Linking ServiceNow as a source

Alpha release

This source is currently in alpha. The interface and available tables may change.

The ServiceNow connector syncs your ITSM data into the PostHog data warehouse, including incidents, problems, change requests, users, configuration items, and more.

Available tables

Table name	ServiceNow table
incidents	`incident`
problems	`problem`
change_requests	`change_request`
change_tasks	`change_task`
tasks	`task`
catalog_requests	`sc_request`
requested_items	`sc_req_item`
catalog_tasks	`sc_task`
users	`sys_user`
user_groups	`sys_user_group`
configuration_items	`cmdb_ci`
knowledge_articles	`kb_knowledge`
assets	`alm_asset`

All tables support incremental sync using sys_updated_on (catches both inserts and updates) or sys_created_on (append-only style syncs).

Linking ServiceNow

Go to the Data pipeline page and the sources tab in PostHog.
Click New source and select ServiceNow.
Provide your ServiceNow instance URL (e.g., https://your-instance.service-now.com).
Choose your authentication method:
- Username and password – enter your ServiceNow username and password.
- API key – enter your ServiceNow API key.
Optional: Add a prefix to your table names.
Click Next.

The data warehouse then starts syncing your ServiceNow data. You can see details and progress in the data pipeline sources tab.

Authentication

ServiceNow supports two authentication methods:

Username and password – uses HTTP basic authentication against the ServiceNow Table API.
API key – uses the x-sn-apikey header for token-based authentication.

The account or API key needs read access to the tables you want to sync. This typically means the rest_api_explorer role or equivalent table ACLs on your ServiceNow instance.

Configuration

Option	Type	Required
`Instance URL`	text	Yes
`Authentication method`	select	Yes

Supported tables

Table	Description	Sync method	Incremental field	Primary key
`incidents`	An unplanned interruption or reduction in quality of an IT service (ServiceNow `incident` table).	Incremental, Full refresh	sys_updated_on, sys_created_on	—
`problems`	The underlying cause of one or more incidents (ServiceNow `problem` table).	Incremental, Full refresh	sys_updated_on, sys_created_on	—
`change_requests`	A request to add, modify, or remove anything that could affect IT services (ServiceNow `change_request` table).	Incremental, Full refresh	sys_updated_on, sys_created_on	—
`change_tasks`	A task carried out as part of a change request (ServiceNow `change_task` table).	Incremental, Full refresh	sys_updated_on, sys_created_on	—
`tasks`	The base task record that all task-based tables extend (ServiceNow `task` table).	Incremental, Full refresh	sys_updated_on, sys_created_on	—
`catalog_requests`	A request for one or more catalog items, submitted through the service catalog (ServiceNow `sc_request` table).	Incremental, Full refresh	sys_updated_on, sys_created_on	—
`requested_items`	An individual catalog item within a catalog request (ServiceNow `sc_req_item` table).	Incremental, Full refresh	sys_updated_on, sys_created_on	—
`catalog_tasks`	A fulfillment task for a requested catalog item (ServiceNow `sc_task` table).	Incremental, Full refresh	sys_updated_on, sys_created_on	—
`users`	A user account in the ServiceNow instance (ServiceNow `sys_user` table).	Incremental, Full refresh	sys_updated_on, sys_created_on	—
`user_groups`	A group of users, used for assignment and notifications (ServiceNow `sys_user_group` table).	Incremental, Full refresh	sys_updated_on, sys_created_on	—
`configuration_items`	A configuration item (CI) in the CMDB representing a managed asset or service (ServiceNow `cmdb_ci` table).	Incremental, Full refresh	sys_updated_on, sys_created_on	—
`knowledge_articles`	A knowledge base article (ServiceNow `kb_knowledge` table).	Incremental, Full refresh	sys_updated_on, sys_created_on	—
`assets`	An asset tracked in asset management (ServiceNow `alm_asset` table).	Incremental, Full refresh	sys_updated_on, sys_created_on	—