Q: What causes Now Platform REST API Returning 403 Forbidden?

Missing rest_service role on authenticating user — Check the sys_user_has_role table for the authenticating user. The Table API requires the rest_service role to function. Navigate to User Administration > Users and verify role assignments. Insufficient ACL permissions on target table — The user lacks read/write ACLs on the target table. Check sys_security_acl table for the table being accessed and verify the user's roles meet the ACL requirements. IP address blocked by allowlist — Instance has IP restriction configured in sys_properties with glide.rest.inbound.ecc_queue.skip_sensor property or custom IP allowlisting. Check System Logs > System Log > All for IP-related rejection messages. Scripted REST API resource role restrictions — The specific REST resource in sys_ws_operation has role requirements that the authenticating user doesn't meet. Check the 'Requires authentication' and 'Role required' fields on the resource definition. Rate limiting or IP-based blocking active — ServiceNow's built-in rate limiting is blocking the requests. Check System Logs > REST for rate limiting messages or examine the sys_rt_schedule table for active rate limiting rules.

Question 1

What causes Now Platform REST API Returning 403 Forbidden?

Accepted Answer

Missing rest_service role on authenticating userhigh likelihood

Check the sys_user_has_role table for the authenticating user. The Table API requires the rest_service role to function. Navigate to User Administration > Users and verify role assignments.

Insufficient ACL permissions on target tablehigh likelihood

The user lacks read/write ACLs on the target table. Check sys_security_acl table for the table being accessed and verify the user's roles meet the ACL requirements.

IP address blocked by allowlistmedium likelihood

Instance has IP restriction configured in sys_properties with glide.rest.inbound.ecc_queue.skip_sensor property or custom IP allowlisting. Check System Logs > System Log > All for IP-related rejection messages.

Scripted REST API resource role restrictionsmedium likelihood

The specific REST resource in sys_ws_operation has role requirements that the authenticating user doesn't meet. Check the 'Requires authentication' and 'Role required' fields on the resource definition.

Rate limiting or IP-based blocking activelow likelihood

ServiceNow's built-in rate limiting is blocking the requests. Check System Logs > REST for rate limiting messages or examine the sys_rt_schedule table for active rate limiting rules.

Question 2

How do you fix Now Platform REST API Returning 403 Forbidden?

Accepted Answer

How to fix it Verify the authenticating user has the rest_service role by navigating to User Administration > Users, search for the user, and check the Roles related list. If missing, add the rest_service role by clicking 'Edit' on the Roles related list and adding it from the Collection tab. Check table-level ACL permissions by navigating to System Security > Access Control (ACL) and filtering by the target table name (e.g., incident). Review each ACL record for 'read', 'write', 'create', and 'delete' operations - ensure the user has roles that satisfy the Requires role field or that the Script field evaluates to true for this user. If using a Scripted REST API, navigate to System Web Services > Scripted Web Services > Scripted REST APIs and locate your API definition. Click into the specific HTTP method resource and verify the Requires authentication and Role required fields - ensure the user has the specified role. Check for IP restrictions by navigating to System Properties > Basic Configuration and searching for properties containing ip or whitelist. Review System Logs > System Log > All for entries containing 'REST', 'IP', or '403' around the time of your API call to identify specific blocking reasons. If IP allowlisting is the issue, add the caller's IP to the allowlist or modify the relevant system property to include the IP range. For rate limiting issues, navigate to System Definition > Tables and open sys_rt_schedule to check for active rate limiting rules affecting your endpoint.

Question 3

How do you prevent Now Platform REST API Returning 403 Forbidden?

Accepted Answer

Create a dedicated integration user account with only the necessary roles (rest_service plus table-specific roles) rather than using admin accounts for API calls. Document all required roles and ACL permissions for each integration in your environment's integration runbook to avoid access issues during user changes. Set up proactive monitoring for 403 errors in System Logs > REST to catch permission issues before they impact production integrations. Use role-based service accounts with clearly defined access patterns and regularly audit their permissions against actual usage. Always test API access with the actual integration user account in sub-production environments before deploying to production.

Now Platform REST API Returning 403 Forbidden

Symptom

Possible Causes

Debugging this in a real instance?

Solution

How to fix it

Prevention Tips

Test Your Knowledge