---
sourceDocument: Brazil Platform security
sourceDocumentLink: https://www.servicenow.com/docs/r/platform-security

 Release :

    - brazil

ft:locale :

    - en-US

ft:publication_title :

    - Brazil Platform security

ft:clusterId :

    - psec

bundleId :

    - psec

workflow :

    - Platform


---

# Create an outbound REST message

# Create an outbound REST message {#ariaid-title1}

Release version: Brazil  
Updated September 10, 2026  
![](https://www.servicenow.com/docs/portal-asset/ico-clock) 1 minute to read  
Create outbound rest message to authorize instance as authorization server.

## Before you begin

Role required: oauth_admin

## Procedure

1. Navigate to System Web ServicesOutboundREST Message and then click New.
2. Fill out the form fields for the OAuth application record as described in .  
   Note the following field values:
   * Endpoint: URL of the instance that is the authorization server.
   * Authentication type: OAuth 2.0.
   * OAuth profile: OAuth profile that you created for the client server.
   {#create-an-outbound-rest-message__ul_ap1_yck_q1c}
3. On the REST message record, click Get OAuth Token.
4. Authenticate with the instance that provides the token---the method depends on the single-sign on integration.  
   You might use:
   * Your username and password that you use to authenticate to the instance.
   * The username and password for the IdP if is enabled. Click Use External Login to access the IdP login screen.  
     Note:  
     In order to automatically get redirected to the IdP login page, you must set the glide.authenticate.external system property.
   * Your code, if MFA is enabled.
   {#create-an-outbound-rest-message__ul_tm1_yck_q1c}
5. Click Allow or Deny to complete the authorization and issue the tokens.  
   The process that follows is outlined in [OAuth authorization code grant flow](https://www.servicenow.com/docs/_~iStz3bSyFRGGHerjXIsg "Authorization code grant flow allows a user to access a resource by authenticating directly with an OAuth server that trusts the resource, in contrast with authenticating with username/password credentials.").

*[\>]: and then