Can it work with tables beyond incidents?

Yes — the Table API resource reaches arbitrary tables, which matters because most ServiceNow instances carry custom tables specific to that organisation.

How do I attach a file to a record?

Through the attachment resource, which uploads binary data from the incoming item against the record you specify.

Why do the available operations change?

They depend on the selected resource, and some parameters only become required once a particular operation is chosen — so pick the resource first.

Which credential does it need?

A ServiceNow credential for the instance you are managing.

ServiceNow

Manage ServiceNow incidents, users, attachments, and table records

Overview

The ServiceNow tool interacts with ServiceNow REST APIs to manage ITSM data. It supports 10 resources: Attachment (upload, download, delete, list with binary data support), Business Service (list), Configuration Item (list), Department (list), Dictionary (list), Incident (CRUD), Table Record (generic CRUD for any table), User (CRUD with lookup by ID or username), User Group (list), and User Role (list). Attachment operations use binary data: upload reads from the item’s binary property and POSTs raw bytes; download fetches file content and writes to the binary store. Uses Basic Auth with instance subdomain.

Category: Productivity
Tool Name: servicenow
Version: 1

Appearance: Icon: lucide-Headphones | Color: #62D84E

Node Type

Action (Binary) — handles file/binary data operations

Input / Output

Direction	Port(s)
Input	`Input`
Output	`Output`, `Error`

Credentials

This tool requires ServiceNow credentials. See the Credentials Guide for setup instructions.

Resources

Resource	Value
Attachment	`attachment`
Business Service	`businessService`
Configuration Item	`configurationItems`
Department	`department`
Dictionary	`dictionary`
Incident	`incident`
Table Record	`tableRecord`
User	`user`
User Group	`userGroup`
User Role	`userRole`

Operations

Attachment (attachment)

Operation	Value	Description
Upload	`upload`	Upload an attachment to a specific table record
Delete	`delete`	Delete an attachment
Get	`get`	Get an attachment
Get Many	`getAll`	Get many attachments on a table

Business Service (businessService)

Operation	Value	Description
Get Many	`getAll`	Get many records

Configuration Item (configurationItems)

Operation	Value	Description
Get Many	`getAll`	Get many records

Department (department)

Operation	Value	Description
Get Many	`getAll`	Get many records

Dictionary (dictionary)

Operation	Value	Description
Get Many	`getAll`	Get many records

Incident (incident)

Operation	Value	Description
Create	`create`	Create an incident
Delete	`delete`	Delete an incident
Get	`get`	Get an incident
Get Many	`getAll`	Get many incidents
Update	`update`	Update an incident

Table Record (tableRecord)

Operation	Value	Description
Create	`create`	Create a table record
Delete	`delete`	Delete a table record
Get	`get`	Get a table record
Get Many	`getAll`	Get many table records
Update	`update`	Update a table record

User (user)

Operation	Value	Description
Create	`create`	Create a user
Delete	`delete`	Delete a user
Get	`get`	Get a user
Get Many	`getAll`	Get many users
Update	`update`	Update a user

User Group (userGroup)

Operation	Value	Description
Get Many	`getAll`	Get many records

User Role (userRole)

Operation	Value	Description
Get Many	`getAll`	Get many records

Parameters

Attachment: Upload

Parameter	Type	Required	Default	Description
Table Name (`tableName`)	`string`	Yes	—	Name of the ServiceNow table (e.g. incident, sys_user). Use GET /now/doc/table/schema to list tables.
Table Record ID	`string`	Yes	—	Sys_id of the record to attach the file to
Input Data Field Name	`string`	Yes	`data`	Name of the binary property that contains the data to upload
Options (`uploadOptions`)	`collection`	No	`{}`	Extra settings for the upload.
— File Name Override	`string`	No	—	Override the file name for the attachment

Attachment: Delete

Parameter	Type	Required	Default	Description
Attachment ID	`string`	Yes	—	Sys_id value of the attachment

Attachment: Get

Parameter	Type	Required	Default	Description
Attachment ID	`string`	Yes	—	Sys_id value of the attachment
Download Attachments	`boolean`	No	`false`	Whether to download the attachment file content as binary data
Output Field	`string`	No	`data`	Name of the binary property to store the downloaded file (shown when Download Attachments is `true`)

Attachment: Get Many

Parameter	Type	Required	Default	Description
Table Name (`tableName`)	`string`	Yes	—	Name of the ServiceNow table (e.g. incident, sys_user). Use GET /now/doc/table/schema to list tables.
Download Attachments	`boolean`	No	`false`	Whether to download the attachment file content as binary data
Output Field	`string`	No	`data`	Name of the binary property to store the downloaded file (shown when Download Attachments is `true`)
Return All (`returnAll`)	`boolean`	No	`false`	Whether to return all results or only up to a given limit
Limit (`limit`)	`number`	No	`50`	Max number of results to return (shown when Return All is `false`)
Options (`attachmentGetOptions`)	`collection`	No	`{}`	Extra settings for the listing.
— Filter	`string`	No	—	An encoded query string to filter the attachment results

Business Service: Get Many

Parameter	Type	Required	Default	Description
Return All (`returnAll`)	`boolean`	No	`false`	Whether to return all results or only up to a given limit
Limit (`limit`)	`number`	No	`50`	Max number of results to return (shown when Return All is `false`)
Options (`options`)	`collection`	No	`{}`	Query settings applied to the request.
— Exclude Reference Link	`boolean`	No	`false`	Whether to exclude Table API links for reference fields
— Fields	`string`	No	—	Comma-separated list of field names to return
— Filter	`string`	No	—	Encoded query string to filter results. SECURITY: power-user field — should be a static literal. Never interpolate untrusted upstream values, as `^` and `^OR` separators can broaden the query.
— Return Values	`options`	No	`false`	Choose which values to return
				Options: `false` (Actual Values), `all` (Both), `true` (Display Values)

Configuration Item: Get Many

Parameter	Type	Required	Default	Description
Return All (`returnAll`)	`boolean`	No	`false`	Whether to return all results or only up to a given limit
Limit (`limit`)	`number`	No	`50`	Max number of results to return (shown when Return All is `false`)
Options (`options`)	`collection`	No	`{}`	Query settings applied to the request.
— Exclude Reference Link	`boolean`	No	`false`	Whether to exclude Table API links for reference fields
— Fields	`string`	No	—	Comma-separated list of field names to return
— Filter	`string`	No	—	Encoded query string to filter results. SECURITY: power-user field — should be a static literal. Never interpolate untrusted upstream values, as `^` and `^OR` separators can broaden the query.
— Return Values	`options`	No	`false`	Choose which values to return
				Options: `false` (Actual Values), `all` (Both), `true` (Display Values)

Department: Get Many

Parameter	Type	Required	Default	Description
Return All (`returnAll`)	`boolean`	No	`false`	Whether to return all results or only up to a given limit
Limit (`limit`)	`number`	No	`50`	Max number of results to return (shown when Return All is `false`)
Options (`options`)	`collection`	No	`{}`	Query settings applied to the request.
— Exclude Reference Link	`boolean`	No	`false`	Whether to exclude Table API links for reference fields
— Fields	`string`	No	—	Comma-separated list of field names to return
— Filter	`string`	No	—	Encoded query string to filter results. SECURITY: power-user field — should be a static literal. Never interpolate untrusted upstream values, as `^` and `^OR` separators can broaden the query.
— Return Values	`options`	No	`false`	Choose which values to return
				Options: `false` (Actual Values), `all` (Both), `true` (Display Values)

Dictionary: Get Many

Parameter	Type	Required	Default	Description
Return All (`returnAll`)	`boolean`	No	`false`	Whether to return all results or only up to a given limit
Limit (`limit`)	`number`	No	`50`	Max number of results to return (shown when Return All is `false`)
Options (`options`)	`collection`	No	`{}`	Query settings applied to the request.
— Exclude Reference Link	`boolean`	No	`false`	Whether to exclude Table API links for reference fields
— Fields	`string`	No	—	Comma-separated list of field names to return
— Filter	`string`	No	—	Encoded query string to filter results. SECURITY: power-user field — should be a static literal. Never interpolate untrusted upstream values, as `^` and `^OR` separators can broaden the query.
— Return Values	`options`	No	`false`	Choose which values to return
				Options: `false` (Actual Values), `all` (Both), `true` (Display Values)

Incident: Create

Parameter	Type	Required	Default	Description
Short Description (`short_description`)	`string`	Yes	—	Short description of the incident
Additional Fields (`additionalFields`)	`collection`	No	`{}`	Extra incident fields to set on creation.
— Assigned To	`string`	No	—	Sys_id of the user the incident is assigned to
— Assignment Group	`string`	No	—	Sys_id of the assignment group
— Business Service	`string`	No	—	Sys_id of the business service
— Caller ID	`string`	No	—	Sys_id of the caller
— Category	`string`	No	—	Category of the incident (use GET /now/table/sys_choice?element=category&name=incident to list)
— Close Notes	`string`	No	—	Close notes for the incident
— Configuration Items	`string`	No	—	Sys_id of the configuration item (cmdb_ci)
— Contact Type	`options`	No	—	How the incident was reported.
				Options: `email`, `phone`, `self-service`, `walk-in`
— Description	`string`	No	—	Full description of the incident
— Impact	`options`	No	`1`	Impact level of the incident
				Options: `1` (High), `2` (Medium), `3` (Low)
— Resolution Code	`string`	No	—	Resolution code (close_code) for the incident
— State	`string`	No	—	State of the incident (use GET /now/table/sys_choice?element=state&name=incident to list)
— Subcategory	`string`	No	—	Subcategory of the incident
— Urgency	`options`	No	`1`	Urgency level of the incident
				Options: `1` (High), `2` (Medium), `3` (Low)

Incident: Delete

Parameter	Type	Required	Default	Description
Incident ID	`string`	Yes	—	Sys_id of the incident

Incident: Get

Parameter	Type	Required	Default	Description
Incident ID	`string`	Yes	—	Sys_id of the incident
Options (`options`)	`collection`	No	`{}`	Query settings applied to the request.
— Exclude Reference Link	`boolean`	No	`false`	Whether to exclude Table API links for reference fields
— Fields	`string`	No	—	Comma-separated list of field names to return
— Filter	`string`	No	—	Encoded query string to filter results (ServiceNow query syntax). SECURITY: power-user field — should be a static literal. Never interpolate untrusted upstream values, as `^` and `^OR` separators can broaden the query.
— Return Values	`options`	No	`false`	Choose which values to return
				Options: `false` (Actual Values), `all` (Both), `true` (Display Values)

Incident: Get Many

Parameter	Type	Required	Default	Description
Return All (`returnAll`)	`boolean`	No	`false`	Whether to return all results or only up to a given limit
Limit (`limit`)	`number`	No	`50`	Max number of results to return (shown when Return All is `false`)
Options (`options`)	`collection`	No	`{}`	Query settings applied to the request.
— Exclude Reference Link	`boolean`	No	`false`	Whether to exclude Table API links for reference fields
— Fields	`string`	No	—	Comma-separated list of field names to return
— Filter	`string`	No	—	Encoded query string to filter results (ServiceNow query syntax). SECURITY: power-user field — should be a static literal. Never interpolate untrusted upstream values, as `^` and `^OR` separators can broaden the query.
— Return Values	`options`	No	`false`	Choose which values to return
				Options: `false` (Actual Values), `all` (Both), `true` (Display Values)

Incident: Update

Parameter	Type	Required	Default	Description
Incident ID	`string`	Yes	—	Sys_id of the incident
Update Fields (`updateFields`)	`collection`	No	`{}`	The incident fields to change. Fields you leave out keep their current value.
— Assigned To	`string`	No	—	Sys_id of the user the incident is assigned to
— Assignment Group	`string`	No	—	Sys_id of the assignment group
— Business Service	`string`	No	—	Sys_id of the business service
— Caller ID	`string`	No	—	Sys_id of the caller
— Category	`string`	No	—	Category of the incident
— Close Notes	`string`	No	—	Close notes for the incident
— Configuration Items	`string`	No	—	Sys_id of the configuration item
— Contact Type	`options`	No	—	How the incident was reported.
				Options: `email`, `phone`, `self-service`, `walk-in`
— Description	`string`	No	—	Full description of the incident
— Impact	`options`	No	`1`	Impact level of the incident
				Options: `1` (High), `2` (Medium), `3` (Low)
— On Hold Reason	`string`	No	—	Reason for holding the incident (applies when state is On Hold)
— Resolution Code	`string`	No	—	Resolution code (close_code) for the incident
— State	`string`	No	—	State of the incident
— Subcategory	`string`	No	—	Subcategory of the incident
— Urgency	`options`	No	`1`	Urgency level of the incident
				Options: `1` (High), `2` (Medium), `3` (Low)
— Work Notes	`string`	No	—	Work notes for the incident

Table Record: Create

Parameter	Type	Required	Default	Description
Table Name (`tableName`)	`string`	Yes	—	Name of the ServiceNow table (e.g. incident, sys_user, cmdb_ci). Use GET /now/doc/table/schema to list all tables.
Data to Send	`options`	No	`columns`	Where the column values come from.
				Options: `mapInput` (use when input field names match ServiceNow column names), `columns` (set the value for each column manually), `nothing` (do not send any column data)
Inputs to Ignore	`string`	No	—	Comma-separated list of input properties to exclude from auto-mapping (shown when Data to Send is `mapInput`)
Fields to Send	`json`	No	`{}`	JSON object mapping column names to values, e.g. {“short_description”: “Test”, “priority”: “1”} (shown when Data to Send is `columns`)

Table Record: Delete

Parameter	Type	Required	Default	Description
Table Name (`tableName`)	`string`	Yes	—	Name of the ServiceNow table (e.g. incident, sys_user, cmdb_ci). Use GET /now/doc/table/schema to list all tables.
Record ID	`string`	Yes	—	Sys_id of the record

Table Record: Get

Parameter	Type	Required	Default	Description
Table Name (`tableName`)	`string`	Yes	—	Name of the ServiceNow table (e.g. incident, sys_user, cmdb_ci). Use GET /now/doc/table/schema to list all tables.
Record ID	`string`	Yes	—	Sys_id of the record
Options (`options`)	`collection`	No	`{}`	Query settings applied to the request.
— Exclude Reference Link	`boolean`	No	`false`	Whether to exclude Table API links for reference fields
— Fields	`string`	No	—	Comma-separated list of field names to return
— Filter	`string`	No	—	Encoded query string to filter results. SECURITY: power-user field — should be a static literal. Never interpolate untrusted upstream values, as `^` and `^OR` separators can broaden the query.
— Return Values	`options`	No	`false`	Choose which values to return
				Options: `false` (Actual Values), `all` (Both), `true` (Display Values)

Table Record: Get Many

Parameter	Type	Required	Default	Description
Table Name (`tableName`)	`string`	Yes	—	Name of the ServiceNow table (e.g. incident, sys_user, cmdb_ci). Use GET /now/doc/table/schema to list all tables.
Return All (`returnAll`)	`boolean`	No	`false`	Whether to return all results or only up to a given limit
Limit (`limit`)	`number`	No	`50`	Max number of results to return (shown when Return All is `false`)
Options (`options`)	`collection`	No	`{}`	Query settings applied to the request.
— Exclude Reference Link	`boolean`	No	`false`	Whether to exclude Table API links for reference fields
— Fields	`string`	No	—	Comma-separated list of field names to return
— Filter	`string`	No	—	Encoded query string to filter results. SECURITY: power-user field — should be a static literal. Never interpolate untrusted upstream values, as `^` and `^OR` separators can broaden the query.
— Return Values	`options`	No	`false`	Choose which values to return
				Options: `false` (Actual Values), `all` (Both), `true` (Display Values)

Table Record: Update

Parameter	Type	Required	Default	Description
Table Name (`tableName`)	`string`	Yes	—	Name of the ServiceNow table (e.g. incident, sys_user, cmdb_ci). Use GET /now/doc/table/schema to list all tables.
Record ID	`string`	Yes	—	Sys_id of the record
Data to Send	`options`	No	`columns`	Where the column values come from.
				Options: `mapInput` (use when input field names match ServiceNow column names), `columns` (set the value for each column manually), `nothing` (do not send any column data)
Inputs to Ignore	`string`	No	—	Comma-separated list of input properties to exclude from auto-mapping (shown when Data to Send is `mapInput`)
Fields to Send	`json`	No	`{}`	JSON object mapping column names to values, e.g. {“short_description”: “Test”, “priority”: “1”} (shown when Data to Send is `columns`)

User: Create

Parameter	Type	Required	Default	Description
Short Description (`short_description`)	`string`	Yes	—	Short description of the user
Additional Fields (`additionalFields`)	`collection`	No	`{}`	Extra user fields to set on creation.
— Active	`boolean`	No	`false`	Whether to activate the user
— Building	`string`	No	—	The user’s building.
— City	`string`	No	—	The user’s city.
— Company	`string`	No	—	The user’s company.
— Country	`string`	No	—	The user’s country.
— Department	`string`	No	—	The user’s department.
— Email	`string`	No	—	The user’s email address.
— First Name	`string`	No	—	The user’s first name.
— Gender	`string`	No	—	The user’s gender.
— Home Phone	`string`	No	—	The user’s home phone number.
— Last Name	`string`	No	—	The user’s last name.
— Location	`string`	No	—	The user’s location.
— Manager	`string`	No	—	The user’s manager.
— Middle Name	`string`	No	—	The user’s middle name.
— Mobile Phone	`string`	No	—	The user’s mobile phone number.
— Password	`string`	No	—	The user’s password.
— Password Needs Reset	`boolean`	No	`false`	Whether the password is flagged as needing a reset.
— Phone	`string`	No	—	The user’s phone number.
— Roles	`string`	No	—	Comma-separated sys_ids of user roles
— Source	`string`	No	—	The source recorded on the user record.
— State	`string`	No	—	The user’s state.
— Street	`string`	No	—	The user’s street address.
— Username	`string`	No	—	The user’s username.
— Zip Code	`string`	No	—	The user’s ZIP or postal code.

User: Delete

Parameter	Type	Required	Default	Description
User ID (`id`)	`string`	Yes	—	Sys_id of the user

User: Get

Parameter	Type	Required	Default	Description
Retrieve By	`options`	No	`id`	Whether to retrieve the user by sys_id or username
				Options: `id`, `user_name`
User ID (`id`)	`string`	Yes	—	Sys_id of the user (shown when Retrieve By is `id`)
Username	`string`	Yes	—	Username to look up (shown when Retrieve By is `user_name`)
Options (`options`)	`collection`	No	`{}`	Query settings applied to the request.
— Exclude Reference Link	`boolean`	No	`false`	Whether to exclude Table API links for reference fields
— Fields	`string`	No	—	Comma-separated list of field names to return
— Filter	`string`	No	—	Encoded query string to filter results. SECURITY: power-user field — should be a static literal. Never interpolate untrusted upstream values, as `^` and `^OR` separators can broaden the query.
— Return Values	`options`	No	`false`	Choose which values to return
				Options: `false` (Actual Values), `all` (Both), `true` (Display Values)

User: Get Many

Parameter	Type	Required	Default	Description
Return All (`returnAll`)	`boolean`	No	`false`	Whether to return all results or only up to a given limit
Limit (`limit`)	`number`	No	`50`	Max number of results to return (shown when Return All is `false`)
Options (`options`)	`collection`	No	`{}`	Query settings applied to the request.
— Exclude Reference Link	`boolean`	No	`false`	Whether to exclude Table API links for reference fields
— Fields	`string`	No	—	Comma-separated list of field names to return
— Filter	`string`	No	—	Encoded query string to filter results. SECURITY: power-user field — should be a static literal. Never interpolate untrusted upstream values, as `^` and `^OR` separators can broaden the query.
— Return Values	`options`	No	`false`	Choose which values to return
				Options: `false` (Actual Values), `all` (Both), `true` (Display Values)

User: Update

Parameter	Type	Required	Default	Description
User ID (`id`)	`string`	Yes	—	Sys_id of the user
Update Fields (`updateFields`)	`collection`	No	`{}`	The user fields to change. Fields you leave out keep their current value.
— Active	`boolean`	No	`false`	Whether the user is active.
— Building	`string`	No	—	The user’s building.
— City	`string`	No	—	The user’s city.
— Company	`string`	No	—	The user’s company.
— Country	`string`	No	—	The user’s country.
— Department	`string`	No	—	The user’s department.
— Email	`string`	No	—	The user’s email address.
— First Name	`string`	No	—	The user’s first name.
— Gender	`string`	No	—	The user’s gender.
— Home Phone	`string`	No	—	The user’s home phone number.
— Last Name	`string`	No	—	The user’s last name.
— Location	`string`	No	—	The user’s location.
— Manager	`string`	No	—	The user’s manager.
— Middle Name	`string`	No	—	The user’s middle name.
— Mobile Phone	`string`	No	—	The user’s mobile phone number.
— Password	`string`	No	—	The user’s password.
— Password Needs Reset	`boolean`	No	`false`	Whether the password is flagged as needing a reset.
— Phone	`string`	No	—	The user’s phone number.
— Roles	`string`	No	—	Comma-separated sys_ids of user roles
— Source	`string`	No	—	The source recorded on the user record.
— State	`string`	No	—	The user’s state.
— Street	`string`	No	—	The user’s street address.
— Username	`string`	No	—	The user’s username.
— Zip Code	`string`	No	—	The user’s ZIP or postal code.

User Group: Get Many

Parameter	Type	Required	Default	Description
Return All (`returnAll`)	`boolean`	No	`false`	Whether to return all results or only up to a given limit
Limit (`limit`)	`number`	No	`50`	Max number of results to return (shown when Return All is `false`)
Options (`options`)	`collection`	No	`{}`	Query settings applied to the request.
— Exclude Reference Link	`boolean`	No	`false`	Whether to exclude Table API links for reference fields
— Fields	`string`	No	—	Comma-separated list of field names to return
— Filter	`string`	No	—	Encoded query string to filter results. SECURITY: power-user field — should be a static literal. Never interpolate untrusted upstream values, as `^` and `^OR` separators can broaden the query.
— Return Values	`options`	No	`false`	Choose which values to return
				Options: `false` (Actual Values), `all` (Both), `true` (Display Values)

User Role: Get Many

Parameter	Type	Required	Default	Description
Return All (`returnAll`)	`boolean`	No	`false`	Whether to return all results or only up to a given limit
Limit (`limit`)	`number`	No	`50`	Max number of results to return (shown when Return All is `false`)
Options (`options`)	`collection`	No	`{}`	Query settings applied to the request.
— Exclude Reference Link	`boolean`	No	`false`	Whether to exclude Table API links for reference fields
— Fields	`string`	No	—	Comma-separated list of field names to return
— Filter	`string`	No	—	Encoded query string to filter results. SECURITY: power-user field — should be a static literal. Never interpolate untrusted upstream values, as `^` and `^OR` separators can broaden the query.
— Return Values	`options`	No	`false`	Choose which values to return
				Options: `false` (Actual Values), `all` (Both), `true` (Display Values)

All Operations

Parameter	Type	Required	Default	Description
Max Concurrency	`number`	No	`10`	Maximum number of items to process concurrently.

Output Data

ServiceNow wraps every Table API response in a result envelope; this node unwraps it before writing anything to the item. On single-record operations the record’s own fields are merged into the item JSON at the top level, so the rest of the incoming item passes through unchanged and you address record fields directly — {{ $json.sys_id }}, not {{ $json.result.sys_id }}. Binary data on the input item is always forwarded, and a downloaded attachment is added alongside it.

These operations fan out — one output item per record returned:

Attachment: Get Many
Incident: Get Many
Table Record: Get Many
User: Get Many
Business Service: Get Many, Configuration Item: Get Many, Department: Get Many, Dictionary: Get Many, User Group: Get Many, User Role: Get Many

Each fanned-out item is the input item’s JSON with one record merged over it. When the query matches nothing the node still emits one item so the branch does not go silent: Attachment: Get Many emits the input item with attachments: [], and every other listing operation emits it with results: []. Check for that key before assuming a record is present.

Every other operation produces exactly one output item:

Operations	What lands on the item
`Attachment: Upload`, `Incident: Create`, `Incident: Get`, `Incident: Update`, `Table Record: Create`, `Table Record: Get`, `Table Record: Update`, `User: Create`, `User: Update`	The record’s own fields, merged in at the top level.
`Attachment: Get`	The attachment’s metadata fields, merged in at the top level. With Download Attachments on, the file content is written to the binary property named by Output Field.
`User: Get`	The single matching user record’s fields. A username lookup returns the first match only.
`Attachment: Delete`, `Incident: Delete`, `Table Record: Delete`, `User: Delete`	`success: true`. Delete calls return no record.

If a response ever arrives as something other than an object, it lands under result instead.

Reference the result downstream by expression, e.g. {{ $json.sys_id }}.

Usage Examples

Create a new incident in ServiceNow
Upload a file attachment to a ServiceNow record
Download attachments from a ServiceNow incident
List all incidents matching a filter query
Update incident status and assignment
Create a new user in ServiceNow
Query any ServiceNow table with generic Table Record operations

Example Configuration

Attach a file held on the item to an incident record:

{
  "type": "servicenow",
  "parameters": {
    "resource": "attachment",
    "operation": "upload",
    "tableName": "incident",
    "id": "abc123def4567890abc123def4567890",
    "inputDataFieldName": "fileData",
    "uploadOptions": {
      "file_name": "error_log.txt"
    }
  }
}

List the attachments on the incident table and download each file:

{
  "type": "servicenow",
  "parameters": {
    "resource": "attachment",
    "operation": "getAll",
    "tableName": "incident",
    "returnAll": false,
    "limit": 50,
    "download": true,
    "outputField": "downloadedFile",
    "attachmentGetOptions": {
      "queryFilter": "table_name=incident"
    }
  }
}

Delete an attachment by its sys_id:

{
  "type": "servicenow",
  "parameters": {
    "resource": "attachment",
    "operation": "delete",
    "attachmentId": "xyz789abc1230000xyz789abc1230000"
  }
}

Raise a high-impact incident:

{
  "type": "servicenow",
  "parameters": {
    "resource": "incident",
    "operation": "create",
    "short_description": "Server outage affecting production",
    "additionalFields": {
      "description": "Production server went down at 2:00 PM EST",
      "urgency": 1,
      "impact": 1,
      "category": "Hardware",
      "assigned_to": "62826bf03710200044e0bfc8bcbe5df1",
      "caller_id": "681ccaf9c0a8016400b98a06818d57c7"
    }
  }
}

Resolve an incident and record the close notes:

{
  "type": "servicenow",
  "parameters": {
    "resource": "incident",
    "operation": "update",
    "id": "abc123def4567890abc123def4567890",
    "updateFields": {
      "state": "6",
      "close_code": "Solved (Permanently)",
      "close_notes": "Issue resolved by restarting server",
      "work_notes": "Server restart completed successfully"
    }
  }
}

Read a page of active priority-1 incidents, returning display values for a few fields only:

{
  "type": "servicenow",
  "parameters": {
    "resource": "incident",
    "operation": "getAll",
    "returnAll": false,
    "limit": 100,
    "options": {
      "sysparm_query": "active=true^priority=1",
      "sysparm_fields": "number,short_description,priority,state",
      "sysparm_display_value": "true"
    }
  }
}

Create a CMDB record straight from the incoming item’s fields:

{
  "type": "servicenow",
  "parameters": {
    "resource": "tableRecord",
    "operation": "create",
    "tableName": "cmdb_ci_server",
    "dataToSend": "mapInput",
    "inputsToIgnore": "internal_id,timestamp"
  }
}

Create the same record with the columns spelled out:

{
  "type": "servicenow",
  "parameters": {
    "resource": "tableRecord",
    "operation": "create",
    "tableName": "cmdb_ci_server",
    "dataToSend": "columns",
    "fieldsToSend": {
      "name": "PROD-WEB-01",
      "ip_address": "192.168.1.100",
      "operating_system": "Linux",
      "environment": "Production"
    }
  }
}

Query any table with an encoded query:

{
  "type": "servicenow",
  "parameters": {
    "resource": "tableRecord",
    "operation": "getAll",
    "tableName": "sys_user",
    "returnAll": false,
    "limit": 50,
    "options": {
      "sysparm_query": "active=true^department=IT",
      "sysparm_fields": "user_name,first_name,last_name,email",
      "sysparm_exclude_reference_link": true
    }
  }
}

Create a user:

{
  "type": "servicenow",
  "parameters": {
    "resource": "user",
    "operation": "create",
    "short_description": "New employee - Software Developer",
    "additionalFields": {
      "user_name": "john.developer",
      "first_name": "John",
      "last_name": "Developer",
      "email": "john.developer@company.com",
      "active": true,
      "department": "IT",
      "roles": "itil,admin"
    }
  }
}

Look a user up by username instead of sys_id:

{
  "type": "servicenow",
  "parameters": {
    "resource": "user",
    "operation": "get",
    "getOption": "user_name",
    "user_name": "john.developer",
    "options": {
      "sysparm_fields": "sys_id,user_name,first_name,last_name,email,active"
    }
  }
}

Move a user to another department and deactivate them:

{
  "type": "servicenow",
  "parameters": {
    "resource": "user",
    "operation": "update",
    "id": "abc123def4567890abc123def4567890",
    "updateFields": {
      "department": "Engineering",
      "manager": "mary.manager",
      "active": false
    }
  }
}

List every business service:

{
  "type": "servicenow",
  "parameters": {
    "resource": "businessService",
    "operation": "getAll",
    "returnAll": true,
    "options": {
      "sysparm_fields": "name,description,business_criticality",
      "sysparm_display_value": "true"
    }
  }
}

List installed configuration items:

{
  "type": "servicenow",
  "parameters": {
    "resource": "configurationItems",
    "operation": "getAll",
    "returnAll": false,
    "limit": 200,
    "options": {
      "sysparm_query": "install_status=1",
      "sysparm_fields": "name,sys_class_name,ip_address,environment"
    }
  }
}

Open an incident from an upstream item, then — in a second node — assign it using the sys_id the first node merged onto the item:

{
  "type": "servicenow",
  "parameters": {
    "resource": "incident",
    "operation": "create",
    "short_description": "{{ $json.issue_title }}",
    "additionalFields": {
      "description": "{{ $json.issue_description }}",
      "urgency": 2,
      "impact": 2,
      "caller_id": "{{ $json.reporter_sys_id }}"
    }
  }
}

{
  "type": "servicenow",
  "parameters": {
    "resource": "incident",
    "operation": "update",
    "id": "{{ $json.sys_id }}",
    "updateFields": {
      "assigned_to": "{{ $json.assigned_user }}",
      "work_notes": "Ticket assigned to technician"
    }
  }
}

Find users who signed in recently:

{
  "type": "servicenow",
  "parameters": {
    "resource": "user",
    "operation": "getAll",
    "returnAll": false,
    "limit": 100,
    "options": {
      "sysparm_query": "active=true^last_login_time>javascript:gs.daysAgoEnd(30)",
      "sysparm_fields": "user_name,first_name,last_name,last_login_time",
      "sysparm_display_value": "true"
    }
  }
}

Error Handling

Mode	Behavior
stop	Halts workflow on first error
continue	Skips failed items, passes successful ones through
errorPort	Routes failed items to Error output port

Tips

Manage ServiceNow incidents, users, attachments, and table records with binary file upload and download support.

Key Configuration Tips

Resource Selection: Always start by selecting the appropriate resource type
Operation Dependencies: The available operations depend on the selected resource
Required vs Optional: Some parameters become required based on operation selection
Collection Structure: Use flat objects for collection parameters, never arrays or _default wrappers
Query Syntax: Use ServiceNow’s encoded query syntax for filtering results
Display Values: Use sysparm_display_value to control whether you get raw values or display values
Field Selection: Use sysparm_fields to limit returned data and improve performance
Pagination: Use returnAll: false with limit for better performance on large datasets