---
sourceDocument: Brazil Platform security
sourceDocumentLink: https://www.servicenow.com/docs/r/platform-security
Release :
- brazil
ft:locale :
- en-US
ft:publication_title :
- Brazil Platform security
ft:clusterId :
- psec
bundleId :
- psec
workflow :
- Platform
---
# Normalise REST API access policy key generation
# Normalise REST API access policy key generation {#ariaid-title1}
Release version: Brazil
Updated September 10, 2026
 2 minutes to read
Summarize
 Summarized using AI
This content was generated using new OpenAI-powered functionality. Results are provided on an as is basis and are not guaranteed to be accurate or complete.
## Summary of Normalise REST API access policy key generation
This feature controls how ServiceNow builds lookup keys for REST API access policies when wildcard flags ("apply to all") are set on API path, HTTP method, or API version dimensions.
Access policies protect REST API endpoints by specifying their scope.
However, legacy data inconsistencies may cause policies to behave incorrectly by matching only a specific value instead of all values indicated by the wildcard flag.
Show full answer Show less
## Key Features
* **Normalization of lookup keys:** When enabled, the platform discards specific values if the "apply to all" flag is set, ensuring policies match all relevant requests within that dimension.
* **Configuration:** Controlled by the system property `glide.rest.policy.normalizeapplyallfields`, which is a boolean set to **true** by default.
* **Automatic cache update:** Policy lookup caches are updated automatically when this property is toggled, with no platform restart required.
## Key Outcomes
* Policies with inconsistent data (where both "apply to all" and a specific value are set) are corrected to match the full scope declared by the wildcard flags.
* Improved security by preventing accidental bypass of authentication requirements due to stale specific values in policy records.
* Unintended changes in policy enforcement scope are possible; so it is recommended to verify existing policy configurations before enabling normalization in production.
## Security Considerations
Without normalization, policies may silently fail to enforce authentication for requests outside the stale specific value, increasing the risk of unauthorized API access. Enabling normalization mitigates this risk by ensuring policies effectively cover their intended scope.
## Dependencies and Prerequisites
No additional dependencies or prerequisites are required to enable this feature.
The glide.rest.policy.normalize_apply_all_fields property controls how the platform builds lookup keys for REST API access policies when wildcard flags are set.
REST API endpoints on the platform can be protected by access policies. Each policy defines a scope by specifying which API path, HTTP method, and API version it covers. For each dimension, you can select either an exact value or
an apply to all wildcard flag. When a request arrives, the platform builds a lookup key from the request attributes and searches a cache of active policies for a match.
This property controls a normalization step in the key-building process. A policy record can be in an inconsistent state where the apply to all flag for a dimension is set to true, but a specific value is also stored in the same record. This is a legacy data condition.
Without normalization enabled, the platform builds the lookup key using the specific value, even though the flag indicates all values should match. This causes the policy to only match requests with that exact value. With
normalization enabled, when the apply to all flag is set, the specific value is discarded before the lookup key is built. This verifies the policy matches the full scope it declares.
{#sc-normalise-rest-api-access-policy-key-generation__table_9iu_9jk_2ik__entry__2}
| Attribute | Description |
|-|-|
| Configuration name | glide.rest.policy.normalize_apply_all_fields |
| Configuration type | System Properties ( /sys_properties_list.do) |
| Data type | Boolean |
| Recommended value | true |
| Default value | true |
| Fallback value | false |
| Category | [API and web service](https://www.servicenow.com/docs/8tbkriHSZwhTDBI3AxKzzQ "The API and Web Service category ensures that applications have appropriate authentication, authorization and session management, validate all input that traverses a trust boundary and include security controls for all API types.") |
| Security risk | * Severity score: 6.5 * CVSS rating: Medium * Security risk details: Access policies on this platform are authorization controls. They determine which authentication requirements apply to which API endpoints. A policy misconfiguration caused by the inconsistent data results in a policy that is registered as active but silently never matches incoming requests outside its stale specific value. An administrator may believe a policy is enforcing an authentication requirement across all HTTP methods, all API versions, or all resources. But requests outside the stale specific value bypass the policy entirely. The attack surface is any API call that should have been governed by such a policy. {#sc-normalise-rest-api-access-policy-key-generation__ul_g1g_s56_xwb} |
| Functional impact | Setting this property to true changes how the policy lookup cache is populated at startup and after policy record change. Policies with the inconsistent data condition will have their effective scope corrected: they match all requests within the "apply to all" dimension. They no longer match only the stale specific value. Policies without the inconsistent data condition are unaffected. The cache is automatically invalidated when the property is toggled. The change takes effect without a restart. Enabling this property widens the enforcement scope of affected policies. This is the intended behavior. Before production rollout, verify that existing policy configurations see no unintended authentication requirements changes. |
| Dependencies and prerequisites | None |
[ ]
{#sc-normalise-rest-api-access-policy-key-generation__table_9iu_9jk_2ik}