Restrict ritm creation via table API

[Mujahid Sharief]

The above requirement is not getting achieved with before insert BR, I need to block ritm creation via table api and only authorized channels like service catalog/approved API should be able to create.
Please help, if anyone has implemented such requirement. 

[Mujahid Sharief]

(function executeRule(current, previous /*null when async*/) {

    if (!current.subcategory.nil()) {
        valCatSubcat(current.category, current.subcategory);
    } else {
        valCat(current.category);
    }

    // --- Always move Pending → Work in Progress ---
    // Replace -5 and 2 with the actual backend values for your instance
    if (current.state == -5) {
        current.state = 2; // Work in Progress
    }

    function valCatSubcat(category, subcategory) {
        var qry = gs.getMessage(
            "name=incident^element=category^ORelement=subcategory^dependent_value={0}^value={1}",
            [category, subcategory]
        );

        var ch = new GlideRecord('sys_choice');
        ch.addEncodedQuery(qry);
        ch.query();

        var result = ch.hasNext();

        if (!result) {
            current.setAbortAction(true);
        }
    }

    function valCat(category) {
        var qry = gs.getMessage(
            "name=incident^element=category^value={0}",
            [category]
        );

        var ch = new GlideRecord('sys_choice');
        ch.addEncodedQuery(qry);
        ch.query();

        var result = ch.hasNext();

        if (!result) {
            current.setAbortAction(true);
        }
    }

})(current, previous);

[Mujahid Sharief]

(function executeRule(current, previous /*null when async*/) {

    // Ensure Pending Target Date exists
    if (current.state == 3 && current.pending_target_date) {
       
        // Compare with current date/time
        var now = new GlideDateTime();
        var target = new GlideDateTime(current.pending_target_date);

        if (target.before(now)) {
            // Move to Work in Progress
            current.state = 2;  // numeric value for "Work in Progress"
        }
    }

})(current, previous);

[Tanushree Maiti]

Hi @Mujahid Sharief ,

In this scenario,

We identified the integration user which we shared with the business (- years ago) who was using the table api.

We deactivated the integration user.

Created scripted api.

With that scripted API, we shared a new integration user credential  which has  limited permission / can only create RITM.

[Ankur Bawiskar]

@Mujahid Sharief 

but why are you giving Table API access on RITM table for 3rd party?