How to set mandatory fields for REST API insert/update without affecting record producers?

[JC S_]

We are trying to enforce mandatory fields when incident tickets are created/updated via REST API. To do this, we created data policies, however, this affected our Service Catalog items that is creating incident tickets via record producers. How can we implement mandatory fields for incident tickets created/updated via REST API without affecting the record producers on our Service Portal?

[Chuck Tomasi]

Someone asked a similar question a little while ago, but it was the other way around - sorry for the additional questions, just wanted to be clear on my end.

Currently, there doesn't appear to be a way to exclude (or include REST) and I don't see a scripting capability on data policies either.

I recommend reaching out to customer support. I'll be interested to hear what they have to say.

HI Service Portal - ServiceNow

Contact Support | ServiceNow

[JC S_]

I've talked to customer support and they are saying that data policy works as expected (it will affect record producers as well).

Do you think it would be possible to approach this using Business Rules? Perhaps a script that checks if session is non interactive then it will set certain fields as mandatroy?

[Chuck Tomasi]

Hi Jim,

That's what I thought. The data policy is universal (not determinant on interactive/non-interactive.

That being said, a business rule could do the check before the record is created to check gs.isInteractive() and recognize whether it is coming from a user or REST API. The BR cannot make a field mandatory, but it can check for null/empty values and throw an error (gs.addErrorMessage()) for unpopulated fields (which is what a mandatory check does anyway.)

Note: You'll want to check this on the portal as well. I believe (but haven't verified) that Service Portal interactions come in via REST.

[Brett Zipkin1]

So I know this thread is 3 years old but I just had the same concern and I solved it using a data policy where the condition was as shown below.  it does however require that the only user accounts using the REST APIs are flagged as web service access only users.  Users coming through the Catalog using a record producer would not be web service only accounts.  At least not in our environment.