Query records using an encoded query string

Encoded queries are ServiceNow's internal format for complex filter conditions — the same strings the platform uses when you build filters in list views. The addEncodedQuery() method lets you apply these pre-built filter strings directly to GlideRecord queries, avoiding the tedium of chaining multiple addQuery() calls for complex logic. Most developers discover this method when they need to replicate a complex list filter in server-side code, but they often miss that encoded queries are fragile — field name changes break them silently, and user-supplied encoded queries are a direct path to data exposure.

When to use this

• When you've built complex filters in the UI and need to replicate the exact same logic in server-side code
• When you have queries with complex OR conditions that would require multiple addQuery() and addOrCondition() calls
• When you're building scheduled jobs or business rules that need to process records matching saved filter conditions
• When you're migrating report queries or dashboard widgets to server-side processing

When NOT to use this

• Don't accept encoded query strings from user input or URL parameters — they bypass field-level ACLs and can expose restricted data
• Don't use this for simple single-field queries — addQuery('state', '2') is clearer and more maintainable than encoded strings
• Don't use this in applications where field names might change — encoded queries break silently when fields are renamed or removed
• Don't use this for cross-scope queries without testing — encoded queries may reference fields that don't exist in your application scope

Key behaviors and gotchas

• Get encoded queries from list views by right-clicking the filter breadcrumb and selecting "Copy Query" — don't try to construct them manually
• Choice field values in encoded queries use internal values, not display values — state=2 means "In Progress", not "2"
• Reference field queries in encoded strings use sys_id values, not display values — assigned_to=abc123 not assigned_to=John Smith
• Encoded queries respect ACLs when the query runs, but malicious encoded strings can attempt to read fields the current user shouldn't access
• You can combine addEncodedQuery() with regular addQuery() calls — they're ANDed together in the final query
• Domain separation applies to encoded queries — cross-domain filters may return no results even if the encoded string is syntactically correct