OAuth 2.0 in Zurich - "Access to unscoped api is not allowed" when calling Table API using Postman

[RajeshEdaguttu]

Hi Team,

I am using ServiceNow Zurich and integrating it with Postman using OAuth 2.0 (Authorization Code Grant).

OAuth authentication is successful, and I am able to generate an access token. However, when I call the Incident Table API:

GET /api/now/table/incident

I receive the following error:

{
"error": {
"message": "User Not Authorized",
"detail": "Access to unscoped api is not allowed"
},
"status": "failure"
}

My OAuth Application Registry has Scope Restriction set to Secured scopes only.

I also noticed that the following properties are not available in my Zurich instance:

glide.oauth.restrict_scopes
com.glide.rest.api.auth.scope.check.enable

Additionally, I couldn't find the Authentication Scopes module mentioned in some older documentation.

Could anyone please explain the recommended approach to resolve this issue in the Zurich release while using OAuth 2.0?

Thank you.

[Ankur Bawiskar · Accepted solution]

@RajeshEdaguttu 

for Zurich do this

1) Create a REST API Auth Scope for the API you want to call -> REST API Auth Scope 

2) Link that auth scope to the relevant REST API

3) Link the same auth scope to your OAuth Entity / Application Registry.

4) Re-issue the access token and call the API again

💡 If my response helped, please mark it as correct ✅ and close the thread 🔒— this helps future readers find the solution faster! 🙏

[Ankur Bawiskar · Accepted solution]

@RajeshEdaguttu 

for Zurich do this

1) Create a REST API Auth Scope for the API you want to call -> REST API Auth Scope 

2) Link that auth scope to the relevant REST API

3) Link the same auth scope to your OAuth Entity / Application Registry.

4) Re-issue the access token and call the API again

💡 If my response helped, please mark it as correct ✅ and close the thread 🔒— this helps future readers find the solution faster! 🙏

[RajeshEdaguttu]

Hi @Ankur Bawiskar ,

Thanks you for information. Provided information was useful. 

Regards,

Rajesh Edaguttu.

[Tanushree Maiti · Accepted solution]

Hi @RajeshEdaguttu 

1) Refer KB: KB2731346 "OAuth client does not have unrestricted access to unscoped APIs is not allowed" during an... 

Resolution

Change the 'Scope Restriction' field in the Application Registry to 'Broadly Scoped' to allow cross-scope access.

If cross-scope privileges are not desired, create an Application Registry in the scope of the resource trying to be accessed and keep the 'Scope Restriction' field as 'Securely Scoped' to limit interactions to that scope.

2)  Refer article: Limit the access granted to an OAuth client by using REST API authentication scopes.

[RajeshEdaguttu]

Hi @Tanushree Maiti ,

Thank you for valuable information. It's very useful.