foreign welcome back everyone to this video series on creating scripted rest apis in servicenow in the next two videos we're going to be discussing access controls now these two videos should be seen together and I strongly recommend that you watch both of them access controls can be defined on the API level as well as individual resources in that API they can also be defined for underlying tables and these are the access controls that you may already be familiar with whenever you create an API and resources in service now the system will automatically assign a pre-configured Access Control to them and we're going to take a look at this in just a moment but what I can tell you right now is that at the moment our API has a gaping big security hole in it and we're going to find out what that is okay if we have a look at our scripted rest API record here we can see in the security tab that there is a default ACL that is being applied here I didn't specify when I created the API but it's there the system will assign it automatically it's called scripted rest external default now if we go to one of the resources in our API such as get vehicle the version one and we come down we can also see that there is a similar setting here for ACL also called scripted rest external default if I go to our version 2 resource for the same operation come down again we see the same Access Control rule here so let's take a look at this Access Control so let's come back to our regular interface here and go to our Access Control list and we'll just filter that list and open up the scripted rest external default one now what we can see here that the type of Access Control at the very top is rest endpoint we're actually going to create a new one in just a moment that will have the same type it will also have the same operation in fact there is only one operation for that type and it's called execute so importantly we need to look at the definition the conditions for accessing this key accessing this access control and as you can see here there is one role Define called snc internal and the script down below explicitly states that you cannot have the snc external role so in my instance I've already gone ahead and activated and installed the explicit roles plugin and I recommend that you do that for your instances as well if you don't know what the explicit roles plugin is I've added a link in the description below to the documentation once you activate this plugin it will demarcate your internal users from your external users using two roles snc internal and snc external and whenever you create users in your system after that plugin has been activated internal users in the sys user table they will be automatically inside the snc internal role and whenever you go ahead and create external users such as contacts and consumers in your instance if you've got customer service management for example they will be assigned to snc external role it's a very good way to demarcate your different kinds of users in the system so if we go ahead and look at our vehicle integration user we can see here that one of the roles that it has is the snc internal role but not just that user has that role in fact every user in my instance right now has this snc internal role which means that every user in my platform has access to the API and that's not good so if we come back here we can see we've got three different roles already admin integration and user I'm going to go ahead quickly and just create a fourth role here and call this one resource because I want to test access both to the API as well as the underlying resources so I'll go ahead and submit that and then what I'll do I'm going to create two access controls both of them will be other type rest endpoint with operation execute the first one here will be access to the API in general for the vehicles API that is okay and the role will be the integration role okay the one that we've been using previously I'll save that and then I'll go ahead and create a second Access Control also rest endpoint also execute but this time it's going to be for access to individual resources in the API okay and I'll assign the role resource the one that we just created okay so now we've got two roles integration and resource associated with two access controls also called or called API and resource okay the next thing I'm going to do is come back to my rest API record here and remove the scripted rest external default access control and add the new one that we just created scripted rest Vehicles API so in other words to access this API you will need to pass that access control Rule and I will go ahead and save that I'll also come to the version 2 of our API for the get vehicle resource here and I'll do the same thing here except I'm going to replace a scripted rest external default with the scripted rest Vehicles resource okay all right and we'll save that one too okay now I'm going to come down and remove the roles associated with my integration user so if I come to the user record here and go to roles and click on edit we'll see we can only remove the snc internal role do you know why that is because the role for the integration has been associated with the group and the user has inherited that role from the group so what we need to do is actually go to the group record open up that and then click on edit there and we'll see the integration role there so I'm just going to remove that okay and save that all right so this should mean now that our vehicles integration user no longer has access to that API so let's go ahead and Postman and test that okay so I'll go to the get vehicle resource here and just to remind ourselves that authorization is using that integration user I'm not going to make any changes here I'm just going to send the request once more and this time we get a user not authorized message okay we've authenticated but we're not authorized to use that API and that's exactly what we expect so if we come back to the group now and come to edit and then assign that integration role once more and save that and we'll do another test okay I'll just send the same request again send we also get user not authorized because we assign a different Access Control to that particular resource in order to pass that access control you actually need to pass the resource access control that we set up earlier and at the moment our integration user doesn't have that resource role but if we were to come to another resource called get vehicles at the moment that still has the default scripted rest default Access Control and that is open to all internal users so if I were to send the request here it would actually pass we would actually be able to retrieve that record because we've passed the access control for the API and we've also passed the resource access control as well okay so let's come back to our group again and this time we're going to add the resource role and test that once more so again we'll come to get vehicles and send that request that should work just fine because actually we haven't made any changes to that API and we passed it before so we're going to pass it again but this time if we go to the get vehicle resource and click on send here previously we had a user not authorized message but this time it should work and it does let's look at the vehicle table and in particular the access controls for this table let's have a look at the read access controls in particular so at the moment we have two let's have a look at the conditions in each one to see who have granted read access to this table so in the first Access Control we see that you need the admin user let's have a look at the second one here we need the user role but what about the integration user what about the integration role that that user has we've been doing most of our testing in Postman using that user and those tests have just been working fine we've been able to make API calls we've been able to get records create records delete records but we don't have read access to this table and if you look at the access controls that I've got for the other operations that integration role is nowhere to be found but still we're able to perform operations on that table now we've just explicitly opened up or restricted access to the API for that integration raw and the integration user so that user is able to make API cores but that user does not have the permission here to access a table in any way shape or form except of course through our API and that is the big security Gap that we have right now in our API and that's what we need to urgently fix and stick around for the next video because we'll do exactly that foreign