# Connecting ServiceNow

Connect a ServiceNow instance so Eraser can draw architecture diagrams from the configuration items (CIs) and relationships in your CMDB. Eraser reads the instance as an integration user you create yourself, and that user holds only read roles.

Everything below starts from **Settings → [Data Sources](https://app.eraser.io/dashboard/all?settings=dataSources)** in Eraser – keep that tab open, since you'll return to it to copy values into ServiceNow.

## Quick overview

1. Enter your instance ([how-to](/connecting-servicenow#1-enter-your-instance))
2. Create the integration user ([how-to](/connecting-servicenow#2-create-the-integration-user))
3. Configure Google OIDC ([how-to](/connecting-servicenow#3-configure-google-oidc))
4. Connect the instance ([how-to](/connecting-servicenow#4-connect-the-instance))

## What Eraser gets access to

The integration user holds three roles: **sn_cmdb_user**, **service_viewer**, and **snc_read_only**. Together they allow reading configuration items, their relationships, and the application services they belong to – nothing else.

No password or API key is exchanged. Eraser signs in with a short-lived token issued by Google, and your instance accepts it only because you register Google as a trusted provider for your team in step 3. A token issued for any other Eraser team is refused.

Eraser checks the user's roles before it accepts the connection and before every scan, and refuses anything broader: a user holding any other role is rejected.

## 1. Enter your instance

Open **Settings → Data Sources** and pick **ServiceNow** – from the list of data sources, or from **Add connection** once one is connected. Enter your instance's hostname, such as `pulsequeue.service-now.com`. The buttons in the next two steps open pages on that instance.

<Figure src="/assets/data-sources-servicenow-connect-pane.png" alt="The Connect ServiceNow form in Eraser, with the instance hostname filled in" border />

## 2. Create the integration user

<Callout kind="warning" title="Required role">
Steps 2 and 3 are performed in ServiceNow by someone with the **admin** role.
</Callout>

Choose **Open a new user in ServiceNow** and create a user with the **Email** Eraser shows and **Web service access only** ticked. The form usually opens with both already filled in. Choose **Submit**.

Open the new user and add three roles on its **Roles** tab: **sn_cmdb_user**, **service_viewer**, and **snc_read_only**.

<Callout kind="note">
Eraser confirms the access is read-only by reading the user's own role assignments. If your instance restricts the `sys_user_has_role` table, let the user read its own rows.
</Callout>

## 3. Configure Google OIDC

Eraser gives you the audience your instance should accept:

<Figure src="/assets/data-sources-servicenow-oidc.png" alt="The Audience value in Eraser, with a Copy button" border />

Choose **Open Application Registry in ServiceNow**, then **New** and **Configure an OIDC provider to verify ID tokens**. Set **Client ID** to the **Audience** from Eraser.

For its OIDC provider configuration, use Google's metadata URL, `https://accounts.google.com/.well-known/openid-configuration`, map the `email` claim to the user's **Email** field, and turn off JTI verification – Google's tokens don't carry a JTI claim.

## 4. Connect the instance

Back in Eraser, you can add a **Filter**: a ServiceNow encoded query that limits which CIs are imported, such as `sys_class_name=cmdb_ci_server`. Leave it empty to import every CI the user can read. Retired CIs are always skipped.

Choose **Verify and connect**, and Eraser runs its first scan.

## After connecting

Each connection appears in **Settings → [Data Sources](https://app.eraser.io/dashboard/all?settings=dataSources)**, showing the instance and when it last synced.

* **Rescan** reads the CMDB again. There is no scheduled background scan – Eraser reads your instance when you ask it to.
* **Active** lets Eraser scan the instance and use it as context in AI chat. **Inactive** stops both, without discarding the connection.
* **Reconnect** checks the setup again after you fix it in ServiceNow, keeping the connection's history.
* **Remove from Eraser** disconnects and forgets the instance.

Removing a connection does not change anything in ServiceNow. To revoke access completely, also deactivate the integration user.

Once a connection is active, anyone on the team can reference it in AI chat to generate architecture diagrams – see [Cloud diagrams](/cloud-diagrams).

## Troubleshooting

| What Eraser says | What it means |
|---|---|
| Use the instance hostname ending in .service-now.com | Enter the instance's own hostname, such as `pulsequeue.service-now.com`. |
| Authentication check failed (HTTP 401) | The instance refused Eraser's token. Check the OIDC provider from step 3: the Client ID, the `email` to **Email** mapping, and that JTI verification is off. |
| Map the scanner email to exactly one active, web-service-only integration user | No user has the email from step 2, more than one does, or the user is inactive or not web-service-only. |
| ServiceNow accepted a token for another audience | The OIDC provider accepts tokens meant for other teams. Set its Client ID to the **Audience** Eraser shows. |
| … denied access to sys_user_has_role (HTTP 403) | The user can't read its own role assignments. Allow it, as in step 2. |
| Cannot verify read-only access | The user holds a role beyond the three read roles, or is missing one of them. |