---
sourceDocument: Australia Platform security
sourceDocumentLink: https://www.servicenow.com/docs/r/australia/platform-security

 Release :

    - australia

ft:locale :

    - en-US

ft:publication_title :

    - Australia Platform security

ft:clusterId :

    - psec

bundleId :

    - psec

workflow :

    - Platform


---

# Troubleshooting

# REST API scope troubleshooting {#ariaid-title1}

Release version: Australia  
Updated March 12, 2026  
![](https://www.servicenow.com/docs/portal-asset/ico-clock) 3 minutes to read
Summarize  
![AI sparkle icon](https://servicenow.com/docs/portal-asset/ai-sparkle-icon) Summarized using AI  
This content was generated using new OpenAI-powered functionality. Results are provided on an as is basis and are not guaranteed to be accurate or complete.  

## Summary of REST API Scope Troubleshooting

This document provides guidance on troubleshooting common issues related to the REST API scope in ServiceNow.
Effective troubleshooting can help ensure that REST APIs function correctly with appropriate authentication scopes, which is crucial for securing API access and managing user permissions.
Show full answer Show less  

## Key Features

* **Authentication Scope Checks:** Ensure that your API is linked to the correct auth scope and that the corresponding sysapiaccesspolicy record is active.
* **OAuth Token Management:** Understand how OAuth tokens interact with different auth scopes and how to handle token access permissions effectively.
* **Error Handling:** Learn to recognize and address common error messages, such as "Missing required api access scope," which indicates scope validation failures.
* **User Account Restoration:** Steps for restoring a deleted pre-defined user account by exporting from another instance or updating system properties.

## Key Outcomes

By following the troubleshooting actions and understanding the FAQs outlined, ServiceNow customers can:

* Resolve authentication issues related to REST API calls.
* Ensure that OAuth tokens have the correct scopes for accessing APIs.
* Manage user account and auth scope configurations effectively.
* Understand the limitations of auth scope checks, particularly regarding BasicAuth and mutualAuth methods.  
Troubleshooting actions can help resolve common issues when setting up or running the
REST API scope.
{#rest-api-scope-troubleshooting__table_upj_wjr_4tb__entry__2}

| Issue | Action |
|-|-|
| REST API is linked with auth scope, however in runtime there is no auth scope check even using Bearer token authentication. | * Make sure the sys_api_access_policy record is active. Runtime ignores inactive records. * Check if property com.glide.rest.api.auth.scope.check.enable is set to false. * Check if the OAuth token has `useraccount` auth scope. {#rest-api-scope-troubleshooting__ul_t3h_1kr_4tb} |
| REST API is linked with auth_scope1, however the access token which has auth_scope2 is also able to access it. | * Check if this record is active. * Check for this REST, check if any other records, which have the same APIs but different apply methods, versions, or resource. {#rest-api-scope-troubleshooting__ul_mmz_dkr_4tb} |
| REST API is linked with auth scope, however in runtime there is no auth scope check for basicAuth and mutualAuth. | It is expected since the REST API auth scope only applies to the OAuth access token or OIDC token. It doesn't apply BasicAuth, Session Cookie and Certificate based authentication. |
| REST API call return 403 when using the OAuth access token. | Check for the error message "Missing required api access scope". If found then the auth scope check fails for this REST API |
| Pre-defined `useraccount` is deleted and not sure to restore. | Export `useraccount` as `xml` from the other instance and import it or create an `useraccount` and modify system property glide.oauth.token.scope.useraccount to the newly created sys_id record. |
[Table 1. Troubleshooting]

{#rest-api-scope-troubleshooting__table_upj_wjr_4tb}

## Frequently asked questions {#rest-api-scope-troubleshooting__section_l1h_zkr_4tb}

Following are some of the frequently asked question when using the REST API Auth
scope:

Can one OAuth token be linked with several auth scopes?
:   Yes, one `oauth_entity` can be linked with multiple auth scopes, every
    OAuth token issued by this `oauth_entity` has the same auth scopes.

Can different OAuth tokens with different auth scopes access the same REST API?
:   Yes, for the same REST API, it may be accessed by different auth scopes. As long as one auth scope is matched, the auth scope returns the results.

Can OAuth access token with `useraccount` auth scope access any REST APIs?
:   Yes, the `useraccount` has full access to auth scope.

Can OAuth access token OAuth scope be changed dynamically?
:   Yes, the auth scoped is not hard-coded with the access token in the `oauth_credential` table. Instead auth scope is getting from linked `oauth_entity` during runtime.

Can OAuth token keep same auth scopes after refresh?
:   Yes, auth scope will not change after token refresh, unless `oauth_admin` modify auth scope linked with `oauth_entity`.

Pre-defined `useraccount` auth scope record is deleted, can a new auth scope with name `useraccount` be created?
:   Creating a new auth scope with the same `useraccount` doesn't work. In the runtime, it uses the `sys_id` instead of name to do the auth scope check, modify the system property
    glide.oauth.token.scope.useraccount to the newly created `sys_id` record.

If admin modify auth scoped linked with `oauth_entity`, are all the existing OAuth access token issued by this OAuth entity changed also?
:   Yes, the auth scope is not directly linked with the OAuth access token, it is getting from `oauth_entity` during runtime.

Can different OAuth access tokens issued by the same `oauth_entity` have different auth scopes?
:   No, all access to the token is issued by the same `oauth_entity` and always have the same auth scopes.

Can a user define different auth scopes for a particular endpoint?
:   No, there is a unique constrain check for a particular REST API endpoint. However for the same REST API endpoint, it may have more than one matched auth scopes.

Is the auth scope check used for BasicAuth also?
:   No, auth scope check is only OAuth access token and OIDC token, it is not applied for basicAuth and mutualAuth