ServiceNow
Architecture

// In your Scripted REST Resource handler
(function process(request, response) {

  var record = new GlideRecord('incident');
  if (!record.get(request.pathParams.sys_id)) {
    response.setStatus(404); return;
  }

  var payload = {
    sys_id:      record.sys_id.toString(),
    number:      record.number.toString(),
    short_desc:  record.short_description.toString(),
    state:       record.state.toString(),
    // Sensitive — conditionally included
    caller_id:   record.caller_id.toString(),
    work_notes:  record.work_notes.toString(),
    cost_centre: record.u_cost_centre.toString()
  };

  // Resolve caller identity from OAuth token or header
  var callerSysId = request.getHeader('X-Caller-SysId');

  if (!callerHasRole(callerSysId, 'u_api_sensitive')) {
    delete payload.caller_id;
    delete payload.work_notes;
    delete payload.cost_centre;
  }

  response.setContentType('application/json');
  response.setBody(JSON.stringify(payload));

})(request, response);

function callSecureEndpoint(endpoint, payload) {
  var r = new sn_ws.RESTMessageV2();
  r.setEndpoint(endpoint);
  r.setHttpMethod('POST');
  r.setRequestBody(JSON.stringify(payload));
  r.setHttpHeader('Content-Type', 'application/json');

  // Layer 1: Bearer token
  var token = getBearerToken();
  r.setHttpHeader('Authorization', 'Bearer ' + token);

  // Layer 2: HMAC signed header
  // Set body BEFORE computing signature — it covers the payload
  var secret    = gs.getProperty('u_api_hmac_secret');
  var timestamp = new GlideDateTime().getNumericValue().toString();
  var digest    = new GlideDigest();
  var sig       = digest.getSHA256HMACBase64(
    secret, JSON.stringify(payload) + timestamp
  );
  r.setHttpHeader('X-Timestamp', timestamp);
  r.setHttpHeader('X-Signature', sig);

  // Layer 3: mTLS via Connection and Credential Alias
  r.setMutualAuth('u_mtls_client_alias');

  var resp = r.execute();
  if (resp.getStatusCode() !== 200) {
    gs.logError('Secure call failed: ' + resp.getStatusCode());
    return null;
  }
  return JSON.parse(resp.getBody());
}

// Dot-walking works fine in sync Business Rules.
// In async context, each reference hop may resolve stale data.
// Extract into a Script Include — keep the BR readable.

// Goal: email of the manager of the incident assignment group
// Wrong in async: current.assignment_group.manager.email.toString()

function getGroupManagerEmail(groupSysId) {
  if (!groupSysId) return null;

  var group = new GlideRecord('sys_user_group');
  if (!group.get(groupSysId)) return null;

  var managerSysId = group.manager.toString();
  if (!managerSysId) return null;

  var manager = new GlideRecord('sys_user');
  if (!manager.get(managerSysId)) return null;

  return manager.email.toString() || null;
}

// In the Business Rule:
var email = getGroupManagerEmail(
  current.assignment_group.toString()
);

// API Registry table: u_api_registry
// Fields: u_active, u_path, u_handler, u_auth_type, u_acl_role
// Called from Script Include on scoped app activation

function registerAPIEndpoints() {
  var registry = new GlideRecord('u_api_registry');
  registry.addQuery('u_active', true);
  registry.query();

  while (registry.next()) {
    createResource(
      registry.u_path.toString(),
      registry.u_handler.toString(),
      registry.u_auth_type.toString(),
      registry.u_acl_role.toString()
    );
  }
}

function createResource(path, handler, authType, aclRole) {
  var exists = new GlideRecord('sys_ws_endpoint');
  exists.addQuery('relative_path', path);
  exists.query();
  if (exists.next()) return; // already registered

  var ep = new GlideRecord('sys_ws_endpoint');
  ep.newRecord();
  ep.setValue('relative_path', path);
  ep.setValue('script_include', handler);
  ep.setValue('requires_authentication', authType !== 'none');
  ep.setValue('required_role', aclRole);
  ep.insert();
}