Configure permissions for ServiceNow protection

To connect your ServiceNow account to Commvault, you must configure a credential with the required permissions and provide the authentication details Commvault needs to connect.

Create or identify a ServiceNow user account

Create a new ServiceNow user account or identify an existing account that will be used for backup and restore operations. The account must use Basic authentication (username and password) and have sufficient permissions to access the Table API.

Assign the required permissions

Assign the following roles to the ServiceNow user account:

Operation	Required role	What it grants
Browse and backup	`rest_api_explorer` OR `admin`	Full REST API access for CRUD operations on tables, attachments, and sys_dictionary
Backup (table-specific)	`itil` (if applicable)	Access to incident, change, and problem tables
Backup (table-specific)	`asset` (if applicable)	Access to CMDB tables
Restore	`rest_api_explorer` OR `admin`	Table API POST and PATCH operations for creating and updating records, Import Set API, attachment upload API

Minimum required: The rest_api_explorer role grants full REST API access including:

Table API GET operations to read records
Access to sys_dictionary for field definitions
Attachment metadata and binary download
Table API POST and PATCH operations for restore
Attachment upload API for restore

If you use a non-admin account, make sure the account has explicit access to the tables you want to back up. Tables that the user cannot read are silently excluded from backup.

Provide connection details

To connect to ServiceNow, Commvault needs the following information from your ServiceNow instance:

Instance URL — Your ServiceNow instance URL (for example, https://dev12345.service-now.com). Find this in your ServiceNow browser address bar.
Username — The ServiceNow account username created in the previous step.
Password — The password for the ServiceNow account.

Notes and considerations

Credentials do not expire automatically, but ServiceNow administrators can enforce password rotation policies. If your ServiceNow password changes, update the credential in Commvault.
Use a dedicated service account rather than a personal account to avoid disruption when personnel changes occur.
The same credential can be shared across multiple ServiceNow instances if each instance has the same username and password, but using separate credentials per instance is recommended for easier troubleshooting and audit logging.

Validate permissions

After configuring the credential, run a test backup to confirm that permissions are correct:

Configure a ServiceNow backup with a small set of test tables.
Run an on-demand backup.
If the backup fails with a 401 Unauthorized error, verify that the username and password are correct and that the account is not locked or disabled.
If the backup fails with a 403 Forbidden error, verify that the account has the rest_api_explorer or admin role.
If specific tables are missing from the backup, verify that the account has read access to those tables and that they are not system tables with sys_ prefix (excluded by default).