DAST

Preparing ServiceNow for Burp Suite DAST

• Last updated: October 29, 2026

• Read time: 4 Minutes

Prepare an integration user in ServiceNow before you add a connection in Burp Suite DAST.

Creating the integration user

Whichever authentication option you choose, Burp Suite DAST acts as an integration user in ServiceNow. To create the user:

1. Create a dedicated user. Don't use a person's account.
2. We recommend selecting Web service access only, labeled Internal Integration User on newer releases. Burp Suite DAST doesn't need it for OAuth. For username and password, it is an alternative to the snc_basic_auth_api_access role.
3. Give the user the roles in this table.

Role	What it allows	If the user lacks it
itil	Burp Suite DAST can choose a table, read and raise tickets in tables that extend Task, search assignment groups and other lookups, and find existing tickets.	Assignment group and ticket lookups return nothing, so Burp Suite DAST reports linked tickets as not found, and you can't add an action.
personalize_dictionary	Burp Suite DAST can read table columns, required fields and display columns.	You can't add an action, because Burp Suite DAST can't read the columns or required fields of the table.
personalize_choices	Burp Suite DAST can read choice lists, such as impact and urgency.	You can't add an action, because Burp Suite DAST can't read choice lists such as impact and urgency.

Granting the admin role (optional)

Burp Suite DAST can read two sources of required fields only with the admin role:

• Dictionary overrides. A table such as incident can make a column mandatory when its parent table doesn't.
• Data policies that make a field mandatory for API requests. The data_policy_admin role doesn't replace the admin role.

Without the admin role, Burp Suite DAST doesn't show those fields as required. The fields appear as optional in the action editor, even though ServiceNow requires them, so you can save an action that looks complete. ServiceNow then rejects the ticket when you raise it with those fields empty. The admin role is a broad grant for an integration user, so weigh it against the risk of rejected tickets.

Using username and password authentication with ServiceNow

Give the integration user the snc_basic_auth_api_access role. Without it, ServiceNow refuses the connection and Burp Suite DAST shows "Credentials rejected", unless the user has Web service access only and your instance lets those users use Basic authentication. That depends on the glide.authenticate.basic_auth.allow_wsao property. Giving the role works either way. OAuth doesn't need the role.

Setting up OAuth client credentials

OAuth client credentials need the Washington DC release or later, and an administrator with the oauth_admin role. To set them up in ServiceNow:

1. Create the system property glide.oauth.inbound.client.credential.grant_type.enabled with the type true | false and the value true. ServiceNow sets this property to false by default.

2. Create the inbound OAuth client:

   • In Zurich and later, go to Machine Identity Console > Inbound integrations > New integration and select OAuth - Client credential grant.
   • In Washington DC to Yokohama, go to System OAuth > Application Registry > New and select Create an OAuth API endpoint for external clients.
3. Leave the access token lifespan at the default of 1800 seconds or longer. If you restrict auth scopes or select Enforce token restriction, allow the Table API.
4. Set the OAuth application user to the integration user. If the field is missing from the Application Registry form, add it through Configure > Form Layout.
5. Copy the client ID and client secret.

Burp Suite DAST raises every ticket as the application user.

Troubleshooting ServiceNow connections

These causes apply to both authentication options.

• "Credentials rejected. Check them and try again." Burp Suite DAST shows this message for several causes. Check, in order, that the client ID and client secret are right, that the OAuth client has an application user, and that the user is active. For username and password, check that the password is right and that the role requirement above is met.
• "This destination's required fields can't be checked. The account is missing permissions. Check them and try again." The integration user is missing one of the three roles in the roles table.
• The connection check passes, but a lookup says "The account is missing permissions. Check them and try again." Either a role is missing, or you selected Enforce token restriction on the OAuth client without a REST API access policy for the Table API. In the second case, ServiceNow returns a 403 "Access to unscoped api is not allowed" message to every request, even for an administrator. Leave token restriction off for the client, or add a policy that allows the Table API.
• "This account can't read this table" when you add an action. Standard Task tables such as incident and change_request are covered by itil. For a custom table, give the integration user read and create access to it.