Method failed: (/api/now/table/incident) with code: 401 - Invalid username/password combo

roronoa · 3 weeks ago

Issue: "User is not authenticated" error in REST API Explorer

Hi everyone,

I'm facing an issue in ServiceNow REST API Explorer. Whenever I click Send, I get the following response:

{
  "error": {
    "message": "User is not authenticated",
    "detail": "Required to provide Auth information"
  },
  "status": "failure"
}

I'm already logged into the ServiceNow instance, so I'm not sure why the REST API Explorer is asking for authentication.

Has anyone faced this issue before? What could be causing it, and how can I fix it?

I have a also given the correct credentials

KPNow · 3 weeks ago

Hi @roronoa

Getting a "User is not authenticated" error inside the REST API Explorer—even when you are actively logged in with correct credentials is a common frustration :). This usually happens because the REST API Explorer executes requests via an outbound HTTP connection from the browser or server, meaning your active UI session cookies don't automatically carry over to the endpoint. The most frequent culprit tends to be a session or authentication header mismatch: if multi-factor authentication (MFA) is enabled on your account, if your session has timed out in a background tab, or if local browser extensions (like ad blockers or privacy tools) strip authorization headers, the Explorer's underlying AJAX request will fail to pass the Authorization header or X-UserToken (CSRF token).

To resolve this, first ensure you explicitly select an authentication mechanism directly inside the REST API Explorer interface. Under the Set authentication type section on the left sidebar, toggle from "No Auth" to Basic Auth and re-enter your username and password, or switch to OAuth if your instance enforces single sign-on (SSO)/MFA. If re-authenticating within the Explorer doesn't work, clear your browser cache, log out and back in to refresh your CSRF token, or test the request in an Incognito window. Additionally, verify that your user account has the rest_api_explorer role and that the REST endpoint you are calling doesn't have custom ACLs or Scripted REST API security rules requiring specific headers that your test payload is missing.