DAST

Connecting Burp Suite DAST to ServiceNow

• Last updated: October 29, 2026

• Read time: 5 Minutes

Add a connection to ServiceNow so that Burp Suite DAST can create and link tickets.

Choosing an authentication option

ServiceNow offers two authentication options. Choose the option that your instance allows and that suits your credential rotation policy.

Authentication option	Use when	Credential lifetime
Username and password	Your instance allows Basic authentication for a web service user.	Until the password changes
OAuth client credentials	Your instance runs the Washington DC release or later, or restricts Basic authentication.	Until you rotate the client secret

With OAuth client credentials, Burp Suite DAST stores the client ID and client secret as it stores a password, and requests access tokens as it needs them. You don't need to reconfigure Burp Suite DAST after a restart.

Burp Suite DAST doesn't offer the ServiceNow password grant, because ServiceNow recommends disabling it. It also doesn't support OAuth methods that need a person to sign in through a browser.

Before you add a connection, prepare an integration user in ServiceNow. For instructions, see Preparing ServiceNow for Burp Suite DAST.

Adding a connection

Each connection has its own URL and credentials, so you can connect several ServiceNow instances. To add the first connection:

1. Log in to Burp Suite DAST as a user with the Modify settings permission.
2. Click the settings icon in the top-right corner of the window, then click Integrations.
3. On the ServiceNow tile, click Configure. The Connect to ServiceNow dialog opens, with three steps listed on the left: Instance URL, Authentication and Configuration.
4. On Instance URL, enter a Connection name, such as Production, and the ServiceNow URL, in the form https://<instance>.service-now.com. Click Next.
5. On Authentication, select an Authentication option and complete its fields, as the following table shows. Click Next. Burp Suite DAST checks the connection.
6. On Configuration, set the defaults, then click Save.

Authentication option	Fields to complete
Username and password	In Email address or username, enter the ID or email address of the integration user. In API token or user password, enter the password of the user.
OAuth client credentials	Client ID and Client secret.

To go back to an earlier step, click its name in the list on the left. Each step stays locked until you complete the step before it. To add another connection, click Edit on the ServiceNow tile to open the connections page, then click Add connection and follow the same steps.

The connection name is required. It must be unique across every connection of every type, ignoring case. Burp Suite DAST shows "Name is required" or "A connection with this name already exists" if the name fails these rules.

Checking the connection

When you click Next on Authentication, Burp Suite DAST checks the URL and credentials. The button shows Checking connection while the check runs. Configuration stays locked until the check passes. Saving also runs the check, and so does a change to the URL or credentials later.

If the check fails, you stay on the step. A field error appears on the field. An error that belongs to another step puts an alert icon on that step, and a banner reads "The connection check failed. Review the step marked with an error." An error with no field, such as a credentials or network error, appears as a banner on the current step.

Message	When it appears
Credentials rejected. Check them and try again.	The username, password, client ID or client secret is wrong. It also appears when the OAuth client has no application user, when the user is inactive, and when the URL is not a ServiceNow instance.
No compatible service at this URL. Check the URL.	The URL answers, but not like ServiceNow.
This URL redirects elsewhere. Check the URL.	The URL starts with http:// instead of https://, or has a path after the host name.
Can't connect to this URL. Check the URL and network.	The host doesn't resolve, the instance name doesn't exist, or the request timed out.
This URL can't be used. Enter a public https URL.	On Cloud, the address is not https, or resolves to a private address. It appears on the ServiceNow URL field.
Unexpected response. Try again later.	ServiceNow answered with an error, or limits the rate of requests.
No active ServiceNow user has this email address or username	With username and password, the lookup found no active user. It appears on Email address or username.

Burp Suite DAST doesn't show the error text from ServiceNow. For the causes of "Credentials rejected" and how to fix them, see Troubleshooting ServiceNow connections.

Checking and managing connections

Click Edit on the ServiceNow tile to open the connections page. It lists every connection as a card. The tile shows a tick and the number of connections, such as "3 connected". The page has a back arrow to Integrations and a How do I connect? link.

Each card shows:

• The connection name, with Edit and Remove icons.
• The status: "Testing connection...", Connected, Not connected with the reason, or "1 ticket not raised" or "N tickets not raised" with an orange warning icon and a reason line.
• The required settings of the connection that aren't secret, such as the URL and username.
• The number of actions for the connection, such as "2 (1 automatic)", with a Manage actions link.

Every time the connections page opens, Burp Suite DAST checks each connection with its saved credentials. The check stores nothing. "Testing connection..." shows on the card while the check runs, including right after you save. You need the same permission as for managing integration settings to run the check.

To edit a connection, click its Edit icon. The dialog title stays Connect to ServiceNow. A stored secret shows as an empty masked field with the placeholder "Leave blank to keep the current value". Both ServiceNow secrets are required, so there is nothing to clear.

To remove a connection, click its Remove icon. The Remove ServiceNow connection dialog asks "Are you sure you want to remove '<name>'? This cannot be undone." Click Remove to confirm. Removing a connection also removes its actions and triggers, and the tickets, links and failure records that Burp Suite DAST holds for it. Issue timelines still show that tickets were raised.

Network access on Cloud

Cloud Cloud instances of Burp Suite DAST can connect only to hosts on an allow-list. ServiceNow instances hosted on *.service-now.com and *.servicenowservices.com are on the list, so you need no network change. Cloud instances accept only public https URLs. Burp Suite DAST refuses anything else with "This URL can't be used. Enter a public https URL."

Self-hosted Self-hosted instances can connect to any ServiceNow instance that your network can reach.