REST API 401 Unauthorized: invalid or missing credentials

Basic authentication credentials are incorrect, expired, or the user account has been locked or deactivated in the sys_user table. (high likelihood)

Authorization header is missing or malformed in the HTTP request, such as incorrect Base64 encoding of username:password for basic auth. (high likelihood)

Bearer token authentication is being used but the OAuth token has expired, been revoked, or is invalid for the requested endpoint. (medium likelihood)

The user account has valid credentials but lacks the required ACL permissions or roles to access the specific table or REST API endpoint. (medium likelihood)

ServiceNow instance has IP restrictions configured in System Security > Access Control > IP Address Access Control that block the requesting client IP. (low likelihood)

Step 1: Verify the user account exists and is active by searching the User table (sys_user) for the username and confirming the Active field is checked.

Step 2: Test the credentials by logging into the ServiceNow instance web interface using the same username and password to confirm they are valid.

Step 3: Check the Authorization header format in your HTTP request - for basic auth it should be 'Authorization: Basic [base64(username:password)]' and verify the Base64 encoding is correct.

Step 4: Review the Application Log at System Diagnostics > Logs > Application Log for authentication-related error details that may provide more specific failure reasons.

Step 5: If using OAuth Bearer tokens, verify the token is still valid by checking the OAuth Token table (oauth_token) or generate a new token through the OAuth application flow.

Step 6: Confirm the user has the necessary roles and ACL permissions to access the target table or REST API endpoint by checking User Administration > Users and Roles.

Step 7: Test the API call using a REST client like Postman or curl with known good administrative credentials to isolate whether the issue is credential-specific or endpoint-specific.

Step 8: Check System Security > Access Control > IP Address Access Control to ensure the client IP address is not being blocked by IP restrictions.