Read the request body in a Scripted REST…

Server-sideadvancedTested on Xanadu

Chrome Extension

Sourdough: ServiceNow Monitoring and Analytics

A Chrome extension for ServiceNow Admins and Developers with essential tools, analytics, graphs and monitoring features.

Instance HealthGraphs & ChartsAPI HealthDeveloper ToolsQuick SearchInstance Switcher

Add to Chrome

Free to install. Pro $5/month after a 14-day no-card trial.
Pro requires the ServiceNow admin role. Upgrade inside the extension.

Overview

Tasks

CMDB

API

Metrics

Monitor

Internals

Instance:sourdoughdev·Version:Yokohama

Instance StateONLINE

System StatusFully Operational

Session Timeout90 minutes

Logged-In Sessions2 (20 active)

Build Nameyokohama-12-18-2024_p1

IP Address10.159.128.43

Instance HealthHealth Score: 90%

🔥 5dSourdough (Chrome Plugin)Dark Mode

Parse the JSON request body in an inbound Scripted REST API endpoint

Scripted REST API

(function process(request, response) {
    try {
        // Validate content type before attempting JSON parse
        var contentType = request.getHeader('Content-Type');
        if (!contentType || contentType.indexOf('application/json') !== 0) {
            return response.setStatus(400).setBody({error: 'Content-Type must be application/json'});
        }

        var requestBody = request.body.data;
        if (!requestBody) {
            return response.setStatus(400).setBody({error: 'Request body is required'});
        }

        // Parse and validate required fields
        if (!requestBody.incident_number || !requestBody.state) {
            return response.setStatus(400).setBody({error: 'incident_number and state are required'});
        }

        // Process the incident update
        var incident = new GlideRecord('incident');
        if (!incident.get('number', requestBody.incident_number)) {
            return response.setStatus(404).setBody({error: 'Incident not found'});
        }

        incident.state = requestBody.state;
        incident.work_notes = requestBody.work_notes || 'Updated via API';
        incident.assigned_to = requestBody.assigned_to || incident.assigned_to;
        incident.update();

        // Include query parameters in response for audit
        var source = request.getParameter('source') || 'unknown';
        var correlationId = request.getHeader('X-Correlation-ID') || gs.generateGUID();

        response.setStatus(200);
        response.setBody({
            success: true,
            incident_sys_id: incident.getUniqueValue(),
            processed_by: source,
            correlation_id: correlationId
        });

    } catch (ex) {
        gs.error('REST API error: ' + ex.message);
        response.setStatus(500).setBody({error: 'Internal server error'});
    }
})(request, response);

The request.body.data property gives you the parsed JSON object from the request body—but only if ServiceNow successfully parsed it as JSON. Unlike other platforms where you get raw strings to parse yourself, ServiceNow pre-processes the body based on the Content-Type header. If the client sends malformed JSON or the wrong content type, request.body.data will be null or undefined with no helpful error message, leaving you debugging ghost requests that "aren't sending data" when they actually are—just not parseable.

When to use this pattern

Building REST endpoints that accept complex data structures with multiple fields or nested objects
Integrating with external systems that send JSON payloads for record updates or bulk operations
When you need both request body data and headers/query parameters for validation or audit trails
Processing webhook payloads from third-party services that follow REST conventions

When NOT to use this pattern

Don't build Scripted REST endpoints for ServiceNow-to-ServiceNow communication—use direct Script Include calls instead
Don't use this for simple GET operations with URL parameters—use query parameters with request.getParameter() instead
Don't process non-JSON payloads this way—for XML or form data, use request.body.dataString and parse manually
Don't use this for file uploads—ServiceNow Scripted REST APIs handle binary data differently through attachments

Key behaviors and gotchas

ServiceNow only populates request.body.data when Content-Type starts with application/json—other content types leave it undefined
The request.body.data object is already parsed—calling JSON.parse() on it will throw an error
Headers are case-insensitive when retrieved with request.getHeader(), but query parameters with request.getParameter() are case-sensitive
All inbound data is treated as strings initially—numeric field assignments like incident.state = requestBody.state work because ServiceNow coerces string values
Empty request bodies (Content-Length: 0) result in request.body.data being null, not an empty object
ACLs still apply to record operations within Scripted REST endpoints—test with users who have different role permissions
ServiceNow automatically logs failed JSON parse attempts in the system log with cryptic "REST API" entries

⚠️

Never trust request.body.data exists without checking—malformed JSON or missing Content-Type headers cause it to be null, and accessing properties on null crashes your endpoint with an unhelpful 500 error that makes debugging nearly impossible.

Free Newsletter

Enjoying this? Get one deep-dive per week.

Join 1,000+ ServiceNow pros — scripts, GlideRecord patterns, Flow Designer techniques, and career moves. Free.

Alternative Approaches

Raw body parsing with manual JSON.parse()

(function process(request, response) {
    try {
        var rawBody = request.body.dataString;
        if (!rawBody) {
            return response.setStatus(400).setBody({error: 'Request body required'});
        }
        
        var requestData = JSON.parse(rawBody);
        
        // Process requestData...
        response.setStatus(200).setBody({success: true});
        
    } catch (ex) {
        response.setStatus(400).setBody({error: 'Invalid JSON: ' + ex.message});
    }
})(request, response);

Use this when you need custom JSON parsing logic or better error messages for malformed payloads.

Trade-offs: More verbose but gives you complete control over parsing errors and edge cases.

Test Your Knowledge

Quick 3-question quiz — see how your ServiceNow skills stack up.

Question 1 of 3Performance

A list view on a table with millions of records is slow. Best fix?

Select an answer to continue

Read the request body in a Scripted REST endpoint