---
sourceDocument: Brazil API Reference
sourceDocumentLink: https://www.servicenow.com/docs/r/api-reference

 Release :

    - brazil

ft:locale :

    - en-US

ft:publication_title :

    - Brazil API Reference

ft:clusterId :

    - crapiref

bundleId :

    - crapiref

workflow :

    - Creator


---

# Script processors

# Script processors {#ariaid-title1}

Release version: Brazil  
Updated September 10, 2026  
![](https://www.servicenow.com/docs/portal-asset/ico-clock) 3 minutes to read  
Processors provide a customizable URL endpoint that can execute arbitrary server-side
JavaScript code and produce output such as TEXT or JSON. Creating custom processors is
deprecated.  
Note:  
This feature is deprecated. While legacy, existing custom processors continue to be supported, creating new custom processors has been deprecated. Instead, use the [Scripted REST APIs](https://www.servicenow.com/docs/lrq5et5qRFWUhx9Az0NIXg "The scripted REST API feature allows application developers to build custom web service APIs.").  
Warning:  
When creating a processor, ensure that you use parameter names that are specific to your processor. For example, if your processor exports a list of legal records, and a necessary parameter is the recipient's email address, don't use "email" as the parameter name. Create a more processor specific parameter name, such as legal_export_recipient_email. Failure to do so, and using instance parameter names, such as id, table, sys_id, service, catalog_id, or view (and others), can cause unexpected results.

## When to create processors

Do not create custom processors. This feature is deprecated. Please use the REST APIs instead
of creating custom processors. The remaining information is left for existing processors
only.

## Processor form

{#c_Processors__table_ck2_yr2_sr__entry__2}

| Field | Description |
|-|-|
| Name | Unique name of the processor. |
| Type | Programming language of the processor script. Options include: * java: do not select this option * script {#c_Processors__ul_x5t_js2_sr} |
| Application | Application containing this record. |
| Active | Flag to enable or disable the record. |
| CSRF protect | Option to protect the processor from running unless the instance uses a CSRF token. |
| Description | Description of the processor's function or purpose. |
| Parameters | List of available input parameters. Specify parameter values in the URL as \<parameter name\>=\<parameter value\>. Note: Parameter names must be processor-specific. Do not choose common parameter names that another processor might use. If you use a common parameter name, such as `id`, `sys_id` or `table` in a processor, it can break other functionality, since the processor wins when that parameter exists in a URL. For example, a processor with an `id` parameter, regardless of the Path value in the same record, breaks the Service Portal, which depends on that parameter for page identification. |
| Path | URI path used to call this processor. Call a processor from the URL as: <kbd class="ph userinput">https://&lt;instance name&gt;.service-now.com/&lt;Path&gt;.do</kbd> |
| Script | Immediately Invoked Function Expression to run when the system calls this processor. The function automatically provides input parameters for the following API objects. * g_request * g_response * g_processor {#c_Processors__ul_imr_j2k_sr} |
| Protection policy | Policy to use to protect this record's script. Options include: * None * Read-only * Protected {#c_Processors__ul_ypd_cv2_sr} |
[ ]

{#c_Processors__table_ck2_yr2_sr}

## Processor API components {#ariaid-title2}

Processors have access to dedicated API classes, objects, and methods.
{#r_ProcessorAPIComponents__table_ProcessorAPIComponents__entry__2}

| Class, object, or method | Description |
|-|-|
| `g_response` | An object of type HttpServletResponse. See [GlideServletResponse](https://www.servicenow.com/docs/8aN3QxNK586Fhcjrd_OX6Q#c_GlideServletResponseScopedAPI "The GlideServletResponse API provides methods to use in processor scripts."). |
| `setContentType('text/html;charset=UTF-8')` | A [GlideServletResponse](https://www.servicenow.com/docs/8aN3QxNK586Fhcjrd_OX6Q#c_GlideServletResponseScopedAPI "The GlideServletResponse API provides methods to use in processor scripts.") method to set the content type of the response being sent to the client. |
| `g_request` | An object of type HttpServletRequest. See [HttpServletRequest](https://www.servicenow.com/docs/R9mijEIFv6cHLjXmBQu1wg#c_GlideServletRequestScopedAPI "The GlideServletRequest API provides methods to use in processor scripts."). |
| `getParameter()` | A glide method to get the value of a URL parameter. |
| `canRead()` | A GlideRecord method to determine if the user can read data from a table. See [GlideRecord](https://www.servicenow.com/docs/FgjTlm40d6FI5VbkwXi4qQ#c_GlideRecordScopedAPI "The scoped GlideRecord API is used for database operations."). |
| `g_processor` | A simplified servlet for processors. See [GlideScriptedProcessor](https://www.servicenow.com/docs/m7z8GPVjbTPRszDYHk8vvQ#c_GlideScriptedProcessorScopedAPI "The GlideScriptedProcessor API provides a customizable URL endpoint that can execute arbitrary server-side JavaScript code and produce output such as TEXT, JSON, or HTML. ServiceNow processors are equivalent to Java servlets."). |
| `writeOutput()` | A [GlideScriptedProcessor](https://www.servicenow.com/docs/m7z8GPVjbTPRszDYHk8vvQ#c_GlideScriptedProcessorScopedAPI "The GlideScriptedProcessor API provides a customizable URL endpoint that can execute arbitrary server-side JavaScript code and produce output such as TEXT, JSON, or HTML. ServiceNow processors are equivalent to Java servlets.") method to display information on the client. |
| `g_target` | An object containing the target table name of a processor URL. For example, a processor containing the URI incident.do applies to the Incident table. |
[Table 1. Processor API components]

{#r_ProcessorAPIComponents__table_ProcessorAPIComponents}

## Secure a script processor against unauthorized access {#ariaid-title3}

You can protect your processor against unauthorized use by using role restrictions,
and protect it by requiring a CSRF token.

### About this task

Note:  
This feature is deprecated. While legacy, existing custom processors continue to be supported, creating new custom processors has been deprecated. Instead, use the [Scripted REST APIs](https://www.servicenow.com/docs/lrq5et5qRFWUhx9Az0NIXg "The scripted REST API feature allows application developers to build custom web service APIs.").

You can re-use a table's user role restrictions to protect it from access by your
processor. This protection method assumes the processor will access table data.

### Procedure

1. Create or select a user role that has access to the table the processor script calls.
2. Navigate to System DefinitionProcessors.
3. In Script, add the following code block.  

       var now_GR = new GlideRecord('your_table_name');
       // canRead() compares the table's ACL to the user making this request, and returns true if the logged-in user has read access to this table
       if(gr.canRead())  
       { 
         // Perform table query here
         g_processor.writeOutput('Success!'); 
       } else { 
         g_processor.writeOutput('You do not have permission to read table your_table_name'); 
       }

4. Update the code block to use other access restrictions as needed.  
   Available access functions include:  
   * canCreate()
   * canRead()
   * canWrite()
   * canDelete()
   {#t_SecureAProcessor__ul_ccy_3z2_sr}
5. Click Update.

### Protect a processor with a CSRF token {#ariaid-title4}

You can protect a processor by requiring a CSRF token.

#### About this task

Script type processors can require a CSRF token check before the processor runs.

#### Procedure

1. Navigate to AllSystem DefinitionProcessors.
2. Open a processor record.
3. Select the CSRF protect option.
4. Click Update.
**Related topics**   

* [Assign a role to a user](https://www.servicenow.com/docs/access?context=t_AssignARoleToAUser&version=brazil&pubname=brazil-platform-administration&ft:locale=en-US)

*[\>]: and then