question The scripted rest api will be run under which credential? in Common Service Data Model forum

The scripted rest api will be run under which credential?

Lisa71 — Fri, 09 Jan 2026 07:54:36 GMT

Will it be run under the system credential or caller credential? Or both are possible depends on the settings? what to indicate the settings?

What's the difference when I check the "requires authentication" "requires ACL authorization" in the scripted rest resource?

Thanks.

Re: The scripted rest api will be run under which credential?

Tejas Adhalrao — Fri, 09 Jan 2026 08:27:38 GMT

Hi @Lisa71 ,

In a Scripted REST API, the script can run using either the system account or the user’s account, depending on the settings. If you select “Requires authentication,” the API needs valid user credentials, and the script runs as that user. If you also select “Requires ACL authorization,” ServiceNow will check the user’s table and field permissions (ACLs) before allowing access. If you only check “Requires authentication,” the script runs as the user but can still bypass ACLs. And if you don’t require authentication at all, the script runs as the system user and anyone can call it. In short, “Requires authentication” controls who is calling, while “Requires ACL authorization” controls what they can access.

Re: The scripted rest api will be run under which credential?

Chaitanya ILCR — Fri, 09 Jan 2026 08:48:52 GMT

Hi @Lisa71 ,

if credentials are password it will run as the user

If no authentication is required, the script runs in the context of a "Guest" user.

example

I have created a sample scripted rest api which creates an incident

called the api without credentials

when no credentials is opted it runs the api with Guest user permissions

Please mark my answer as helpful/correct if it resolves your query.

Regards,
Chaitanya

Re: The scripted rest api will be run under which credential?

Mathew Hillyard — Fri, 09 Jan 2026 08:55:34 GMT

Hi @Lisa71

This is the CSDM forum. Please post in a more suitable forum where you will find a wider audience, e.g. the Developer forum.

I hope this helps!
Mat

Re: The scripted rest api will be run under which credential?

Ankur Bawiskar — Fri, 09 Jan 2026 09:27:14 GMT

@Lisa71

It will run in the session of that user whose credentials 3rd party is using, either Basic OR OAuth 2.0

If no credentials uses then as mentioned by @Chaitanya ILCR -> it is guest user (Not recommended practice)

Requires Authentication -> Blocks unauthenticated/anonymous access

Requires ACL Authorization -> Enforces ACL security on REST endpoint

💡 If my response helped, please mark it as correct ✅ and close the thread 🔒— this helps future readers find the solution faster! 🙏

Re: The scripted rest api will be run under which credential?

Lisa71 — Fri, 09 Jan 2026 11:04:23 GMT

Thanks. So if "requires authentication" is Not checked, then the scripted rest api will be run under "system" privilege, means it can do anything with high privilege, right?

Re: The scripted rest api will be run under which credential?

Tejas Adhalrao — Fri, 09 Jan 2026 11:43:22 GMT

Hi @Lisa71 ,

Exactly, but Always keep “Requires authentication” checked for APIs that access sensitive data.

If you found my solution helpful, please mark it as Helpful or Accepted Solution...!

thanks,

tejas

Email: adhalraotejas1018@gmail.com

LinkedIn: https://www.linkedin.com/in/tejas1018