---
sourceDocument: Brazil Platform security
sourceDocumentLink: https://www.servicenow.com/docs/r/platform-security

 Release :

    - brazil

ft:locale :

    - en-US

ft:publication_title :

    - Brazil Platform security

ft:clusterId :

    - psec

bundleId :

    - psec

workflow :

    - Platform


---

# Restricted Binding functionality in Case Bearer authorization

# Restricted Binding functionality in Case Bearer authorization {#ariaid-title1}

Release version: Brazil  
Updated September 10, 2026  
![](https://www.servicenow.com/docs/portal-asset/ico-clock) 1 minute to read  
Restricted Binding Functionality in Case Bearer Authorization
Use the glide.oauth.enforce_restricted_binding_for_ui system property and enable restricted binding for an OAuth entity to prevent the access tokens generated by that entity from being used for UI calls (For
example, <kbd class="ph userinput">incident_list.do</kbd>).

When restricted binding is turned off, the access token generated can be used for UI calls regardless of the value of the system property.

When the glide.oauth.enforce_restricted_binding_for_ui system property isn't set to true or restricted binding is turned off, a user with the access token to access an API (for example, a mobile API) can obtain a session and use it to access other restricted resources on the instance (for example, <kbd class="ph userinput">incident_list.do</kbd>).

Ensure that the glide.oauth.enforce_restricted_binding_for_ui property is set to true.

## More information {#sc-restricted-binding-functionality-in-case-bearer-authorization__section_qhx_1b1_xwb}

{#sc-restricted-binding-functionality-in-case-bearer-authorization__table_ajc_b43_3kb__entry__2}

| Attribute | Description |
|-|-|
| Configuration name | glide.oauth.enforce_restricted_binding_for_ui |
| Configuration type | System Properties (/sys_properties_list.do) |
| Data type | Boolean |
| Recommended value | true |
| Default value | true |
| Fallback value | false |
| Category | [Architecture, design, and threat modeling](https://www.servicenow.com/docs/flZLwb5A4NTOzIsm_05BPA "This broad control addresses high level design considerations and key elements to implement a secure application. This covers the tenants of availability, confidentiality processing integrity, non-repudiation and privacy. Additionally, elements of a secure software development lifecycle are included.") |
| Security risk | * Severity score: 5.0 * CVSS score: Medium * Security risk details: When the glide.oauth.enforce_restricted_binding_for_ui system property isn't set to true, a user with the access token to access an API (for example, a mobile API) can obtain a session and use it to access other restricted resources on the instance (for example, <kbd class="ph userinput">incident_list.do</kbd>). {#sc-restricted-binding-functionality-in-case-bearer-authorization__ul_g1g_3sf_xwb} |
| Functional impact | When the glide.oauth.enforce_restricted_binding_for_ui system property is set to true and restricted binding is enabled for a specific OAuth entity, the access token generated using that entity can't be used for UI calls (for example, <kbd class="ph userinput">incident_list.do</kbd>). |
| Dependencies and prerequisites | None |
[ ]

{#sc-restricted-binding-functionality-in-case-bearer-authorization__table_ajc_b43_3kb}