ServiceNow Integration

CloudZero offers an app integration with ServiceNow so you can create ServiceNow tickets from Optimize Recommendations and Anomalies, helping your team to track and resolve cloud cost issues in the tools they already use.

After you create a ticket linked to a Recommendation or an Anomaly, status changes made in ServiceNow sync back so you can view the current state from within CloudZero. Status changes sync on a 15-minute polling window.

Before you begin: prerequisites

CloudZero prerequisites

Only users with the necessary permissions can configure app integrations in CloudZero. For information about how to manage permissions, see Role-based Access Control.

ServiceNow prerequisites

Because CloudZero authenticates with the OAuth 2.0 client credentials grant, your ServiceNow instance must be explicitly configured to accept that grant for inbound requests. This is not enabled by default. Complete all three of the following requirements before you connect, or the connection will fail during the token exchange with an error such as client_credentials grant_type request however integration user is not configured for OAuth.

1. Run ServiceNow Washington DC or later

Support for the inbound client credentials grant type was introduced in the ServiceNow Washington DC release. On earlier releases, ServiceNow does not accept the client credentials grant for inbound OAuth, and the CloudZero connection cannot complete.

For details, see ServiceNow's announcement, Up Your OAuth 2.0 Game: Inbound Client Credentials with Washington.

2. Enable the inbound client credentials system property

Set the system property glide.oauth.inbound.client.credential.grant_type.enabled to true. This property defaults to false, which blocks the client credentials grant even on a supported release.

For step-by-step instructions, see the ServiceNow support article How to configure Client Credentials grant type for inbound OAuth.

3. Register an OAuth endpoint mapped to an application user

In your instance, navigate to All > System OAuth > Application Registry, click New, and select Create an OAuth API endpoint for external clients. When you complete the form:

• Set Name to something identifiable, for example CloudZero Integration.
• Set Client Type to Integration as a Service (or otherwise specify an OAuth Application User). The client credentials grant maps the issued token to a user, so an application user is required — without it, token requests are rejected. See ServiceNow's Configure client type for OAuth and SSO records.
• Grant that application user the itil role so it can create and update tickets on CloudZero's behalf.
• Leave the Redirect URL field at its default. It is not used by the client credentials grant; it applies only to browser-based authorization code flows.
• After you submit, open the record and copy the Client ID and the Client Secret (click the lock icon to reveal the secret). You will paste both into CloudZero.

For the full field reference, see ServiceNow's Create an endpoint for external clients.

Connect to ServiceNow

After you complete the prerequisites, set up the app integration in CloudZero:

1. In CloudZero, navigate to Settings > App Integrations and select Connect ServiceNow.

2. Enter the following values from the OAuth endpoint you registered in ServiceNow:

   • Instance URL — the base URL of your ServiceNow instance, for example https://your-company.service-now.com.
   • Client ID — the Client ID from the Application Registry record.
   • Client Secret — the Client Secret from the Application Registry record.

3. Submit the form. CloudZero exchanges the credentials for an access token against your instance's oauth_token.do endpoint and the integration moves to a Pending state. Complete the instance-linking step to reach Connected.

The App Integrations page then shows that CloudZero is connected to ServiceNow.

You can now create tickets from CloudZero Optimize Recommendations and Anomalies.

Rotate or revoke the ServiceNow credential

You stay in full control of this credential — CloudZero never needs your ServiceNow admin password, only the Client ID and Client Secret from the dedicated Application Registry entry.

• Rotate the secret: Replace the Client Secret on the existing Application Registry entry (the Client ID stays the same), or create a brand-new entry (new Client ID and Secret). Then re-enter the new value(s) in CloudZero via Settings > App Integrations > ServiceNow > Reconnect. CloudZero overwrites the stored secret in place — you do not need to recreate the integration.
• Revoke access: Uncheck Active on the entry, or delete it. CloudZero's access stops at the next token refresh.

Verify the integration

Verify ticket creation (CloudZero → ServiceNow):

1. In CloudZero, navigate to Optimize and find a Recommendation.
2. Create a ticket, select your ServiceNow integration, complete the required fields, and submit.
3. Open ServiceNow and confirm the incident was created with the correct details.

Verify status sync (ServiceNow → CloudZero):

1. In ServiceNow, open the incident you just created and change its State (for example, from "New" to "In Progress"), then click Update.
2. In CloudZero, refresh the Recommendation. The status change syncs via polling within 15 minutes.

Disconnect ServiceNow

To disconnect the ServiceNow app integration, navigate to Settings > App Integrations and select Disconnect ServiceNow.

After disconnecting ServiceNow from CloudZero, tickets created from Optimize or Anomalies remain in ServiceNow. However, you will no longer be able to create new tickets from Optimize or Anomalies, and any status changes on existing tickets will not be reflected in CloudZero.

Troubleshooting