ServiceNow change request "401 Unauthorized" in CI

By Daniel Zoghalchali·Latchkey

ServiceNow rejects the API call with 401 when the credential is missing or invalid. The Table and Change APIs accept basic auth (user:password) or OAuth; a 401 means the credential itself, not the permission, is the problem.

What this error means

A call to /api/now/table/change_request (or the DevOps Change API) fails with HTTP 401 and a ServiceNow "User Not Authenticated" body.

HTTP/1.1 401 Unauthorized
{"error":{"message":"User Not Authenticated","detail":"Required to provide Auth information"},
 "status":"failure"}

Common causes

Missing or wrong basic-auth credentials

The integration user/password was not injected, mistyped, or the account is inactive, so ServiceNow returns 401.

An expired or wrong OAuth token

When using OAuth, an expired access token or wrong client credentials produce 401 until refreshed.

How to fix it

Send valid basic auth from secrets

1. Store the integration user and password (or OAuth creds) as CI secrets.
2. Pass them on the request and target the correct instance host.
3. Verify with a small read before the change call.

curl -sf -u "$SN_USER:$SN_PASSWORD" \
  -H "Accept: application/json" \
  "https://your-instance.service-now.com/api/now/table/change_request?sysparm_limit=1"

Refresh OAuth before the call

If using OAuth, mint a fresh access token from the token endpoint at job start and send it as a Bearer token.

How to prevent it

• Keep ServiceNow credentials in CI secrets and inject them per step.
• Use a dedicated active integration user for CI.
• Smoke-test auth with a limited read before making changes.

Frequently asked questions

Related guides

References

• GitHub Actions documentation