- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
04-27-2022 08:41 AM
Hi All
I have created an ACL for accessing rest api and attched in security tab but its not working all users without itil role also can retrieve data from ServiceNow
how we can rectify this issue?
ACL
POSTMAN
USER PROFILE
Solved! Go to Solution.

- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
05-02-2022 04:08 PM
Hi jobin,
You need the ACL!
But GlideRecordSecure is evaluating the ACLs when being invoked, while GlideRecord is bypassing the ACLs!!
Try this out and let me know the results!!
Hope this helps!
Please, don't forget to mark my answer as correct if it solves your issue or mark it as helpful if it is relevant for you!
Best Regards,
Filipe Cruz
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
04-27-2022 11:04 PM
or can we handle in below script?
(function process( /*RESTAPIRequest*/ request, /*RESTAPIResponse*/ response) {
var arr = [];
var result = {};
var compsid;
var no_data = true;
var company = new GlideRecord('core_company');
company.addQuery('name', 'IN', 'Internal Tools');
company.query();
if (company.next()) {
compsid = company.sys_id;
var gr = new GlideRecord("sc_req_item");
gr.addEncodedQuery('active=true^state!=6^priority=1^ORpriority=2^company=' + compsid);
gr.query();
while (gr.next()) {
var gr2 = new GlideRecord("sc_req_item");
gr2.addQuery('number', gr.number);
gr2.query();
if (gr2.next()) {
no_data = false;
arr.push({
"Number": gr2.number,
"Short Description": gr2.short_description,
"Description": gr2.description,
"Assignment Group": gr2.assignment_group.name,
"Assigned to": gr2.assigned_to.name,
"Category": gr2.u_category.getDisplayValue(),
"Type": gr2.u_sub_category.getDisplayValue(),
"Item": gr2.u_subcategory2.getDisplayValue(),
"Requested For": gr2.request.requested_for.name,
"State": gr2.state.getDisplayValue(),
"Urgency": gr2.urgency.getDisplayValue(),
"Created On": gr2.sys_created_on,
"Created By": gr2.sys_created_by,
"Last Updated By": gr2.sys_updated_by,
"Last Updated On": gr2.sys_updated_on,
"Resolved Date": gr2.u_resolved_date,
"Resolution Category": gr2.u_resolution_category.getDisplayValue(),
"Close Notes": gr2.close_notes,
"Opened": gr2.opened_at,
"Opened by": gr2.opened_by.name,
"Priority": gr2.priority.getDisplayValue(),
"Reassignment count": gr2.reassignment_count,
"Request": gr2.request.number,
"Requestor": gr2.u_requestor.name,
"Company": gr2.company.name,
"Active": gr2.active.getDisplayValue(),
"Sys_id": gr2.sys_id,
"Reported date": gr2.u_reported_date.getDisplayValue()
});
}
result.Data = arr;
}
if (no_data)
result.Result = "No Data Found";
}
response.setBody(result);
}
)(request, response);

- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
04-28-2022 02:24 AM
Hello jobin,
Instead of using the GlideRecord, try to use the GlideRecordSecure:
https://developer.servicenow.com/blog.do?p=/post/gliderecord-vs-gliderecordsecure/
GlideRecordSecure is similar to GlideRecord, but enforces the evaluation of ACLs, so I think that will have a positive outcome for you.
Let me know if that fixed the issue.
Please, don't forget to mark my answer as correct if it solves your issue or mark it as helpful if it is relevant for you!
Best Regards,
Filipe Cruz
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
05-02-2022 06:41 AM
So ACL is not required while using GlideRecordSecure ? here our requirement is ->if the user doesn't have Itil role then they should not able to access data.

- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
05-02-2022 04:08 PM
Hi jobin,
You need the ACL!
But GlideRecordSecure is evaluating the ACLs when being invoked, while GlideRecord is bypassing the ACLs!!
Try this out and let me know the results!!
Hope this helps!
Please, don't forget to mark my answer as correct if it solves your issue or mark it as helpful if it is relevant for you!
Best Regards,
Filipe Cruz