# ServiceNow Workflow

<figure><img src="https://762006384-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MJXOXEifAmpyvNVL1to%2Fuploads%2FbwEhIhA1pt3nZdr7tELD%2FKeeper%20ServiceNow%20Integration%20Hub.png?alt=media&#x26;token=1b2f1bb3-28a3-41e4-b523-14ba0744e508" alt=""><figcaption></figcaption></figure>

## Overview

The ServiceNow Workflow app empowers administrators and security teams to seamlessly manage Keeper Vault operations directly within the ServiceNow platform. This integration leverages the capabilities of the Keeper Commander CLI, enabling automation and secure password management as part of ServiceNow’s IntegrationHub and Flow Designer workflows with a service catalog portal.

This integration is available from the ServiceNow catalog at the URL below:

<https://store.servicenow.com/store/app/4b6de27987ebfe14e95f40c5cebb35d9>

## Features

| Feature                                  | Details                                                                                                                                                                                             | Description                                                                                    |
| ---------------------------------------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ---------------------------------------------------------------------------------------------- |
| **Endpoint Privilege Manager Approvals** | <ul><li>Approve or Deny EPM Requests</li></ul>                                                                                                                                                      | Automated SIR incident flow for EPM Approval Request.                                          |
| **Request Access To Record or Folder**   | <ul><li>Request Access To Folder</li><li>Request Access to Record</li><li>Request One Time Share</li></ul>                                                                                          | Grant or revoke user access to record(s) or folder(s) given that record or folder path or UID. |
| **Store Records To Keeper Vault**        | <ul><li>Add Database Credentials</li><li>Add Login Record</li><li>Add Server Credentials</li><li>Add SSH Key</li><li>Add Software License</li><li>Add Secure Note</li><li>Add Memberships</li></ul> | Securely store your credentials in keeper vault.                                               |
| **Search**                               | <ul><li>Search Record</li><li>Search Folder</li></ul>                                                                                                                                               | Search for a given record or folder.                                                           |

## Example Use Cases

#### Request access to a record

1. Requestor raises a request ticket to access a record stored in a company Keeper vault.
2. App admin approves the request
3. Fulfillment groups manages the task and share a requested record via service-now dedicated app
4. Result: Record is successfully shared to ServiceNow user.

#### Endpoint Privilege Management

1. An request is raised form endpoint device.
2. ServiceNow security incident will be created for that request.
3. ServiceNow app admin approves / deny the request.
4. Security incident ticket will be marked closed with appropriate comments.

## Prerequisites

* Mid server configuration in ServiceNow.
* Commander CLI installed in mid server.
* ServiceNow [Keeper Security ITSM app](/en/keeperpam/secrets-manager/integrations/servicenow-itsm.md) (Optional - For EPM Approval)

## Roles Required In ServiceNow

#### App admin user roles and accessibilities

| Application Menu                                                                  | Required Roles                                                                                                                                              |
| --------------------------------------------------------------------------------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------- |
| <ol><li>Guided Setup</li></ol>                                                    | <ol><li><code>x\_keese\_ks\_inthub.ks\_admin</code></li></ol>                                                                                               |
| <ol start="2"><li>Keeper Sevice Portal</li></ol>                                  | <ol><li><code>x\_keese\_ks\_inthub.ks\_admin</code></li><li><code>catalog-admin</code></li><li><code>mid\_server</code></li></ol>                           |
| <ol start="3"><li>Service Catalog Requests</li><li>Service Catalog Task</li></ol> | <ol><li><code>x\_keese\_ks\_inthub.ks\_admin</code></li><li><code>catalog-admin</code></li><li><code>itil</code></li><li><code>mid\_server</code></li></ol> |
| <ol start="5"><li>My Approvals</li></ol>                                          | <ol><li><code>x\_keese\_ks\_inthub.ks\_admin</code></li></ol>                                                                                               |

#### Approver user roles

| Application Menu               | Required Roles                                               |
| ------------------------------ | ------------------------------------------------------------ |
| <ol><li>My Approvals</li></ol> | <ol><li><code>x\_keese\_ks\_inthub.approver</code></li></ol> |

#### Requestor user roles

| Application Menu                        | Required Roles                                                                                                         |
| --------------------------------------- | ---------------------------------------------------------------------------------------------------------------------- |
| <ol><li>Keeper Service Portal</li></ol> | <ol><li><code>x\_keese\_ks\_inthub.ks\_app</code></li><li><code>itil</code></li><li><code>mid\_server</code></li></ol> |

## Support user roles

| Application Menu                                                                  | Required Roles                                                                                         |
| --------------------------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------ |
| <ol><li>Application Log</li><li>Support Page</li><li>App Privacy Policy</li></ol> | <ol><li><code>workflow\_admin</code></li><li><code>x\_keese\_ks\_inthub.support\_user</code></li></ol> |

## Download And Install Application

Users who have the **System Administrator (`admin`)** role are authorised to install applications from the ServiceNow Store.

1. Go the [ServiceNow Store Listing](https://store.servicenow.com/store/app/4b6de27987ebfe14e95f40c5cebb35d9)
2. Click Get.
3. Once the app is added successfully to the ServiceNow instance navigate to **All > System Applications > All Available Applications > All**
4. Click install

<figure><img src="https://762006384-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MJXOXEifAmpyvNVL1to%2Fuploads%2F1hqAf1ZqCfhVcJlSwvod%2FScreenshot%202026-02-20%20at%203.52.08%E2%80%AFPM.png?alt=media&#x26;token=7d8274b9-a58e-4824-ac12-45d01719f336" alt=""><figcaption></figcaption></figure>

## Configuration Instructions

### MID Server Configurations

To configure Keeper Security Workflow app for ServiceNow, the admin needs a MID server configured and validated in ServiceNow.

Mid server is an agent in ServiceNow where Keeper commander CLI and service mode will be hosted.<br>

To configure MID Server follow below steps

1. Log in to the ServiceNow instance using your Administrator privileges.
2. Navigate to the **All tab** > Search for **keeper security Workflow**> **Guided Setup > MID Server**

<figure><img src="https://762006384-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MJXOXEifAmpyvNVL1to%2Fuploads%2FAYFHFDKkFCRHiIjQA6s3%2FScreenshot%202026-02-24%20at%204.46.08%E2%80%AFPM.png?alt=media&#x26;token=f60765db-cd19-43a4-acdc-7cd245cfebd0" alt=""><figcaption></figcaption></figure>

Please follow the ServiceNow guidelines [here](https://www.servicenow.com/docs/bundle/zurich-servicenow-platform/page/product/mid-server/concept/mid-server-installation.html) for any MID server installation troubleshooting.

### Keeper Security Workflow Configurations

Once, MID server is configured and validated, perform below steps to configure the application.

1. Log in to the ServiceNow instance using your Administrator privileges.
2. Navigate to the **All tab** > Search for **Keeper Security Workflow**> **Guided Setup**

<figure><img src="https://762006384-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MJXOXEifAmpyvNVL1to%2Fuploads%2FEyicRxhNxSoIWFGflYUx%2FScreenshot%202026-02-24%20at%204.48.16%E2%80%AFPM.png?alt=media&#x26;token=e3ed86c3-0f03-4309-861b-37672040c984" alt=""><figcaption></figcaption></figure>

3. Click on **Install Keeper Commander CLI**, click on **Configure**, and follow the steps to install Keeper Commander CLI on the MID Server.

<figure><img src="https://762006384-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MJXOXEifAmpyvNVL1to%2Fuploads%2FETv9UkRTl4178GJHqISt%2FScreenshot%202026-02-24%20at%204.49.49%E2%80%AFPM.png?alt=media&#x26;token=d66e1c8f-eec2-4735-967d-cb4607cbe362" alt=""><figcaption></figcaption></figure>

4. Move on to the next step Configure Keeper Service Mode On MID Server, click on configure and follow the steps to configure and start Service Mode on the MID server.

<figure><img src="https://762006384-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MJXOXEifAmpyvNVL1to%2Fuploads%2F88piVUFrB4irutxAoqs6%2FGS_8.png?alt=media&#x26;token=08cb153e-08b8-43c6-a30c-3cfdb2409c98" alt=""><figcaption></figcaption></figure>

Below is an sample configuration

```
My Vault> service-create
Enter Port No:9090
Enable Ngrok Tunneling? (y/n):n
Enable TLS Certificate (y/n):n
Enable Request Queue? (y/n):y
Enable Advanced Security? (y/n):n
Select Run Mode (foreground/background):foreground
List of supported commands, Enter comma separated: get, search, record-add, record-update, share-folder, share-record, one-time-share, epm
Select configuration format (json/yaml):json
Generated API key: xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx
```

```
Uploading service_config.yaml ...
Commander Service starting on https://localhost:9090/api/v2/
Commander Service started with PID: 35215
```

### Approval Group

Once service mode is up and running in the MID server, head over to the guided setup to configure approval groups.

Approval group members will get the requests for approval for each request raised by requestor.

<figure><img src="https://762006384-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MJXOXEifAmpyvNVL1to%2Fuploads%2F0acJ55Wp5Y2RxKCR4TKg%2FScreenshot%202026-02-24%20at%204.53.06%E2%80%AFPM.png?alt=media&#x26;token=f5d3134b-efae-4b28-8d0b-49e233c884d0" alt=""><figcaption></figcaption></figure>

5. Now, go to the final step of the guided setup **Configure Keeper ServiceMode Credentials,** click on **Configure.**

<figure><img src="https://762006384-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MJXOXEifAmpyvNVL1to%2Fuploads%2FVNgP5yUBpyNQrx3OvZwM%2FScreenshot%202026-02-24%20at%204.54.00%E2%80%AFPM.png?alt=media&#x26;token=18a89f5a-2f3b-4a97-83c4-7456a526902f" alt=""><figcaption></figcaption></figure>

<figure><img src="https://762006384-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MJXOXEifAmpyvNVL1to%2Fuploads%2F11B8U4GvM8Bsb2e3bj2b%2Fksint_5.png?alt=media&#x26;token=c6aa8b79-c9d9-45be-a84f-f70568c8e14f" alt=""><figcaption></figcaption></figure>

6. Click on **New,** and Configure the details of service mode running in mid server.

<figure><img src="https://762006384-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MJXOXEifAmpyvNVL1to%2Fuploads%2Fj5VgucjEcVXThdMflman%2Fksint_6.png?alt=media&#x26;token=0a56101b-e984-4b1e-8c06-8a2d6f3950bd" alt=""><figcaption></figcaption></figure>

## Requesting Services

A requestor can request a service by following below steps

1. Navigate to **All** > **Keeper Security Workflow** > **Keeper Service Portal**

<figure><img src="https://762006384-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MJXOXEifAmpyvNVL1to%2Fuploads%2FtY4yNaXxsHPctcTmoc1l%2FScreenshot%202026-02-24%20at%205.03.06%E2%80%AFPM.png?alt=media&#x26;token=a400a434-d2ac-4320-a038-5e214a62b86d" alt=""><figcaption></figcaption></figure>

2. In service portal page click on **Request something**

<figure><img src="https://762006384-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MJXOXEifAmpyvNVL1to%2Fuploads%2FlcDdkuQjAF1x2T0JWMiT%2FScreenshot%202026-02-24%20at%205.04.13%E2%80%AFPM.png?alt=media&#x26;token=8bf71f0a-c729-41cd-b6fa-94949453e660" alt=""><figcaption></figcaption></figure>

3. Click on the desired category and select an service to request for.

<figure><img src="https://762006384-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MJXOXEifAmpyvNVL1to%2Fuploads%2FpdhlD13JkZxrvoh8cGVJ%2FScreenshot%202026-02-24%20at%205.07.22%E2%80%AFPM.png?alt=media&#x26;token=2bad8fb7-085b-4134-8dfb-c760356940f9" alt=""><figcaption></figcaption></figure>

4. Fill the form related to the item, and click on Request.

<figure><img src="https://762006384-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MJXOXEifAmpyvNVL1to%2Fuploads%2FfaSDxNVCMi4imgKr1Lqb%2FScreenshot%202026-02-24%20at%205.08.53%E2%80%AFPM.png?alt=media&#x26;token=35459546-328c-499e-9892-5da8865e889c" alt=""><figcaption></figcaption></figure>

5. A request ticket will be assigned to the requestor with the details as seen below.

<figure><img src="https://762006384-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MJXOXEifAmpyvNVL1to%2Fuploads%2F5YVlfCnMq3Hp2C7MoTpA%2FScreenshot%202026-02-24%20at%205.10.24%E2%80%AFPM.png?alt=media&#x26;token=eaaee8a4-a54a-442a-aebc-9ed7bd0f1328" alt=""><figcaption></figcaption></figure>

### Approving Requests

On the app admin side, the app admin can view requests, approve or deny requests, and perform tasks as required.

1. To view and approve / deny requests app admin or approver can navigate to\
   **All** > **Keeper Security Workflow** > **My Approvals**

<figure><img src="https://762006384-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MJXOXEifAmpyvNVL1to%2Fuploads%2FfZutQGPsYIabUodZ3eve%2FScreenshot%202026-02-24%20at%205.27.53%E2%80%AFPM.png?alt=media&#x26;token=04e04bb6-8800-4d84-80bc-f36f084fc864" alt=""><figcaption></figcaption></figure>

<figure><img src="https://762006384-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MJXOXEifAmpyvNVL1to%2Fuploads%2FWYy0vEgWXMB1PKfEbtcc%2FEN_8.png?alt=media&#x26;token=bde1316a-c49c-4e79-9070-7301e7e5842b" alt=""><figcaption></figcaption></figure>

2. Approver can approve or deny the request by clicking respective buttons

<figure><img src="https://762006384-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MJXOXEifAmpyvNVL1to%2Fuploads%2FjSSFJliAe63g1KyWkWI7%2FScreenshot%202026-02-24%20at%205.14.03%E2%80%AFPM.png?alt=media&#x26;token=880ea3d5-de92-45b4-981a-bcbae3e40662" alt=""><figcaption></figcaption></figure>

### Task Fulfilment

If a task requires additional information or some fulfillment work from the app admin (such as fetching correct records to share or changing user requests permissions), it can achieved by the task section.

1. **Navigate to All > Keeper Security Workflow > Service Catalog Task**

<figure><img src="https://762006384-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MJXOXEifAmpyvNVL1to%2Fuploads%2FQXFB5j9M4VdftH3yZ6le%2FScreenshot%202026-02-24%20at%205.30.33%E2%80%AFPM.png?alt=media&#x26;token=2b485dbb-d3e4-47f7-840e-62018661c37a" alt=""><figcaption></figcaption></figure>

2. Under task section, app admin can search for a record to share, folder to share or can create a new record in keeper vault directly from ServiceNow.

<figure><img src="https://762006384-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MJXOXEifAmpyvNVL1to%2Fuploads%2FGXXBDaT22s1Z0mnyGyxd%2FScreenshot%202026-02-24%20at%205.17.58%E2%80%AFPM.png?alt=media&#x26;token=20a995a5-0ec4-4fa3-be81-113e03d962ca" alt=""><figcaption></figcaption></figure>

3. Under task, the app admin can search for a record

<figure><img src="https://762006384-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MJXOXEifAmpyvNVL1to%2Fuploads%2FHRCr9GfoHVC1T1JlxzWB%2FScreenshot%202026-02-24%20at%205.20.32%E2%80%AFPM.png?alt=media&#x26;token=a27c5de1-336e-4618-a0db-3671c8cd1383" alt=""><figcaption></figcaption></figure>

4. Once a task is completed, The desired record is shared to the requested user, with the message received from Commander service mode.

<figure><img src="https://762006384-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MJXOXEifAmpyvNVL1to%2Fuploads%2F1agJRXg8iK6BIE74ZiRl%2Fend%20user%2010.png?alt=media&#x26;token=7673c7a6-b031-4400-b6a6-faf1d5b9a6f2" alt=""><figcaption></figcaption></figure>

***

## Endpoint Privilege Manager

Endpoint privilege management approval cycle depends upon the [ServiceNow Keeper Security ITSM](/en/keeperpam/secrets-manager/integrations/servicenow-itsm.md) app.

The admin needs to turn on the alerts for Endpoint Privilege Manager in Keeper Admin Console to be able to use this feature.

<figure><img src="https://762006384-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MJXOXEifAmpyvNVL1to%2Fuploads%2FVtjvoy1MqFaMiDguIBq5%2FPEDM_1.png?alt=media&#x26;token=8b3c940f-a234-4c93-bd3e-2ed5bc3a4732" alt=""><figcaption></figcaption></figure>

\
1\. When a EPM request is raise, You will see the request under **Keeper Security Workflow > My Approvals**

<figure><img src="https://762006384-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MJXOXEifAmpyvNVL1to%2Fuploads%2FfZutQGPsYIabUodZ3eve%2FScreenshot%202026-02-24%20at%205.27.53%E2%80%AFPM.png?alt=media&#x26;token=04e04bb6-8800-4d84-80bc-f36f084fc864" alt=""><figcaption></figcaption></figure>

2. A request will be created with reference to the security incident ticket.

<figure><img src="https://762006384-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MJXOXEifAmpyvNVL1to%2Fuploads%2FshlKcfOSdzThpHmd1ERx%2FPEDM_2.png?alt=media&#x26;token=47bffd80-05f8-47fe-8627-d2b033bfcf54" alt=""><figcaption></figcaption></figure>

3. App admin can approve or deny the request, Once the approval process is done, The security incident ticket will be marked closed with proper comments.

<figure><img src="https://762006384-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MJXOXEifAmpyvNVL1to%2Fuploads%2FMJCbwlUcjZfKgeRVw48a%2FPEDM_4.png?alt=media&#x26;token=a6477be0-07f7-464e-9e8c-035c1839af07" alt=""><figcaption></figcaption></figure>

<figure><img src="https://762006384-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MJXOXEifAmpyvNVL1to%2Fuploads%2Fvdnbe1ej2VUWoephqxv1%2FPEDM_5.png?alt=media&#x26;token=2aed7d0e-c106-4adc-bfc6-49f830cd3f02" alt=""><figcaption></figcaption></figure>

***

## Troubleshooting

#### Service Mode Configuration Error

If below error occurs in case of configuring service mode with MID server, please follow below troubleshooting steps

<figure><img src="https://762006384-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MJXOXEifAmpyvNVL1to%2Fuploads%2Fmh9JmLRpQT6weErV7VIR%2FScreenshot%202026-02-20%20at%201.01.10%E2%80%AFPM.png?alt=media&#x26;token=5f205bcc-1449-4025-82c0-8c14f7026020" alt=""><figcaption></figcaption></figure>

1. Check the service mode host or API Key
2. Check if the correct MID server is configured while submitting the configuration form.

#### Approval Request Not Showing In My Approvals Section

1. Ensure that the correct Approval Group is configured when setting up Service Mode in ServiceNow.
2. Verify whether the application administrator is a member of the approval group configured in the form.

#### Records / Folder Search is showing Unexpected error occured

<figure><img src="https://762006384-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MJXOXEifAmpyvNVL1to%2Fuploads%2Fxd9vc6DXPKJfqdp1hVE7%2FScreenshot%202026-02-20%20at%201.11.14%E2%80%AFPM.png?alt=media&#x26;token=1115b1cd-b67d-4ece-b487-5ee7e00a8471" alt=""><figcaption></figcaption></figure>

1. Ensure that MID server status is UP. If the status is Down, restart MID Server
2. Ensure MID server is validated.
3. Ensure that Service Mode is running inside correct MID Server and listening to the ports configured.

#### EPM Requests Not Showing In My Approvals Section

1. Check if Endpoint Privilege Manager Alerts has been activated in Alerts section of the Keeper Admin Console.
2. Check if the Keeper Security ITSM app is installed and activated.
3. Check if the Keeper Security ITSM app is configured correctly.

### Application Logs

You can always visit Application Log section for more information about the application logs.

<figure><img src="https://762006384-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MJXOXEifAmpyvNVL1to%2Fuploads%2FAF8FqhmCJlTX7tgXwOzb%2FScreenshot%202026-02-24%20at%205.32.04%E2%80%AFPM.png?alt=media&#x26;token=72e4443b-ca51-499f-b8dd-b892406dd048" alt=""><figcaption></figcaption></figure>


---

# Agent Instructions: Querying This Documentation

If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter:

```
GET https://docs.keeper.io/en/keeperpam/secrets-manager/integrations/servicenow-workflow.md?ask=<question>
```

The question should be specific, self-contained, and written in natural language.
The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.