403 forbidden when calling an AI skill form a MCP client (Postman or MS Copilot)

[arielgritti]

Hi community,

I'm running a 403 forbidden error when trying to use an AI skill (incident summarization) published by a ServiceNow MCP server.

Scenario:
OAuth Client Credentials (with an integration user with ITIL role)
AI Skill (OOTB) requires ITIL role

Token is generated OK
I'm able to "connect" from both MCP clients (Postman and MS Copilot)
The "tool" is available

When trying to execute, 403 forbidden is the error.

Any idea? Any help is welcome.

Thanks,
Ariel

[arielgritti]

Hi @rpriyadarshy 
No records on sn_mcp_execution_logs.

So weird.

[arielgritti]

Hi colleagues,

An update on "my case".
I was able to make it work changing the "integration user" by "my" (admin) user; then, for me, that action confirm a missing role/s. Now I need to know which role/s are missing.

[arielgritti · Accepted solution]

Hi colleagues,

I found it. The missing role is: sn_mcp_server.viewer
Granting this role to the service account user in OAuth config (+ ITIL as required by the AI Skill) I was able to execute it (incident summarization) from Postman

Thanks for your help and I hope my finding helps you.
Ariel

[adrian08]

@arielgritti  how did you exactly add the role? There is not user tied to OAUTH, just client id and secret, 

[arielgritti]

Hi @adrian08 
We're able to add the user because we switched to Client Credentials OAuth type.
Doing that, an "OAuth user" is mandatory. Usually, there is when you create an "integration/functional" user and you can add the role.

Thanks for your help and I hope my finding helps you. If true, please mark it as helpful.
Ariel