Restrict non-interactive user to only perform post operation through API call

[Bhawnad]

Hi,

I have a requirement that, a non interactive user id should only be able to create case (POST operation) in ServiceNow with API and it should not be able to access (read/update/delete) any records from the case or any other tables in ServiceNow.

Kindly advise the best possible approach to achieve this requirement. I am thinking of scripted API.

Thanks is advance.

[Tony Chatfield1 · Accepted solution]

Hi, I do not think scripted REST API resolves your requirement, and the REST API Access policy plugin would be the best solution for this - it meets your requirement and also mitigates existing exposure via REST API.

REST API access policies (servicenow.com)