--- sourceDocument: Australia IT Service Management sourceDocumentLink: https://www.servicenow.com/docs/r/australia/it-service-management Release : - australia ft:locale : - en-US ft:publication_title : - Australia IT Service Management ft:clusterId : - itsm bundleId : - itsm workflow : - Technology --- # Integration with JFrog AppTrust application # Integration with JFrog AppTrust application {#ariaid-title1} Release version: Australia Updated March 12, 2026 ![](https://www.servicenow.com/docs/portal-asset/ico-clock) 4 minutes to read Summarize ![AI sparkle icon](https://servicenow.com/docs/portal-asset/ai-sparkle-icon) Summarized using AI This content was generated using new OpenAI-powered functionality. Results are provided on an as is basis and are not guaranteed to be accurate or complete. ## Summary of Integration with JFrog AppTrust application This integration connects ServiceNow DevOps Change Velocity with JFrog AppTrust applications to automate the creation, approval, and evidence collection of change requests as application versions progress through defined life-cycle stages such as Development, QA, Staging, and Production. Show full answer Show less The integration requires installation of the JFrog plugin (xsncjfrog) from the ServiceNow Store. It enables governance of application version promotions by linking JFrog AppTrust life-cycle stages with ServiceNow change management processes. ## Key Features * **Tool Connection:** Connect JFrog to ServiceNow using bearer token credentials, allowing discovery of JFrog projects, webhook reconfiguration, and association of business applications for event notifications. * **Permissions:** The bearer token must have read access to artifact repositories, projects, and builds in JFrog to enable seamless import and evidence retrieval. * **Project Discovery and Association:** ServiceNow automatically discovers JFrog projects and enables you to map them to ServiceNow business applications to ensure change requests are correctly linked. * **Webhook Configuration:** Webhooks can be configured at both project and tool levels to receive real-time notifications from JFrog when application versions are promoted. * **Automated Change Requests:** Promotion of application versions in JFrog triggers automatic creation of populated change requests in ServiceNow, which upon approval, communicate back to JFrog to advance the promotion. * **Change Approval Policies:** You can create custom change approval policies in ServiceNow that incorporate the JFrog Fetch evidences flow action to collect and attach promotion evidence before approval. * **Digital Signature Verification:** To ensure artifact integrity, ServiceNow supports verifying digital signatures using a public key managed through the Key Management Framework (KMF) and exported from JFrog. ## Practical Application for ServiceNow Customers By integrating JFrog AppTrust with DevOps Change Velocity, customers can automate and enforce change control processes around software promotions, improving governance and traceability. This integration streamlines promotion workflows by linking them directly to ServiceNow change requests, ensuring approvals and evidence collection are efficiently managed. Customers can expect: * Automated synchronization of application version promotions with change request lifecycle in ServiceNow. * Improved compliance through enforced approval policies and evidence attachment before promotion progresses. * Real-time event synchronization via webhooks, enhancing visibility into application promotion status. * Enhanced security by verifying digital signatures on application artifacts to prevent tampering. To implement, customers should ensure correct permission scopes on bearer tokens, associate business applications appropriately, configure webhooks for event notifications, and optionally set up change policies and digital signature verification for comprehensive governance. Integrate DevOps Change Velocity with JFrog AppTrust applications to automate change request creation, approval, and evidence collection as application versions are promoted through life-cycle stages. Install the JFrog plugin (x_snc_jfrog) by requesting it from the ServiceNow Store. Visit the [ServiceNow Store](https://store.servicenow.com/sn_appstore_store.do#!/store/home) to view all the available apps, and for information about submitting requests to the store. For cumulative release notes information for all released apps, see the [ServiceNow Store version history release notes](https://www.servicenow.com/docs/r/store-release-notes/sn-store-release-notes.html). ## JFrog AppTrust overview {#integration-with-jfrog-apptrust-application__section_af4_15p_k3c} JFrog AppTrust is an application risk governance solution containing applications. Within each application, administrators define a software development life-cycle as a sequential set of stages such as Development, QA, Staging, and Production, through which application versions are promoted. When a new version is built, it can be advanced from one life-cycle stage to the next through a process called promotion. Promotions can be subject to change control using DevOps Change Velocity. ## Tool record {#integration-with-jfrog-apptrust-application__section_jwj_w5p_k3c} Connect : The JFrog tool must be connected using bearer token credentials. This connection enables the following capabilities: * Discovery of JFrog projects within your instance. * Re-configuration of webhooks that are already existing. * Association of ServiceNow business applications with JFrog AppTrust applications to configure new webhooks for projects. * Enabling of change control for application promotion. {#integration-with-jfrog-apptrust-application__ul_gfp_1vp_k3c} Note: For information on connecting a JFrog tool, see [Onboard JFrog to DevOps Change Velocity --- Workspace](https://www.servicenow.com/docs/iyffuUj4l3R9mUwokKAkaw "Connect to your JFrog instance using the DevOps Change Workspace playbook to track artifact repositories published to JFrog."). Permission checks : The bearer token must have the required permissions for seamless discovery and import of tool objects. The permission check verifies access to the following objects: {#integration-with-jfrog-apptrust-application__table_nnc_dvp_k3c__entry__3} | Object | Permissions Required | Impact | |-|-|-| | Artifact repository | Read access to artifact repositories | Required to retrieve artifact details such as artifact name, version, and metadata | | Project | Read access to JFrog projects | Required to discover and list available projects in the JFrog instance | | Build | Read access to build information | Required to retrieve build details associated with artifacts for change request evidence | [ ] {#integration-with-jfrog-apptrust-application__table_nnc_dvp_k3c} Discover Projects : Once the tool is connected and permissions are verified, ServiceNow discovers the JFrog projects available in your instance. During discovery, ServiceNow queries the JFrog API to retrieve the list of projects and imports them as DevOps tool objects. Configure webhooks at project level : To configure new webhooks for a project, you must associate the ServiceNow business application with the JFrog AppTrust application. For more information, see [Associate business application](https://www.servicenow.com/docs/dKT4Q6DuZVIV3LcUS6ZTEQ "Associate a business application with a JFrog project in the JFrog tool record to create an AppTrust application in JFrog."). Configure webhooks at tool level : Once the projects are configured, you can automatically re-configure webhooks for the configured projects by selecting the Auto configure with new token button in the tool record. This action configures all previously configured JFrog projects with a new token. Webhooks enable JFrog to send real-time event notifications to ServiceNow, such as when an application version is promoted to a new life-cycle stage. Project tab : Use the Project tab in the tool record to associate ServiceNow business applications with JFrog AppTrust applications. This association ensures that change requests created during promotions are linked to the correct business application in ServiceNow, enabling accurate tracking and governance. To associate a business application, select a discovered project and map it to the appropriate ServiceNow business application. For detailed instructions, see [Associate business application](https://www.servicenow.com/docs/dKT4Q6DuZVIV3LcUS6ZTEQ "Associate a business application with a JFrog project in the JFrog tool record to create an AppTrust application in JFrog."). ## Change creation {#integration-with-jfrog-apptrust-application__section_em4_kwp_k3c} When an application version is promoted to a new stage in JFrog, the integration with DevOps Change Velocity (DCV) automatically creates a change request in ServiceNow, populated with the required evidences. In JFrog, change request creation can be enabled for a stage in the AppTrust Integrations page. Once the change request is reviewed and approved in ServiceNow, the approval is passed back to JFrog, which then automatically promotes the application version to the new stage. ## Change policy {#integration-with-jfrog-apptrust-application__section_yjr_tvx_k3c} You can add change approval policies to the model you created for JFrog change requests. For information on creating change approval policies, see [Creating change approval policies](https://www.servicenow.com/docs/ZbX_Apzrv_V1LTTmfQeTAA "Use the change approval policy to create change approval definitions and the change approval policy workflow to control the approval process for a change request."). In the change policy, to retrieve the evidence associated with a JFrog change request, you can use the JFrog Fetch evidences flow action. This flow action collects the relevant evidence data such as artifact promotion details from JFrog and attaches it to the corresponding change request. You can incorporate this flow action into your change policy's approval workflow. This ensures that the required evidence is available before the change request is approved or moved forward. ## Digital signature verification {#integration-with-jfrog-apptrust-application__section_gwz_ywp_k3c} ServiceNow supports digital signature verification to ensure the integrity and authenticity of application artifacts. A public key is required to verify digital signatures associated with an AppTrust application in JFrog. This verification ensures that artifacts have not been tampered with during the promotion process. You must first generate a key with the sn_kmf.cryptographic_manager role. Perform the following steps to generate a key: 1. Navigate to the Key Management Framework (KMF) module in your ServiceNow instance. 2. Select the x_snc_jfrog.signing_key module. 3. Generate the key. 4. Export the key from your JFrog instance. 1. In your JFrog instance, navigate to Administration \> Security \> Keys Management. 2. Look for the public key associated with your AppTrust configuration. 3. Export or copy the public key from this section. {#integration-with-jfrog-apptrust-application__ol_vtt_gts_g3c} {#integration-with-jfrog-apptrust-application__ol_mzm_wsx_k3c} * **[Associate business application](https://www.servicenow.com/docs/dKT4Q6DuZVIV3LcUS6ZTEQ)** Associate a business application with a JFrog project in the JFrog tool record to create an AppTrust application in JFrog.