Getting incident close codes using REST API from sys_choise table

[TadasSukys]

Hello,

I need to get the list of close codes (aka "Resolution codes") for an incident using a REST API.

I've found that I can GET this list from this endpoint:

https://instanceId.service-now.com/api/now/table/sys_choice?name=incident&element=close_code&sysparm... 

For authentication on ServiceNow I use OAuth JWT bearer grant type. Here are official link how to set it up Create an OAuth JWT API endpoint for external clients (servicenow.com)

I've associated a ServiceNow user to the JWT, authentication works fine.

But when I try to get close code values, I get the following error message "Insufficient rights to query records, detail = Field(s) present in the query do not have permission to be read".

In this post I've found that user needs a special role in order to query data from sys_choise table Solved: how do you retrieve value column from sys_choice u... - ServiceNow Community

If I assign role 'personalized_choices' to my user, it works and I can get data from the endpoint.

Here are my questions:

1. Do I use a correct way to get close codes for an incident using REST API?

2. What is minimal role that permits reading data from sys_choice table, in my case close codes only?

3. What are other ways to get permissions to sys_choise table to read close codes? As I've mentioned, I use OAuth JWT Bearer grant type - are there a flexible way to control permissions using scopes?

Thank you.

[Anil Lande]

As it is mentioned on the post you followed the role required to read data from sys_choice tables is 'personalized_choices'. 

1. Do I use a correct way to get close codes for an incident using REST API?

Yes, this is correct way. But approach can change based on your requirement.

I don't see any issue with the current authentication method, you can use basic authentication as well.

[TadasSukys]

Thank you for your answer.

What I am looking is the less permissive role - are you saying that 'personalized_choices' is the one that should be used?

Also I look for other options, not only roles, maybe OAuth scopes (eg. allow only read operation on sys_choice).

Any suggestions on that?