foreign to part 17 in this series of creating scripted rest apis in servicenow in previous videos we looked at how we could secure our API with access controls and in the previous video we looked at how we could enable o or for authentication purposes but what if there were a way in which we could actually enforce oauth in other words the connections or authentications to our API were only permissible using oauth that we would reject all attempts to connect using basic authentication and what if there were a way in which we could specify specific IP addresses that were permitted to access our API and rejected connections from all other IP addresses well there is a way in servicenow using API access policies and this is part of the Adaptive authentication feature in servicenow so let's take a look the first thing we'll need to ensure is that we have all the necessary plugins activated the main one is adaptive authentication but you'll need the oauth plugin activated already and the authentication profiles plugin as well but you may find that these three plugins are already activated in your instance so once they're activated we'll need to come to API access policies we'll create a new record here we'll give it a name Vehicles oauth we'll select our API Vehicles now one of the great things about this record is that we are able to determine exactly what API or all apis this access policy will apply to so if I select Global here it's going to apply to all apis in my instance if I deselect it then we leave the vehicles as the API that we've just selected I can apply this to all methods or a specific method or resources or a specific resource and all versions or a specific version so if I deselect that one there let's say we are going to apply this only for version 3 because we don't want to disrupt anyone that's still using version one or version two so let's select that and save the record so this record the API access policy is the framework we actually haven't determined any configuration really to apply to this policy or that are part of this policy so let's do that now let's go to authentication profile open that up there are two ones that exist there out of the box already but we need to create a new one and select this standard option here we'll give this one a name as well vehicle authentication profile or give it a description auth profile for the vehicles API now we're going to select the type here oauth okay so this means we're actually going to enforce oauth 4 version 3 of our vehicles API now we need to reference The oauth Entity this is the application that we registered in the previous video so in the previous video if you haven't already looked at it take a look at it because in that video we create an application or register an application where we generate a client ID and a client Secret for that application so which enables that application to then request and get an access token for authentication purposes so here we need to specify that application here so in other words we're going to enforce oauth for a specific application for a specific version of our API now one little problem here is that this magnifying glass here doesn't work okay even though I've saved the record um but you will find if you start typing in this field that the references from that table will pop up so if we type in uh VH there uh we can see we've got access or reference now to that application that I created in the previous video so I'll go ahead and select that update it and then we'll come back to our access policy record and then just go ahead and select that one and save that okay okay so let's just review exactly what we have here we have a new API access policy for version three of our vehicles API okay four all methods or resources in it okay we've specified that connections to this API this version 3 is only permissible using oauth for that application that we registered in the previous video okay so that should mean now we can only connect using oauth and all attempts to connect using basic authentication with the username and password will fail so if we go ahead and have a look in Postman here this is the record that we've still had up from our previous video it is an oauth authentication get request to retrieve a single vehicle from our vehicles table so if I just don't change anything here and click on send we've got that record back that works we are able to authenticate the API access policy has permitted us to or given us authorization to connect to the API and perform that request now let's come back to our basic authentication folder here I'm going to open up the get vehicle request here you can see that the authentication type is basic auth we've got our username and password there so if I click on send and send that request we get an error okay we need to provide authorization information in other words we need to authenticate using an access token instead okay so that attempt will fail and that's exactly what we've just defined with that API access policy if I come back to version 2 of our API however and go to get vehicle okay note that the path here is version two we haven't defined an access policy for that we're still using basic authentication in this request so if I send that request that will work just as it did before so we're not disrupting any applications or clients that are still Clinging On to the old way of doing things and using basic Authentication now one of the great things about adaptive authentication as it applies to apis and API access policies is that you can go even further to restrict access to your API so if I come back to my vehicle authentication profile here and you can see there's a list here called authentication policies at the moment we don't have anything at the moment we're just enforcing oauth but if I were to open this up there are some out of the box policies there that you can take a look at but if you click on new here and just give this a name and save the record okay we will find what other options there are if we go to policy inputs and click on new we can see we can restrict this API based on IP address role and group so if we select IP filter criteria it's real easy to do specify a single IP address and IP range a subnet from which connections to our API are permissible so that's how you go ahead and further restrict access to your API using API access policies which is part of adaptive authentication this has just been a very quick and simple demonstration here so there are further resources in the description below including a course on now learning on adaptive authentication which goes through this entire feature and includes some exercises that you can perform there as well so in the next video and the final video in our little section here on security we're going to look at authentication Scopes which is part of the oauth 2.0 specification and we're going to tighten the screws one more time to restrict access to our API based on what access token you have so hang around for that one