Make an outbound REST call with Basic Auth

ServiceNow's RESTMessageV2 handles Basic Auth through setBasicAuth(), which automatically encodes credentials and sets the Authorization header. The biggest mistake developers make is hardcoding credentials directly in scripts instead of using Connection and Credential aliases — this creates a security vulnerability and makes credential rotation a nightmare across multiple environments. The platform's credential management system exists specifically to solve this problem, but most developers skip it because they want to "get it working first."

When to use this

• When integrating with external APIs that require Basic authentication (common with older enterprise systems)
• In Business Rules, Script Includes, or Scheduled Jobs where you need real-time data from external systems
• When the external system doesn't support OAuth or API keys (legacy systems often only support Basic Auth)
• For synchronous operations where you need the response immediately to continue processing

When NOT to use this

• Don't use this in client scripts — outbound REST calls are server-side only. Use GlideAjax to call a Script Include instead
• Don't hardcode credentials in the script — use Connection and Credential aliases for security and maintainability
• Don't use this for high-volume operations — consider Import Sets with scheduled imports for bulk data synchronization
• Don't use Basic Auth if the external API supports OAuth or API keys — Basic Auth credentials are base64 encoded, not encrypted

Key behaviors and gotchas

• setBasicAuth() automatically base64 encodes the username:password and sets the Authorization: Basic header — don't set it manually
• Always check getStatusCode() before processing the response — a 401 means authentication failed, 403 means forbidden
• getBody() returns a string — wrap JSON.parse() in try/catch because malformed JSON will throw an exception
• RESTMessageV2 has a 30-second default timeout — set setHttpTimeout() if the external API is slow
• Connection and Credential aliases require rest_service_user role to manage — use setAuthenticationProfile() instead of hardcoded credentials
• Outbound HTTP requests respect the instance's proxy settings — verify connectivity in sub-production environments