Some links on this page are affiliate links: if you buy through them we may earn a commission, at no extra cost to you.
To create a ServiceNow Scripted REST API POST endpoint, define a Scripted REST API, add a POST resource, and read a JSON request body from request.body.data. Return a JavaScript object for a JSON response. Send both Content-Type: application/json and Accept: application/json, then test the endpoint in REST API Explorer before adding repeatable Automated Test Framework (ATF) coverage.
What a Scripted REST API POST endpoint is
A Scripted REST API defines an inbound service in your ServiceNow instance. The API record establishes the service namespace and version; a resource beneath it defines the HTTP method, relative path, and script that handles the request. A POST resource is appropriate when the caller sends data in the request body for your script to process.
The complete endpoint URL depends on the instance and the API and resource records you create. A documented versioned form is https://<instance>.service-now.com/api/<namespace>/<version>/<resource-path>. For example, a resource path of /example/body might be called as https://<instance>.service-now.com/api/sn_demo_api/v1/example/body. Treat that namespace and path as illustrative: use the exact namespace, API ID, version, and relative path configured in your instance.
Do these 3 things before closing this tab:
1Scan for outdated or missing drivers - takes under a minute2Repair Windows errors before they cause bigger problems3Fix the driver behind crashes, sound loss and screen glitchesCreate a POST resource that reads JSON
- In the ServiceNow application navigator, open the Scripted REST APIs area and create a Scripted REST API. Set its name and API ID, and define the version you intend callers to use.
- Within the API, add a resource. Set its HTTP method to
POSTand choose a relative path, such as/example/body. - In the resource script field, read the parsed body through
request.body.data. Return only the response fields the caller needs. - Save the resource, note the instance-specific endpoint URL, and test it with an authenticated account authorized to access the API.
For a JSON object shaped like {"name":"Ada","id":1234}, a minimal resource script is:
(function process(/*RESTAPIRequest*/ request, /*RESTAPIResponse*/ response) {
var body = request.body.data;
return {
"name": body.name,
"id": body.id
};
})(request, response);The returned object is the response data. This example assumes that the incoming body is valid JSON with the expected name and id properties. Define and validate the request contract appropriate to your integration rather than assuming every caller will send that shape.
When the JSON body is an array
If the resource expects an array, request.body.data can be used to access indexed entries. This example reflects the documented two-item sample shape:
(function process(/*RESTAPIRequest*/ request, /*RESTAPIResponse*/ response) {
var body = request.body.data;
return {
"id": body[0].id,
"name": body[0].name,
"id1": body[1].id,
"name1": body[1].name
};
})(request, response);It expects at least two elements, each with the named properties. For production use, validate that the body is an array and that required entries and fields exist before dereferencing them; otherwise a different payload shape can cause the script to fail.
Free tools Windows power users keep installed
One-click scans. No signup required.
When the body is plain text
For a plain string body rather than parsed structured content, read request.body.dataString:
(function process(/*RESTAPIRequest*/ request, /*RESTAPIResponse*/ response) {
var requestBody = request.body;
var requestString = requestBody.dataString;
return {"requestString": requestString};
})(request, response);Choose the parsing approach to match the body you accept. Use data for a structured JSON object or array; use dataString when your resource is intended to process a raw string.
Send the POST request with the required headers
For a JSON request, send both Content-Type and Accept. The first identifies the format of the request body; the second tells the endpoint what response representation the caller accepts. A documented example uses Basic Authentication and a JSON array:
POST https://<instance>.service-now.com/api/sn_demo_api/v1/example/body HTTP/1.1
Host: <instance>.service-now.com
Authorization: Basic <credentials>
Content-Type: application/json
Accept: application/json
[
{"name":"user0","id":1234},
{"name":"user1","id":5678}
]Replace the sample instance, namespace, version, credentials, and path with values for your environment. The payload must match the resource’s expected shape: use an object for the object-processing example or an array for the array-processing example. ServiceNow documents application/json and application/xml as common header values; the selected content type and accepted response must agree with the resource’s supported formats.
Quick wins for a faster PC:
Clear out junk files and repair common Windows errorsFree Scan →Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →Repair Windows errors before they cause bigger problemsFix Now →Requests with a body require the Content-Type and Accept headers. Missing required headers can produce 400 Bad Request. A resource can also reject an unsupported requested representation; inspect its response status and error body rather than assuming every failure is a parsing problem.
Secure the resource for the integration
Set access controls for the actual calling system and data. ServiceNow documents Basic Authentication and OAuth, with optional MFA configuration; the caller also needs sufficient authorization. Roles, ACLs, and API access policies affect whether a caller can reach and use the endpoint.
- Choose the authentication method required by your integration and provision credentials through the appropriate process.
- Grant only the roles and data access the integration needs, and check applicable ACLs and API access policies.
- Keep authentication enabled for production inbound resources. Do not disable it simply to make an initial test pass.
- Document the API version, resource path, request and response shapes, and access requirements for client developers.
The example request shows Basic Authentication syntax, not a recommendation that every deployment use Basic. Select the supported authentication and authorization configuration that fits your instance and integration.
Test the endpoint in REST API Explorer
REST API Explorer is the interactive first check: it lets you select an endpoint, construct a request, send it, inspect the response, and generate client code samples.
Recommended Free Tools
- Open System Web Services > REST API Explorer.
- Select your Scripted REST API and the POST resource you created.
- Enter the required headers, including
Content-TypeandAccept, and supply a payload matching the resource’s expected object, array, or string format. - Authenticate as a user with the required authorization, send the request, and inspect the HTTP status and response body.
- Use the Explorer’s generated client code samples as a starting point for the calling application, adapting them to your authentication and runtime.
Explorer is useful for an interactive request, but a successful one-off call does not establish coverage for later changes. Add ATF inbound REST test steps for repeatable checks. Include valid payloads, missing-header behavior, authentication failures, malformed or unexpected data, and expected response fields. This provides a way to catch regressions against the endpoint contract.
Best Value
Version and evolve the API deliberately
The API’s version is part of the endpoint contract. If a change would break existing callers—for example, changing required input fields or response shape—consider publishing a new API version rather than silently changing the behavior callers already use. Keep the resource path and version documented with client configuration so an update does not accidentally point an integration at a different contract.
For compatible changes, still use your ATF coverage to verify established request and response behavior. Keep Explorer requests useful as development examples, but make repeatable inbound REST tests the check that can be run again as the script or access configuration changes.
Troubleshoot common POST failures
| Symptom | Likely cause | What to check |
|---|---|---|
400 Bad Request |
A required request header is missing, or the request does not meet the resource’s input expectations. | Send both Content-Type and Accept; confirm the content type matches the body format and the resource’s content negotiation settings. |
| The script cannot find expected fields | The payload shape differs from what the script expects, such as an object being sent where the script expects an array. | Inspect the actual body, then align the client payload and resource logic. Use request.body.data for structured JSON and access fields according to the actual object or array shape. |
| Plain text is not read as expected | The resource is using structured-body access for a string payload. | For a raw string body, read request.body.dataString and ensure the request format matches that contract. |
| The request is rejected before useful script output | The credentials, roles, ACLs, or API access policy do not authorize this caller. | Verify the authentication method and credentials, then check the caller’s roles, ACL access, and API access policy. Do not resolve a production authorization issue by disabling authentication. |
| The endpoint rejects the requested response format | The caller’s Accept header asks for a representation the resource does not support. |
Request a supported representation, such as application/json for a JSON resource, and inspect the error status and response body. A resource script can return a typed error such as NotAcceptableError for an unsupported representation. |
| Array processing fails on a short or incomplete payload | The illustrative array script assumes two entries with id and name. |
Validate array length and required fields before accessing indexes, or send a payload that fulfills the documented contract. |
Or skip the browser setup
ScreenshotNeo is a website screenshot API and MCP server, not a ServiceNow Scripted REST API client; it does not create or test this ServiceNow endpoint. If your integration also needs website screenshots, ScreenshotNeo can capture a URL with one GET request and provides an MCP server for AI agents and other MCP clients.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
For example, this cURL request saves a screenshot of Stripe as WebP:
curl -G "https://api.screenshotneo.com/v1/shot" -d access_key=YOUR_API_KEY --data-urlencode url=https://stripe.com -o shot.webpSee the ScreenshotNeo API documentation for request options. Cookie and consent banners, newsletter popups, and chat widgets are removed before the shot; bot checks, blank pages, and failed loads are not billed. The MCP server lets AI agents take screenshots. The Free plan includes 1,000 screenshots per month with no card required; paid plans start at $5 for 3,000 shots.
Sign up for ScreenshotNeo free: 1,000 screenshots a month, no card required.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
