Skip to page contentSkip to chat
ServiceNow support
    • Community
      Ask questions, give advice, and connect with fellow ServiceNow professionals.
      Developer
      Build, test, and deploy applications
      Documentation
      Find detailed information about ServiceNow products, apps, features, and releases.
      Impact
      Accelerate ROI and amplify your expertise.
      Learning
      Build skills with instructor-led and online training.
      Partner
      Grow your business with promotions, news, and marketing tools
      ServiceNow
      Learn about ServiceNow products & solutions.
      Store
      Download certified apps and integrations that complement ServiceNow.
      Support
      Manage your instances, access self-help, and get technical support.
Is it possible to restrict REST calls for some users only? - Support and Troubleshooting
  • >
  • Knowledge Base
  • >
  • Support and Troubleshooting (Knowledge Base)
  • >
  • Is it possible to restrict REST calls for some users only?
KB0639032

Is it possible to restrict REST calls for some users only?


4164 Views Last updated : Apr 7, 2024 public Copy Permalink
KB Summary by Now Assist

Issue

Is it possible to restrict REST calls for some users only?

Problem
As users become more knowledgeable, they may start using REST calls to retrieve data from instances. Some administrators want the option to disable REST for some users.

 

Symptoms
Administrators see REST messages coming from different users on the instance transaction logs. Administrators could get asked to avoid REST API calls done by clients like powershell, Postman, REST explorer, Excel scripts, and other REST clients directly into the instance.

  

Cause
There are no settings that restrict REST access for some users. If a user has access to the record, the REST API is available for that record as well. Technically, everything is "accessible" by default. This means that the API is defined for all tables, but the web service must still pass both user authentication, Data Policies, and ACLs to get to the data.


Resolution
We recommend educating users if their actions are affecting instance performance. REST transactions are visible in instance transaction logs. If users abuse REST services, educate them on how they can tune their queries to reduce the impact on the instance.

To validate the transactions created on Today, with URL starting with /, Response time > 5000 and created is not guest: <instance>/syslog_transaction_list.do?sysparm_query=sys_created_onONToday%40javascript%3Ags.beginningOfToday()%40javascript%3Ags.endOfToday()%5EurlSTARTSWITH/%5Eresponse_time%3E5000%5Esys_created_by!%3Dguest%5Etype%3Drest

Administrators can also create transaction quota rules to limit some access to requests, but this is not recommended because it should not restrict required internal REST calls from those users. Use the available transaction quotas as as example (such as, search for <instance>/sysrule_quota_list.do?sysparm_query=conditionLIKErest). Note that this is a very advanced feature, so fully test on a development instance before making changes on production. 

The world works with ServiceNow.

Sign in for more! There's more content available only to authenticated users Sign in for more!
Did this KB article help you?
Did this KB article help you?

How would you rate your Now Support digital experience?

*

Very unsatisfied

Unsatisfied

Neutral

Satisfied

Very satisfied

Very unsatisfied

Unsatisfied

Neutral

Satisfied

Very satisfied

What can we improve? Please select all that apply.

What are we doing well? Please select all that apply.

Tell us more

*

Do you expect a response from this feedback?

  • Terms and conditions
  • Privacy statement
  • GDPR
  • Cookie policy
  • © 2025 ServiceNow. All rights reserved.