Integrating Temporary Access Passes with ServiceNow
A typical integration lets a ServiceNow agent or workflow issue a Temporary Access Pass (TAP) for a user, and show the pass once to the person who needs it.
Authentication
ServiceNow authenticates to the REST API with a dedicated service account. The account requests a bearer token from /identity/connect/token, then sends it with each call.
The account must be a member of _EXPLICIT_REST_API_USERS_ to get a token, and must satisfy the TAP endpoint policies. See REST API Authorization policies. In 12.11 and later, the account's user group also needs the Issue temporary access passes privilege.
Request
To issue a pass, ServiceNow sends POST /api/rest/v2/accounts(<accountGuid>)/temporaryAccess for the user's Microsoft Entra ID account.
The request can set the pass lifetime, whether the pass can be used only once, and a start time. If the request leaves these out, the target system's defaults apply. For the request and response format, see the REST API Reference in Postman.
Displaying the pass
The response to the issue request is the only place the pass code appears. Listing passes never returns it.
Configure ServiceNow to display the code once, to the agent or user. Do not write it to the ticket, work notes, or logs.