ServiceNow n8n integrationAutomate ServiceNow with n8n.

Pushes a binary file carried by the workflow onto a record that already exists, so a document built two nodes earlier ends up sitting on the right ticket.

• Table Name or ID: chosen from the list, or set with an expression when the table varies per item.
• Table Record ID: the sys_id of the record the file attaches to, commonly {{ $json.field }} from the node before.
• Input Data Field Name: the name of the binary property that holds the data to upload.
• File Name for the Attachment: optional, sets the name the attachment is given.

Removes one attachment from the instance, addressed by its own identifier rather than by the record it hangs on.

• Attachment ID: the sys_id value of the attachment to delete, the single required field of the operation.

Reads a single attachment and, when you ask for it, brings the file itself back into the run as binary data.

• Attachment ID: the sys_id value identifying the attachment.
• Download Attachments: a required boolean that decides whether the file content comes along.
• Output Field: the field name where the downloaded data is placed.
• Filter: an encoded query string, written as <col_name><operator><value> and case-sensitive throughout.

Lists the attachments held on one table, with the option of downloading each file in the same pass.

• Table Name or ID: the table whose attachments you want, from the list or via an expression.
• Download Attachments: required boolean; combined with Output Field it decides where the binary data lands.
• Return All: on, n8n walks every page; off, it stops at Limit.
• Filter: an encoded query, and note that parameters here are case-sensitive.

Returns the business services declared in the instance, the reference list a workflow reads when it needs to know which service a request belongs to.

• Return All and Limit: either the complete list or a capped slice of it.
• Field Names or IDs: the columns to bring back, picked from the list or set as comma separated values in an expression.
• Return Values: Actual Values, Display Values, or Both.

Configuration items come back as workflow items, which makes this the entry point for anything built on the instance inventory.

• Return All: switched on for a full inventory pass, left off with Limit for a quick sample.
• Filter: an encoded query string that narrows the set before it reaches n8n.
• Exclude Reference Link: on, the Table API links attached to reference fields are left out of the payload.

Pulls the department list so a workflow can route, group or label work by organizational unit rather than by a hardcoded string.

• Limit: the maximum number of results when Return All stays off.
• Field Names or IDs: a short list of columns keeps the run light when you only need names.
• Return Values: pick Display Values when the output is headed for a human, Actual Values when it feeds another node.

Dictionary entries describe the columns of the instance, which is what you read before writing to a table you did not design yourself.

• Filter: an encoded query string, handy for narrowing to one area of the instance.
• Field Names or IDs: the columns of the dictionary entry itself that you want back.
• Return All: on, every page is fetched; off, Limit caps the output.

Opens a new incident from whatever the workflow just received, whether that came from a form, a mailbox or another system.

• Short Description: the short description of the incident, and the only required field.
• Caller ID: the unique identifier of the caller, typically resolved a step earlier and passed as {{ $json.field }}.
• Assignment Group Name or ID: the group the incident goes to; selecting one is what allows Assignee Name or ID to be set.
• Impact and Urgency: each offers Low, Medium or High.

Deletes the incident whose identifier you hand it, one item per execution.

• Incident ID: the unique identifier of the incident, required, and the only field the operation asks for.

Fetches one incident by identifier, which is the usual step between receiving a reference and deciding what to do with it.

• Incident ID: the unique identifier of the incident, required.
• Field Names or IDs: restricts the response to the columns you actually read.
• Return Values: Display Values reads naturally in a message, Actual Values suits a comparison.
• Exclude Reference Link: drops the Table API links on reference fields.

Queries several incidents in one node, which is how most reporting and escalation workflows begin.

• Return All: on for a complete export, off to stop at Limit.
• Filter: an encoded query string applied before the data leaves ServiceNow.
• Field Names or IDs: the shortlist of columns to return.
• Return Values: Actual Values, Display Values or Both.

Writes new values onto an incident that already exists, leaving the fields you did not touch alone.

• Incident ID: required, often {{ $json.field }} from a lookup step.
• Update Fields: a collection of 16 entries, from State Name or ID to Close Notes.
• Work Notes: work notes for the incident, the natural place for an automated comment, whether it records what the workflow did or what the requester answered.
• On Hold Reason Name or ID: applies when the state is On Hold.

Any table exposed by the instance can receive a new row here, which is the escape hatch when the object you work with is not one of the named resources.

• Table Name or ID: required, chosen from the list or set with an expression.
• Data to Send: Auto-Map Input Data to Columns when the input names already match the destination fields, Define Below for Each Column to set them yourself, or Nothing to send no column data.
• Inputs to Ignore: comma separated input properties to leave out when auto-mapping.

Drops a single row from the table you name, addressed by the record identifier.

• Table Name or ID: the table in which the record exists, from the list or via an expression.
• Table Record ID: the unique identifier of the record, required, often {{ $json.field }} carried from a previous search.

Retrieves one row when the identifier is already known, without pulling the rest of the table along with it.

• Table Name or ID: the table in which the record exists.
• Table Record ID: the unique identifier of the record, required.
• Field Names or IDs: keeps the response to the columns you read.
• Exclude Reference Link: leaves out the Table API links on reference fields.

Reads a slice of a table, or the whole of it, depending on how Return All is set.

• Table Name or ID: required, the table to read.
• Return All: on, n8n chains the API pages; off, Limit sets the maximum number of results.
• Filter: an encoded query string that does the narrowing server side.
• Return Values: Actual Values, Display Values or Both.

Edits a row in place on any table, with the same mapping choices as the create operation.

• Table Name or ID and Table Record ID: both required, the second being the unique identifier of the record.
• Data to Send: Auto-Map Input Data to Columns, Define Below for Each Column, or Nothing.
• Fields to Send: the fixed collection where each destination column gets its value.

Adds a user to the instance, with a collection of 24 optional fields covering identity, contact details and access.

• Short Description: the short description of the user, and the only required field of the operation.
• Username, First Name, Last Name, Email: the identity block most workflows fill.
• Role Names or IDs: the roles of the user, from the list or as identifiers in an expression.
• Password Needs Reset: requires a password reset when the user logs in.

Takes a user out of the instance, identified by nothing more than an identifier.

• User ID: the unique identifier of the user, required.

Looks up one person, and unusually it lets you choose which key you search on.

• Retrieve Identifier: required, set to ID or to Username.
• User ID or Username: the value matching the choice above.
• Field Names or IDs: the columns to return.
• Return Values: Display Values for readable output, Actual Values for machine use.

Walks the whole user directory, one workflow item per person.

• Return All: on for the full directory, off to stop at Limit.
• Filter: an encoded query string, the right place to narrow a large directory.
• Field Names or IDs: a short column list keeps the payload sensible at scale.
• Exclude Reference Link: removes the Table API links on reference fields.

Changes what the instance knows about someone already recorded in it, one field or twenty at a time.

• User ID: the unique identifier of the user, required.
• Update Fields: the same collection of 24 entries offered at creation, so nothing has to be relearned between the two operations.
• Department, Manager, Location: the three that move most often when someone changes team.
• Active: whether the user is activated.

Before a workflow can route anything by team, it needs the group list, and that is exactly what comes back here.

• Return All and Limit: the whole set, or a capped slice of it.
• Filter: an encoded query string to keep only the groups you care about.
• Field Names or IDs: the columns to return, as a list or an expression.
• Return Values: Actual Values, Display Values or Both.

Pulling the role list into a workflow starts here: n8n returns the user roles from your ServiceNow instance, one role per item.

• Return All: on, n8n pages through the API until every role is back; off, Limit caps how many arrive.
• Filter: an encoded query string, meaning a condition written in ServiceNow syntax, that narrows what comes back.
• Field Names or IDs: choose the fields to keep, from the list or with an expression, so each item stays small.