question Need Help Securing a Public Scripted REST API (GET) in Community Central forum

Need Help Securing a Public Scripted REST API (GET)

daiva — Thu, 24 Jul 2025 09:39:26 GMT

Hello Community,

I've created a Scripted REST API (GET method) in ServiceNow that generates a payment link. Currently, it’s publicly accessible, but this approach lacks proper security.

When I try to secure it using ACL authentication, I receive an “Invalid Request” or “Forbidden Access” error. My goal is to enable authentication but still allow access to users who are not in the ServiceNow user table (i.e., unauthenticated external users).

Is there a recommended way to securely expose this API to external/non-ServiceNow users while preventing unauthorized access?

Thanks in advance for your guidance!
daiva

Re: Need Help Securing a Public Scripted REST API (GET)

Ankur Bawiskar — Thu, 24 Jul 2025 09:56:16 GMT

@daiva

not possible without using user from user table

Every authentication happens via sys_user record only.

If my response helped please mark it correct and close the thread so that it benefits future readers.

Re: Need Help Securing a Public Scripted REST API (GET)

Pranesh072 — Thu, 24 Jul 2025 10:55:17 GMT

Requirement is bit confusing. You want to authenticate the users but also expose it to non-ServiceNow users. Both statements are contradictory.

If you can tell the exact use case that how you differentiating external user from public users?

Re: Need Help Securing a Public Scripted REST API (GET)

daiva — Thu, 24 Jul 2025 12:06:12 GMT

I’ve developed a Scripted REST API (GET method) in ServiceNow that serves a payment link and is intended to be accessed by external users (non-authenticated/guest users). To make this publicly accessible, I’ve currently exposed the endpoint without authentication. However, this creates a security concern — and makes the integration non-compliant for Store publishing.

When I try enabling ACL-based authentication or use basic auth, it blocks access for guest users with errors like "Forbidden" or "Invalid Request."

My requirement is:

The API should be secure enough to meet Store submission standards.

It must still be accessible to external guest users (not in the sys_user table).

Ideally, without creating a ServiceNow user for every consumer.

Has anyone implemented a similar setup or can suggest a secure and compliant pattern for exposing REST APIs to guest users?

Thanks in advance!

Re: Need Help Securing a Public Scripted REST API (GET)

Ankur Bawiskar — Thu, 24 Jul 2025 12:49:20 GMT

@daiva

My thoughts

1) Public, unauthenticated endpoints are generally non-compliant with ServiceNow Store requirements

2) By default, Scripted REST APIs are protected using Access Control Lists (ACLs), which require users to be authenticated (users must exist in the sys_user table)

If my response helped please mark it correct and close the thread so that it benefits future readers.