SetValue to list collector fails for external user

[Mio Matsushita]

Here is a simple catalog item with a list collector variable.
In addition, this catalog item has a simple client script that setsValue () the contact sys_id to a list collector variable.
SetValue () works fine for internal users, but I get an error for external users.

Below is a simple client script that sets the value of a list collector variable with the setValue () method.
*"xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx" is the contact's sy_id.

function onChange(control, oldValue, newValue, isLoading) {
 g_form.setValue('list_collector', 'xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx');
}

This client script works fine for internal users, but fails for external users.
I expect the contact's name to appear in the list collector field when an external user is viewing the catalog item.

As a result of investigation, when setValue () is executed for the list collector variable, the API to get the display name from the sys_id of the passed contact is executed, and that API is a 403 error.
The endpoint with the 403 error is:

https://<instance-name>.service-now.com/api/now/ui/glide/list/element/display/customer_contact/xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx

The HTTP status court is 403 and the following response is returned.

<response>
<error>
<detail/>
<message>External User Not Authorized</message>
</error>
<status>failure</status>
</response>

How can I get setValue () to the list collector to work properly when I'm an external user?

【Reference information】
・https://docs.servicenow.com/bundle/sandiego-servicenow-platform/page/product/service-catalog-management/reference/r_VariableTypes.html
When referring to the above document, there is a description about the list collector "The values in the referenced table do not appear if the user is not logged in."
However, the external user is logged in and has an ACL for the contact table, but it does not work properly.

・ https://support.servicenow.com/kb?id=kb_article_view&sysparm_article=KB0747438
"Only when the glide_list attribute is true, can you set a value for this variable using a setValue() function in a catalog client script."
Even if the glide_list attribute is added to the variable according to the above KB, it will not work properly for an external user.

・https://community.servicenow.com/community?id=community_question&sys_id=21a2d42cdb5a0c5014d6fb2439961957
I've given the snc_external user the "client_callable_script_include" execute permission for the script include I'm using, but that doesn't help.

[RaghavSh]

Did you try to create "REST_Endpoint" type ACL for that table with operation execute?

[Mio Matsushita]

Thank you for your help.
However, I also tried granting a REST_Endpoint type ACL and it didn't work.

[Mio Matsushita · Accepted solution]

I was able to solve this problem.
The cause was that external users couldn't access the internal API that resolves the display name when setValue () was done to the list collector.

https://support.servicenow.com/kb?id=kb_article_view&sysparm_article=KB0866990
Referenced to the KB, it was said that this problem could be avoided by passing the display name as the third argument of setValue ().
In fact, the problem was solved by modifying the script as follows.

g_form.setValue('list_collector', 'xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx');

↓

g_form.setValue('list_collector', 'xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx','DisplayValue');

For Array

g_form.setValue('list_collector', sysIdArray, displayValueArray);