Troubleshoot ServiceNow Data Out

Use this page as a symptom-first index for ServiceNow. Find the line that matches what you are seeing, follow the link, and you should be back to a working state in a few minutes. For symptoms that are the same across providers, such as a stuck job, see Troubleshoot Jira Data Out.

Connection problems

Connection fails to verify

Symptom: You filled in Connection name, Subdomain, Username, and Password on the Connect step, and either the wizard showed Connection created but authorization failed. Please check your credentials., or the Verify step shows Connection authorization failed or Connection failed - no tables were returned instead of Your connection is working!.

Most likely causes:

• Wrong Subdomain format - the field expects only the instance name (acme), not a full URL. Remove any https:// prefix and the .service-now.com suffix
• Wrong credentials - the username or password does not match. Try signing in to ServiceNow with the same values, and remember passwords are case-sensitive
• Password needs reset - the service account has Password needs reset selected in ServiceNow, which makes ServiceNow reject API sign-ins with 401 even when the password is correct. Clear the flag
• Basic authentication is restricted - your instance restricts basic authentication for API calls and the account is not exempt. Use a Web service access only account or give the account the snc_basic_auth_api_access role
• Account locked, inactive, or MFA-protected - confirm the account is active and not locked out, and that it does not require multi-factor authentication or single sign-on to sign in
• No access to list tables - the account can sign in but cannot read the Tables (sys_db_object) and Dictionary entry (sys_dictionary) tables, so no tables are returned. See Grant the account the access it needs
• Instance unavailable - the ServiceNow instance is offline, hibernating (common for developer instances), or being upgraded

When you see Connection created but authorization failed, the connection has already been saved in a Failed state. Open Data out > Connections > ServiceNow, click Re-authorize on the connection, re-enter the corrected credentials, and re-step through Verify. If you try to create another connection with the same name instead, the wizard rejects it with A connection with this name already exists.

Authorization status reads "Failed"

Symptom: The connection card on Data out > Connections > ServiceNow shows a red Failed badge and the banner This connection failed authorization and needs to be re-authorized.

Cause: ServiceNow no longer accepts the stored credentials. Almost always a changed or expired password, a locked or disabled account, or a Password needs reset flag on the account.

Fix: Follow Re-authorize a connection. If the new password still fails Verify, the account itself has lost access - have a ServiceNow administrator restore it.

"I cannot edit a connection without re-entering everything"

This is expected. When you edit a ServiceNow connection, the Subdomain, Username, and Password fields start empty because JupiterOne does not display stored credentials. Re-enter all three and click Update connection.

"I cannot find the kebab menu to edit a connection"

The kebab menu (...) sits at the right end of the connection header on the per-provider detail page (Data out > Connections > ServiceNow), not on the provider catalog card. If you are on the catalog page (the one with the Jira, ServiceNow, and Asana cards) and want to edit, click the ServiceNow card's View -> button first. You can also click Re-authorize in the red banner on a failing connection.

Delete is disabled on a connection

Symptom: Delete is greyed out in the connection's kebab menu with the tooltip Delete all instances before removing this connection.

Cause: One or more instances still use the connection.

Fix: Delete the instances listed on the connection card (see Manage instances), then delete the connection.

Instance problems

I do not see ServiceNow on the Instances tab

Symptom: You set up a ServiceNow connection, but Data out > Instances has no ServiceNow section.

Cause: The Instances tab lists a provider only after it has at least one instance.

Fix: Open Data out > Connections > ServiceNow and click Add an instance on the connection card. See Create a ServiceNow instance.

The Data in ServiceNow integration field is missing

Symptom: On the Configure step, there is no Data in ServiceNow integration field, or the dropdown shows no integrations.

Cause: The field loads from the ServiceNow Data in integrations in your workspace. If the list of integration definitions has not loaded, or none exist, the field is hidden or empty. The field is optional.

Fix: Set up a ServiceNow Data in integration (see Add an integration), then reopen the wizard or edit the instance. You can also continue without it - choose None.

Test incident does not appear in ServiceNow

Symptom: You clicked Send test on the Test step of the Add ServiceNow instance wizard. The wizard reports success, but no incident appears.

Diagnosis:

1. Open Data out > Instances, find the new instance, and check the Successful jobs count. If it incremented to 1, ServiceNow accepted the payload - the incident exists
2. In ServiceNow, open the Incident table and search for the test Short description text. Remember the incident's short description begins with [TEST]
3. Check that you are looking at the same ServiceNow instance that the connection's Subdomain points to - a common mistake when you have both production and sub-production instances

If Successful jobs stayed at 0 and Failed jobs incremented, the payload was rejected - see A job failed below.

Instance is Active but no incidents are being created

Symptom: Status reads Active, Last run is hours or days ago, and Successful jobs + Failed jobs counts are not changing.

Diagnosis:

• Confirm a producer is calling the instance. The primary producers are the CCM Create ticket modal and the Create ticket action on Vulnerability Management remediation cases - if no one has clicked Create ticket, the instance has nothing to do
• Check that the instance is Active, not Paused or in Error. A stopped instance does not create incidents, and it is left out of the Create ticket Workflow dropdown
• Confirm users see your instance in the Workflow dropdown of the Create ticket modal. If they do not, the instance may have been stopped, or they may be looking at a different workspace

Job problems

A job failed

Symptom: A job in the per-instance Jobs table shows status Failed with an Error message.

Fix: Find the message that best matches in the table below. The exact wording comes from ServiceNow and can vary by version and configuration.

Message mentions	Likely cause	Where to fix
401 or Unauthorized	The service account's credentials are rejected - the password changed or expired, the account is locked, or Password needs reset is set.	Re-authorize the connection.
403, Forbidden, or User Not Authorized	The service account lost permission to create incidents, or basic authentication was restricted for it.	Have a ServiceNow administrator restore the access described in Grant the account the access it needs.
404 or not found	The Subdomain no longer points at a valid instance, or the Incident table is not reachable through the API.	Edit the connection and confirm the Subdomain.
A field name or a data policy message	ServiceNow requires a field on new incidents (for example Caller or Category) that Data Out does not send.	Set a default for that field on the ServiceNow side, or relax the data policy for the service account. See What is not configured on the instance.
503, timeout, or an instance-unavailable message	The ServiceNow instance is offline, hibernating, or being upgraded.	Wait for the instance to come back, then create the ticket again.

For stuck jobs and other symptoms that apply to every provider, see A job is stuck.

CCM Create ticket problems

The ServiceNow workflow is not in the Workflow dropdown

Symptom: You clicked Create ticket on a control, but your ServiceNow workflow is not in the Workflow dropdown.

Cause: The dropdown lists only Active instances, so a paused instance or an instance in Error does not appear.

Fix (admin): Open Data out > Instances, find the ServiceNow instance, and start it (see Manage instances). If it is in Error, open its detail page and read the Jobs table for the cause.

Fix (non-admin): Ask a workspace admin to start the instance.

The Assignee field is missing

Symptom: The Create ticket modal shows an Assignee field for a Jira workflow but not for your ServiceNow workflow.

Cause: This is expected. ServiceNow workflows do not offer an assignee picker, and the modal hides the field. The incident is created unassigned.

Fix: Assign incidents with your ServiceNow assignment rules or triage process.

The incident description shows ## and [...](...) characters

Symptom: The ServiceNow incident's Description contains literal markdown such as ## Failing control tests or [test name](https://...).

Cause: ServiceNow receives the description as plain text. JupiterOne converts markdown only for Jira.

Fix: Remove the markdown characters in the Create ticket modal's Description editor before you click Create ticket.

The Create ticket button is disabled on a control

Symptom: The control detail panel's Create ticket button is greyed out.

Cause: Your role is not full admin. The button is disabled with the tooltip Full admin access is required to create a ticket.

Fix: Ask a full admin to create the ticket, or to change your role.

"The Linked tickets section is empty after I clicked Create ticket"

Symptom: You clicked Create ticket and the modal closed with Ticket created, but the Linked tickets section on the control detail panel is still empty.

Diagnosis:

1. Wait a moment and refresh the control detail panel - the incident is created asynchronously and the list updates after the call completes
2. Open the originating Workflow's instance detail page (Data out > Instances > {Workflow name}) and look for the most recent row in the per-instance Jobs table. If it is Succeeded, the incident was created in ServiceNow - the control panel may simply be stale; refresh it
3. If the most recent job is Failed, the incident never made it into ServiceNow. Read the Error message column and follow A job failed

Created incidents land in the wrong ServiceNow instance

Symptom: Incidents are landing in a ServiceNow instance, but not the one you expected.

Cause: The Workflow you picked in the dropdown uses a connection whose Subdomain points at a different ServiceNow instance than you assumed.

Fix: Open Data out > Connections > ServiceNow and check which connection the Workflow belongs to. For a one-off correction, pick a different Workflow on the Create ticket modal next time. For a permanent change, edit the connection with the correct Subdomain, or create a new instance on the right connection and delete the old one.

Still stuck?

If none of the above resolves your issue, gather the following information before contacting JupiterOne Support:

• The Job ID of the failing job (from the per-instance Jobs table on the instance detail page)
• A copy of the Error message column value for that job
• The Workflow name of the affected instance
• The control identifier (if the symptom is on the CCM side)
• A screenshot of the Authorization status badge on the connection card

Support can correlate the Job ID with the underlying outbound delivery to pinpoint where the call dropped.