> ## Documentation Index
> Fetch the complete documentation index at: https://docs.iru.com/llms.txt
> Use this file to discover all available pages before exploring further.

# ServiceNow integration: ServiceNow configuration

> Install the Kandji ServiceNow app, create OAuth credentials and a service account, and verify discovery source settings for the Iru Endpoint integration.

### Installing the Kandji ServiceNow App

If the app is not installed yet, install the Kandji ServiceNow app in your ServiceNow instance. The install adds dependencies your tenant needs for the integration.

<Steps>
  <Step title="Access ServiceNow Store">
    Go to the [ServiceNow store](https://store.servicenow.com/sn_appstore_store.do#!/store/home).
  </Step>

  <Step title="Find the Kandji ServiceNow app">
    In the store, search for **Kandji** to find the **Kandji ServiceNow app**.
  </Step>

  <Step title="Install Kandji ServiceNow app">
    Install the Kandji ServiceNow app by selecting **Get**. Sign in to the ServiceNow store if prompted. The account you use must be allowed to install Integration Hub store apps.
  </Step>
</Steps>

### Creating an OAuth App

Iru Endpoint uses a ServiceNow OAuth API client with grant type **Resource Owner Password Credentials (ROPC)** to get access and refresh tokens for your instance.

<Note>
  On ServiceNow **Zurich** and later releases, set **Scope Restriction** to **Broadly scoped** when you create the OAuth API endpoint for external clients. If this field is set to a narrower scope, inbound API calls from Iru Endpoint can fail with errors such as *OAuth client does not have unrestricted access to unscoped APIs is not allowed*. For more information, see ServiceNow [KB2731346](https://support.servicenow.com/kb?id=kb_article_view\&sysparm_article=KB2731346).
</Note>

<Steps>
  <Step title="Access ServiceNow">
    Using a ServiceNow admin account, log in to your ServiceNow tenant ({yourtenant}.service-now\.com).
  </Step>

  <Step title="Navigate to System OAuth">
    In the **Filter navigator**, search for **System OAuth**.
  </Step>

  <Step title="Open Application Registry">
    Click **Application Registry**.
  </Step>

  <Step title="Create OAuth Endpoint">
    Click **Create an OAuth API endpoint for external clients**.
  </Step>

  <Step title="Configure OAuth App">
    Give the OAuth app a name (for example, `kandji_oauth_api`).
  </Step>

  <Step title="Set Redirect URL">
    In the **Redirect URL** field, enter [**https://kandji.io**](https://kandji.io).
  </Step>

  <Step title="Submit Configuration">
    Click **Submit**.
  </Step>

  <Step title="Access OAuth App">
    Go back to the OAuth app that you just created.
  </Step>

  <Step title="Copy Client ID">
    Highlight and copy the **Client ID**.
  </Step>

  <Step title="Reveal Client Secret">
    Reveal the **Client Secret** by clicking the padlock.
  </Step>

  <Step title="Copy Client Secret">
    Copy the **Client Secret**. If you set your own client secret, select **Update** to save it.
  </Step>
</Steps>

### Adding a Service Account

The service account user credentials are used to configure the ServiceNow integration in Iru Endpoint.

<Note>
  Any ServiceNow user account can be used as long as it has access to web services and has the roles **cmdb\_read**, **import\_transformer**, and **rest\_api\_explorer**. Create a dedicated service account for this integration when possible.
</Note>

<Steps>
  <Step title="Access ServiceNow">
    Using a ServiceNow admin account, log in to your ServiceNow tenant ({yourtenant}.service-now\.com).
  </Step>

  <Step title="Navigate to Users">
    In the **Filter navigator**, search for **Users**.
  </Step>

  <Step title="Open User Administration">
    Under User Administration, click **Users**.
  </Step>

  <Step title="Create New User">
    Click **New** to add a new user.
  </Step>

  <Step title="Configure User Details">
    Enter a descriptive name for the user (for example, `kandji_rest_api_user`). Copy the username to a secure location. You need it when you configure the integration in Iru Endpoint.

    * Optionally, enter any additional information required by your organization.
  </Step>

  <Step title="Set Web Service Access">
    Select **Web service access only**.
  </Step>

  <Step title="Submit User Creation">
    Click **Submit**.
  </Step>

  <Step title="Set User Password">
    Open the user you just created, then select **Set Password**.
  </Step>

  <Step title="Generate Password">
    Click **Generate** to create the new password.
  </Step>

  <Step title="Copy Password">
    Copy the new password.
  </Step>

  <Step title="Save Password">
    Click **Save Password**. Store the password in a secure location. You enter it in Iru Endpoint when you configure the ServiceNow integration.
  </Step>

  <Step title="Close Password Dialog">
    Click **Close** to go back to the Users page.
  </Step>

  <Step title="Access User Roles">
    While still on the user page, go to **Roles**.
  </Step>

  <Step title="Edit Roles">
    Click **Edit**.
  </Step>

  <Step title="Add Required Roles">
    Add the following roles to the service account user:

    * cmdb\_read
    * import\_transformer
    * rest\_api\_explorer
  </Step>

  <Step title="Verify Role Assignment">
    You should see six roles in total: three you added directly and three inherited.
  </Step>

  <Step title="Save User Configuration">
    To complete the user creation, click **Save**.
  </Step>
</Steps>

### Troubleshooting

#### Verify that Kandji is a Discovery Source

<Steps>
  <Step title="Access Dictionary">
    In ServiceNow, enter **Dictionary** in the **Filter navigator**.
  </Step>

  <Step title="Open Dictionary">
    Under System Definition, click **Dictionary**.
  </Step>

  <Step title="Search for Discovery Source">
    In Dictionary Entries, select **Column name**, then enter **discovery\_source**.
  </Step>

  <Step title="Select CMDB Table">
    Select the **cmdb\_ci** table.
  </Step>

  <Step title="Access Choices Tab">
    Scroll down and select the **Choices** tab.
  </Step>

  <Step title="Verify Kandji">
    Confirm **Kandji** is listed. If it does not appear, search for the label **Kandji**.
  </Step>
</Steps>

#### If Kandji does not show up as a Discovery Source

Run **kandji\_fix\_script** manually if **Kandji** does not appear as a discovery source after you install the Kandji ServiceNow app.

<Steps>
  <Step title="Access Fix Scripts">
    In ServiceNow, enter **Fix Script** in the **Filter navigator**.
  </Step>

  <Step title="Open Fix Scripts">
    Under System Definition, click **Fix Scripts**.
  </Step>

  <Step title="Search for Fix Script">
    In Fix Scripts, select **Name**, then enter **kandji\_fix\_script**.
  </Step>

  <Step title="Select Fix Script">
    Open the **kandji\_fix\_script** record.
  </Step>

  <Step title="Run Fix Script">
    Click **Run Fix Script**.
  </Step>

  <Step title="Execute in Background">
    In the Run Fix Script modal, click **Proceed in Background**.
  </Step>
</Steps>

Kandji should now appear as a discovery source choice in ServiceNow.

## Considerations

<CardGroup cols={2}>
  <Card title="Service accounts" icon="user">
    Prefer a dedicated account for this integration instead of reusing an interactive user, so access and changes are easier to audit.
  </Card>

  <Card title="OAuth" icon="key">
    On **Zurich** and later, set **Scope Restriction** to **Broadly scoped** when you create the OAuth app (see [Creating an OAuth App](#creating-an-oauth-app)). Set the redirect URL to `https://kandji.io` and store client credentials securely.
  </Card>

  <Card title="Roles" icon="shield">
    The service account needs **cmdb\_read**, **import\_transformer**, and **rest\_api\_explorer**.
  </Card>

  <Card title="Discovery source" icon="magnifying-glass">
    After install, confirm **Kandji** appears under discovery source choices for **cmdb\_ci** in Dictionary.
  </Card>

  <Card title="Troubleshooting" icon="wrench">
    If discovery source or sync looks wrong, run the **kandji\_fix\_script** fix script and confirm the service account has the three roles above.
  </Card>
</CardGroup>

### Related Articles

<CardGroup cols={2}>
  <Card title="ServiceNow integration: Overview" icon="book-open" href="/en/endpoint/integrations/servicenow/servicenow-integration-overview">
    How inventory flows from Iru Endpoint to ServiceNow tables and transforms, and how SAM Pro data flows when enabled.
  </Card>

  <Card title="ServiceNow integration: Iru Endpoint configuration" icon="plug" href="/en/endpoint/integrations/servicenow/servicenow-integration-iru-endpoint-configuration">
    Connect Iru Endpoint with your OAuth app and service account, and manage the integration after ServiceNow is ready.
  </Card>
</CardGroup>