Integrating Temporary Access Passes with ServiceNow
A typical integration lets a ServiceNow agent or workflow issue a Temporary Access Pass (TAP) for a user, and show the pass once to the person who needs it.
Authentication
ServiceNow authenticates to the REST API with a dedicated service account. The account requests a bearer token from /identity/connect/token, then sends it with each call.
The account must be a member of _EXPLICIT_REST_API_USERS_ to get a token, and must satisfy the TAP endpoint policies. See REST API Authorization policies. In 12.11 and later, the account's user group also needs the Issue temporary access passes privilege.
In 12.9 and later, requests that issue (POST) or revoke (DELETE) a pass also require CSRF protection. Requests that list passes (GET) do not. The token response sets a BravuraSecurityFabric-CSRF-Token cookie. Send the bearer token, that cookie, and an X-CSRF-Token header whose value is the URL-decoded cookie value.
Request
To issue a pass, ServiceNow sends POST /api/rest/v2/accounts(<accountGuid>)/temporaryAccess for the user's Microsoft Entra ID account.
The request can set the pass lifetime, whether the pass can be used only once, and a start time. If the request leaves out the lifetime or the one-time use setting, the target system's defaults apply. For the request and response format, see the REST API Reference in Postman.
Displaying the pass
The response to the issue request is the only place the pass code appears. Listing passes never returns it.
Configure ServiceNow to display the code once, to the agent or user. Do not write it to the ticket, work notes, or logs.