the pill picker in a following step only shows 'Approval State', 'Action Status', and 'Don't Treat as Error'. I need to access the Number or the sys_id of the group approval record.

I can look up the group approval record by assignment group and/or the parent field (item being approved) but in my use case these aren't guaranteed to be unique combinations. If I limit the created timeframe (sys_created_onONLast 15 minutes) and search, the result should be the one I'm looking for but it's not guaranteed.

Does anyone know how to access an approval record that was created in Flow Designer using the 'Ask For Approval' action in a following step? The group approval records themselves don't have the flow context or anything like that that I've been able to find.

aen612 · ‎06-12-2024

For now, I'm settling for finding Group Approvals (sysapproval_group) that were created in the past or current minute and assigned to a given assignment group and approving a given AD group. This is working as expected, not 100% ideal but close enough, for now.

var findApprovalRecord = 'not what we want';
var groupApprovalRecord = new GlideRecord('sysapproval_group');
groupApprovalRecord.addEncodedQuery('assignment_group=' + fd_data.flow_var.input_approval_group + '^parent=' + fd_data.flow_var.input_ad_group + '^sys_created_onONLast minute@javascript&colon;gs.beginningOfLastMinute()@javascript&colon;gs.endOfLastMinute()^ORsys_created_onONCurrent minute@javascript&colon;gs.beginningOfCurrentMinute()@javascript&colon;gs.endOfCurrentMinute()');
groupApprovalRecord.query();
if(groupApprovalRecord.next()){
findApprovalRecord = groupApprovalRecord.getValue('sys_id');
}
return findApprovalRecord;

Then, performing a 'Look Up Records' action on sysapproval_approver where 'group.sys_id' matches findApprovalRecord (group approval sys_id) from above. Finally, looping through these records updating the custom notes to approver field.

View solution in original post

SanjivMeher · ‎06-10-2024

I think you can just simply use a Look up Records to query the sysapproval_approver table with the documentid of the record on which approval is created and state in 'requested'. Then use a For Each loop to update each of the approval record with the instructions you wish to add. The group approvals are linked to sysapproval_approver record, but dont think, if you need to access them.

Please mark this response as correct or helpful if it assisted you with your question.

aen612 · ‎06-11-2024

I can do that, the problem is that the record being approved isn't unique. That's the reason I want to find the group approval, as that has a direct correlation to the individual approval records.

Thanks for your reply, I appreciate it.

SanjivMeher · ‎06-11-2024

Would you be able to provide more detailed information on what you are trying to do? That would help understand, how to solve this issue.

Please mark this response as correct or helpful if it assisted you with your question.

aen612 · ‎06-11-2024

The flow is triggered by a catalog item that allows a user to request access to multiple features, and a role and environment. Ex: Read access in Non-Prod to 'Report Creator' and 'Currency Editor'. Depending on the feature/role/environment combinations, a user will be added to corresponding groups in Active Directory. I've created a Decision Table that correlates the feature combos to AD groups. Adding a user to a given AD group requires approval from a different group in ServiceNow, some approval users exist in multiple groups, some only exist in one. I've created an additional Decision Table that correlates AD groups to the ServiceNow approval groups.

Since each feature requires unique approval, I'm creating the approvals simultaneously in a for loop that's calling a subflow with 'wait = false', I don't want one approval to potentially hold up another. And, a user could be approved access to one feature but denied access to another, because of this the document ID for the approval(s) can't be the RITM itself. Instead, I'm using the AD group (feature, that has a corresponding record in ServiceNow) as the document ID. This is the reason that the created group approvals are not unique, eventually there will be multiple approvals for a given group (feature). Using the 'Ask For Approval' flow action does not allow to set additional fields such as short_description when creating the approval record(s), if it did I'd be able to look up the exact approvals easily.

So, right now, the group approvals are being created successfully, and behaving as expected. Individual approvals are created for each user in a given approval group. However, when viewing the approval it may not be clear to the user what they're being asked to approve. For a previous use case, we created a field on the sysapproval_approver 'notes to the approver', I want to populate that field with what we're looking for approval, i.e., feature/role/environment that the requested user wants to access, and the RITM that was their request. We can easily find these approval records if we have access to the group approval number or sys_id. I can look up the group approval records by document id, and if I look for approvals created in the last minute it should be the right one, but it will never be guaranteed to be 100%. It's definitely possible that two different users could request the same access to the same feature at the same time. The flow 'knows' which group approval record(s) it created, but I have been unable to find how it 'knows' or where that info is stored. It must be somewhere.

If an approval is approved, we update the RITM with some comments and add the user to the respective group in AD. If an approval is rejected, we note that in the RITM and move on.

In the main flow, after creating all of the approvals, I call another subflow with 'wait = true', this subflow counts all of the flow contexts (approvals) and waits for them all to be complete (currently checking in 10 minute intervals, will likely increase to 30 min), once all complete we close the RITM.

I've tried creating the group approvals via script and also via the 'Create Record' flow action and have not been successful thus far. Well, I can get the group approval record created, and it creates the corresponding individual approvals, but when one approval was approved or rejected, the others remained at requested vs no longer required. I'll likely start focusing on getting this to work.

I think that sums everything up. I'm happy to answer any questions and really do appreciate anyone who takes the time to look and/or respond.

Thanks!
Aaron