Why GUEST account in 'Outbound HTTP Logs' table?

[Suggy]

I see several entries created by GUEST account in 'Outbound HTTP Logs' [sys_outbound_http_log] table? 

Similarly, I see in inbound API table as well

Why GUEST user? In which scenario guest user will appear?

I have seen this kind data in many instances. Definitely it will be there in your customer instances as well.

Anyone know why?

[Maik Skoddow]

Hi @Suggy 

The GUEST user in ServiceNow represents unauthenticated or anonymous access to the platform. This account is used internally by ServiceNow to track activities initiated by users who are not logged in. f an integration, REST API, or web service endpoint is accessed without authentication (for example, if the endpoint does not require authentication, or if the authentication headers are missing or invalid), ServiceNow will process the request as the GUEST user. Similarly, if a public-facing ServiceNow resource (such as a knowledge base article, survey, or public API endpoint) is accessed, the actions performed will be logged under the GUEST account.

Scenarios Where the GUEST User Will Appear

• Public APIs: If you have enabled unauthenticated access to certain REST or SOAP APIs, any requests made without credentials will be logged as GUEST.

• Public Portals and Knowledge Base: Access to public-facing ServiceNow portals, knowledge articles, or surveys that do not require login will be tracked under the GUEST user.

• Misconfigured Integrations: If an external system attempts to call a ServiceNow API without proper authentication (e.g., missing or expired credentials), ServiceNow will treat the request as coming from GUEST.

• Testing or Probing: Automated tools or users probing your instance without authentication will also show up as GUEST in the logs.

Maik