Connect ServiceNow to Teamwork Graph using a direct connector

Connect ServiceNow to Rovo so people can find operational information and complete supported ServiceNow tasks from Rovo Chat and Rovo agents.

How the direct connection works

Rovo sends live requests to your ServiceNow instance when a person asks it to complete a supported task. The direct connector does not proactively crawl or index your ServiceNow content into Teamwork Graph.

The connection has two authorization layers:

• An administrator configures the connector using an OAuth application created in ServiceNow.

• Each person authorizes their own ServiceNow account when they first use the connector.

ServiceNow remains the source of truth for access. Rovo can only return or change information that the signed-in person is permitted to access under ServiceNow roles, table permissions, record ACLs, and field ACLs.

Before you begin

Before you set up the connection, make sure you have:

• Atlassian organization or site administrator access.

• ServiceNow administrator access to create an OAuth application.

• the subdomain or instance name for the ServiceNow environment you want to connect.

• approval from your security or data governance team for the intended read and write actions.

• a test user whose ServiceNow permissions represent the people who will use the connector.

Decide which ServiceNow environment to connect before setup. Start with a non-production environment if your organization requires validation before production use.

Create an OAuth application in ServiceNow

1. Confirm that OAuth is enabled in ServiceNow. The OAuth plugin is com.snc.platform.security.oauth, and the corresponding OAuth property must be active.

2. In ServiceNow, go to System OAuth, then Application Registry.

3. Select New, then choose the option to create an OAuth API endpoint for external clients.

4. Give the application a recognizable name, such as Atlassian Rovo.

5. Add this production redirect URL exactly as shown: https://id.atlassian.com/outboundAuth/finish.

6. Configure the useraccount authorization scope.

7. Save the application.

8. Copy the client ID and client secret to an approved secret-management system. Do not place the secret in tickets, chat messages, or shared documents.

Add the direct connector in Atlassian Administration

1. Go to admin.atlassian.com. Select your organization if you have more than one.

2. Open Apps, then Connectors.

3. Select Add connector, then choose ServiceNow.

4. Select Direct as the connection type.

5. Enter a clear connection name, your ServiceNow instance or subdomain, the OAuth client ID, and the OAuth client secret.

6. Review the notice about third-party access, then save or validate the connection.

7. When prompted, sign in to ServiceNow and authorize the connection with the test user.

8. Use the production callback exactly as shown: https://id.atlassian.com/outboundAuth/finish.

Test the connection

Test a read action before testing a write action.

Suggested read tests:

• “Using ServiceNow, show my open incidents.”

• “Find ServiceNow knowledge articles about VPN access.”

• “Show change requests scheduled for this week in ServiceNow.”

Confirm that:

• the result comes from the intended ServiceNow instance

• the test user sees only records they can access directly in ServiceNow

• record details and links point to the expected instance

If you enable write actions, use a non-critical test record first:

• “Create a low-priority ServiceNow incident titled ‘Rovo connector validation’.”

• “Add a work note to incident INC0012345 saying ‘Connector validation completed’.”

Review the proposed change carefully and approve the confirmation only when the target and content are correct.

What people can do

Available tools depend on the actions approved by the Atlassian administrator, and each person’s ServiceNow permissions.

Typical read tasks include:

• Find and review incidents, changes, problems, and knowledge articles.

• Inspect configuration items and their relationships.

• Check service catalog information, project records, users, groups, and SLA details.

Typical write tasks include:

• Create or update an incident.

• Add a work note to an incident.

• Complete other approved ServiceNow actions exposed by the connector.

Include “using ServiceNow” in a prompt if Rovo could reasonably use more than one connected app.

Permissions and security

Note the following points:

• Each person signs in with their own ServiceNow account. Do not use a shared user account.

• ServiceNow permissions and ACLs continue to apply to every request.

• An administrator should expose only the tools needed for the approved use cases.

• Write actions require user review and confirmation. People remain responsible for checking the target record and proposed change.

• Keep the OAuth client secret confidential and rotate it according to your organization’s policy. Rotating the credential may require people to authorize again.

• Review ServiceNow audit logs and Atlassian administration records according to your organization’s audit policy.

Disconnect or revoke access

To stop the connection:

1. Remove or disable the ServiceNow connector in Atlassian Administration.

2. In ServiceNow, revoke the relevant user authorizations if required.

3. Disable or delete the ServiceNow OAuth application if the organization no longer uses it.

Removing the connector clears the Atlassian-side connection and associated user authorizations. Revoking or deleting the OAuth application in ServiceNow prevents it from being used again.

Troubleshoot the connection

The OAuth callback or redirect fails

Confirm that the ServiceNow OAuth application uses this exact redirect URL:

https://id.atlassian.com/outboundAuth/finish

Also confirm that OAuth is active and that the client ID and secret match the application you created.

A person is asked to sign in

This is expected the first time each person uses the connector. It can also occur after an administrator rotates OAuth credentials or revokes authorization.

Rovo returns no records or a permission error

Ask the person to open the same record directly in ServiceNow. If they cannot access it there, update the ServiceNow role or ACL rather than broadening the connector credentials.

A write action fails

Confirm that the person can make the same change directly in ServiceNow. Business rules, required fields, table ACLs, and record state can prevent a validly authenticated write.

Rovo chooses another app

Name ServiceNow explicitly in the prompt and include a record number, table, or other identifying context.

Need more help?

Contact Atlassian Support through your standard support channel. Include the connector name, Atlassian site, ServiceNow instance, approximate time, action attempted, and the visible error message. State whether the problem affects a read or a write.

Never include an OAuth client secret, access token, or sensitive record content in a support request.

Related information

• ServiceNow connector overview

• Connect Rovo to external products