Flow Designer - Unable to Create REQ/RITM from Inbound Email for External Guest User

[PaluriK]

Requirement:

When an email is received from an external guest user (the sender does not exist in the sys_user table), the flow should create a REQ and RITM successfully.

Working as expected with the users exist in the sys_user table and REQ/RITM is created successfully. 

Current Setup:

- Flow Trigger: Inbound Email

- The flow is triggered successfully.

- Catalog variables are populated.

- Requester email is stored as a String variable (not a reference).

- The sender is an external email address and does not exist in sys_user.

Issue:

The flow reaches the catalog request creation step but fails while creating the REQ/RITM. The execution shows a cart-related error attached the screenshot, and no REQ or RITM is created.

Can anyone help me on this issue if the Create Catalog Request action require a valid sys_user record even if the requester email is stored as a String?

2. Is there any supported approach to create a REQ/RITM for external users who are not present in the sys_user table?

3. Is there any additional configuration required for the Cart API or guest users?

Kindly let me know if you need any further details. I will be happy to share as soon as possible. 

[Tanushree Maiti]

Hi @PaluriK 

Refer: KB0821206 Understand inbound email flow behavior with Run as property settings 

Resolution

Inbound email triggered flows always run as the user who sent the email (or as the guest user if the email sender cannot be resolved to a sys_user record). 

Unlike other flow types where you can choose to run as either system user or the initiating user, inbound email flows follow these rules: 

• The flow always executes as the email sender.
• If the system cannot identify the sender, the flow runs as the Guest user.
• All actions in the flow are subject to the sender's access control list (ACL) restrictions.

To test access controls for an inbound email flow:

1. Impersonate a typical inbound email user.
2. Manually trigger the flow to verify behavior.

If your flow requires elevated privileges that the email sender may not have: 

1. Move those actions to a subflow.
2. Configure the subflow with Run as System property.
3. The subflow runs with system privileges even though the main flow runs as the email sender.

[Shruti]

Hi

Cart functionality typically expect a valid user context. When the inbound email is received from an external sender who does not exist in the sys_user table, the request creation can fail because there is no valid user record associated with the request.

As a supported approach, consider creating a dedicated Guest User profile in ServiceNow and using that user as the requester context for inbound requests from external email addresses.

Steps:

1. Create a Guest User record in the sys_user table.
2. When an inbound email is received from an external sender, identify that the sender does not exist in sys_user.
3. Create the REQ/RITM using the Guest User as the Requested For user while storing the external sender's email address in a catalog variable or additional field for reference.
4. If you are using the Cart API, ensure the request is executed using valid credentials or a user context associated with the Guest User profile, as the Cart API requires an authenticated user context to create catalog requests successfully.

This approach maintains a valid ServiceNow user reference for the request lifecycle while still allowing requests to be submitted on behalf of external users who do not have accounts in the instance. 

[Ankur Bawiskar]

@PaluriK 

check if your catalog item has any user criteria which is blocking external users from submitting

Check "Available For" and "Not Available For" related list

💡 If my response helped, please mark it as correct ✅ and close the thread 🔒— this helps future readers find the solution faster! 🙏