ITSM Quick Reference
Overview
A quick reference card for common ITSM operations in ServiceNow. Keep this handy for fast lookups of state values, priority matrices, and common query patterns.
- What problem does it solve? Quick lookup for common ITSM values and operations
- Who should use this skill? Anyone working with incidents, changes, or problems
- What are the expected outcomes? Faster development with fewer documentation lookups
Prerequisites
- Appropriate roles and table access for the operation being performed
- A confirmed target instance before making changes
Procedure
Incident Operations
Quick Actions
| Action |
MCP Tool |
Key Parameters |
| List incidents |
SN-List-Incidents |
query, limit |
| Create incident |
SN-Create-Incident |
short_description, caller_id, category |
| Update incident |
SN-Update-Record |
table_name: incident, sys_id, data |
| Get incident |
SN-Get-Incident |
sys_id |
| Close incident |
SN-Close-Incident |
sys_id, resolution_code, resolution_notes |
| Assign incident |
SN-Assign-Incident |
sys_id, assigned_to, assignment_group |
| Add work notes |
SN-Add-Work-Notes |
sys_id, work_notes |
| Search incidents |
SN-Natural-Language-Search |
table: incident, natural language query |
Create Incident
Tool: SN-Create-Incident
Parameters:
short_description: Unable to access email
description: User reports Outlook not connecting to server
caller_id: <user_sys_id>
category: software
subcategory: email
impact: 3
urgency: 3
Close Incident
Tool: SN-Close-Incident
Parameters:
sys_id: <incident_sys_id>
resolution_code: Solved (Permanently)
resolution_notes: Restarted email service and cleared user cache
close_notes: User confirmed email is working
Assign Incident
Tool: SN-Assign-Incident
Parameters:
sys_id: <incident_sys_id>
assigned_to: <user_sys_id>
assignment_group: <group_sys_id>
State Values
Incident States
| Value |
Label |
Description |
| 1 |
New |
Newly created, not yet triaged |
| 2 |
In Progress |
Work has started |
| 3 |
On Hold |
Waiting for external input |
| 6 |
Resolved |
Solution implemented, pending verification |
| 7 |
Closed |
Verified and closed |
| 8 |
Canceled |
Canceled (not applicable) |
Change Request States
| Value |
Label |
Description |
| -5 |
New |
Draft state |
| -4 |
Assess |
Assessment phase |
| -3 |
Authorize |
Awaiting authorization |
| -2 |
Scheduled |
Approved and scheduled |
| -1 |
Implement |
Implementation in progress |
| 0 |
Review |
Post-implementation review |
| 3 |
Closed |
Successfully completed |
| 4 |
Canceled |
Change canceled |
Problem States
| Value |
Label |
Description |
| 1 |
New |
Newly identified |
| 2 |
Assess |
Under assessment |
| 3 |
Root Cause Analysis |
Investigating root cause |
| 4 |
Fix in Progress |
Working on permanent fix |
| 5 |
Resolved |
Root cause addressed |
| 6 |
Closed |
Verified and closed |
| 7 |
Canceled |
Problem canceled |
Change Types
| Value |
Label |
Description |
| standard |
Standard |
Pre-approved, low risk |
| normal |
Normal |
Requires CAB approval |
| emergency |
Emergency |
Expedited approval process |
Priority Matrix
Impact x Urgency = Priority
|
Urgency 1 (High) |
Urgency 2 (Medium) |
Urgency 3 (Low) |
| Impact 1 (High) |
Priority 1 (Critical) |
Priority 2 (High) |
Priority 3 (Moderate) |
| Impact 2 (Medium) |
Priority 2 (High) |
Priority 3 (Moderate) |
Priority 4 (Low) |
| Impact 3 (Low) |
Priority 3 (Moderate) |
Priority 4 (Low) |
Priority 5 (Planning) |
Priority Values
| Value |
Label |
SLA Target |
Description |
| 1 |
Critical |
1 hour |
Business critical, widespread impact |
| 2 |
High |
4 hours |
Significant business impact |
| 3 |
Moderate |
24 hours |
Limited business impact |
| 4 |
Low |
72 hours |
Minor inconvenience |
| 5 |
Planning |
No SLA |
Future enhancement |
Common Encoded Queries
Incident Queries
| Description |
Encoded Query |
| Active incidents |
active=true |
| P1 incidents |
priority=1 |
| P1 or P2 incidents |
priority=1^ORpriority=2 |
| Unassigned incidents |
assigned_toISEMPTY |
| Assigned incidents |
assigned_toISNOTEMPTY |
| Created today |
sys_created_onONToday@javascript:gs.beginningOfToday()@javascript:gs.endOfToday() |
| Created last 7 days |
sys_created_on>=javascript:gs.daysAgoStart(7) |
| New state |
state=1 |
| In Progress |
state=2 |
| Resolved or Closed |
state=6^ORstate=7 |
| Not Closed |
state!=7 |
| My incidents |
assigned_to=javascript:gs.getUserID() |
| My team's incidents |
assignment_group=<group_sys_id> |
| Contains text |
short_descriptionLIKEnetwork |
| Starts with |
numberSTARTSWITHINC00100 |
| Category is network |
category=network |
| Ordered by priority |
ORDERBYpriority |
| Ordered by created (newest) |
ORDERBYDESCsys_created_on |
Change Request Queries
| Description |
Encoded Query |
| Emergency changes |
type=emergency |
| Normal changes |
type=normal |
| Standard changes |
type=standard |
| Scheduled changes |
state=-2 |
| Changes this week |
start_dateONThis week@javascript:gs.beginningOfThisWeek()@javascript:gs.endOfThisWeek() |
| High risk changes |
risk=1 |
| Pending approval |
state=-3^approval!=approved |
Problem Queries
| Description |
Encoded Query |
| Open problems |
state<6 |
| Root cause analysis |
state=3 |
| Known errors |
known_error=true |
| Problems with workaround |
workaroundISNOTEMPTY |
| Related to incidents |
related_incidentsISNOTEMPTY |
Field Reference
Common Incident Fields
| Field |
Type |
Description |
number |
String |
Auto-generated (INC0010001) |
short_description |
String |
Brief summary (required) |
description |
String |
Detailed description |
caller_id |
Reference |
Reporting user |
opened_by |
Reference |
User who created record |
assigned_to |
Reference |
Assigned technician |
assignment_group |
Reference |
Assigned team |
state |
Choice |
Current state |
impact |
Choice |
Business impact (1-3) |
urgency |
Choice |
Time sensitivity (1-3) |
priority |
Choice |
Calculated priority (1-5) |
category |
Choice |
Incident category |
subcategory |
Choice |
Incident subcategory |
work_notes |
Journal |
Internal notes |
comments |
Journal |
Customer-visible notes |
resolution_code |
Choice |
How resolved |
resolution_notes |
String |
Resolution details |
close_code |
Choice |
Closure reason |
close_notes |
String |
Closure notes |
cmdb_ci |
Reference |
Configuration item |
Common Change Fields
| Field |
Type |
Description |
number |
String |
Auto-generated (CHG0010001) |
short_description |
String |
Brief summary |
description |
String |
Detailed description |
type |
Choice |
standard/normal/emergency |
state |
Choice |
Current state |
risk |
Choice |
Risk level (1-4) |
impact |
Choice |
Business impact (1-3) |
start_date |
DateTime |
Planned start |
end_date |
DateTime |
Planned end |
requested_by |
Reference |
Requester |
assigned_to |
Reference |
Change owner |
assignment_group |
Reference |
Owning team |
cab_required |
Boolean |
Needs CAB approval |
justification |
String |
Business justification |
implementation_plan |
String |
Implementation steps |
backout_plan |
String |
Rollback procedure |
test_plan |
String |
Testing steps |
Common Problem Fields
| Field |
Type |
Description |
number |
String |
Auto-generated (PRB0010001) |
short_description |
String |
Brief summary |
description |
String |
Detailed description |
state |
Choice |
Current state |
priority |
Choice |
Priority (1-5) |
assigned_to |
Reference |
Problem manager |
assignment_group |
Reference |
Owning team |
known_error |
Boolean |
Is known error |
workaround |
String |
Temporary workaround |
cause_notes |
String |
Root cause |
fix_notes |
String |
Permanent fix |
related_incidents |
List |
Related incidents |
cmdb_ci |
Reference |
Configuration item |
Resolution Codes
Incident Resolution Codes
| Value |
Label |
| Solved (Work Around) |
Temporary fix applied |
| Solved (Permanently) |
Root cause addressed |
| Solved Remotely (Work Around) |
Remote temporary fix |
| Solved Remotely (Permanently) |
Remote permanent fix |
| Not Solved (Not Reproducible) |
Cannot reproduce |
| Not Solved (Too Costly) |
Fix not cost-effective |
| Closed/Resolved by Caller |
User resolved |
Close Codes
| Value |
Label |
| Solved |
Resolved successfully |
| Closed/Resolved by Caller |
User resolved |
| Not Solved (Not Reproducible) |
Cannot reproduce |
| Closed (Cancelled) |
Request withdrawn |
Category Reference
Incident Categories
| Category |
Subcategories |
hardware |
cpu, disk, keyboard, memory, monitor, mouse |
software |
email, operating system, application |
network |
connectivity, dhcp, dns, firewall, vpn |
database |
db2, ms sql server, oracle |
inquiry |
request, password reset |
MCP Tools Quick Reference
Incident Tools
| Tool |
Purpose |
Required Parameters |
SN-List-Incidents |
Query incidents |
- |
SN-Get-Incident |
Get single incident |
sys_id |
SN-Create-Incident |
Create incident |
short_description |
SN-Update-Record |
Update incident |
table_name, sys_id, data |
SN-Close-Incident |
Close incident |
sys_id, resolution_code |
SN-Assign-Incident |
Assign incident |
sys_id |
SN-Add-Work-Notes |
Add work notes |
sys_id, work_notes |
SN-Natural-Language-Search |
NL search |
table, query |
Generic Tools
| Tool |
Purpose |
Required Parameters |
SN-Query-Table |
Query any table |
table_name |
SN-Get-Record |
Get any record |
table_name, sys_id |
SN-Create-Record |
Create any record |
table_name, data |
SN-Update-Record |
Update any record |
table_name, sys_id, data |
Common Workflows
Triage New Incident
1. Query: SN-Query-Table(table_name: incident, query: state=1^active=true)
2. Review: Check short_description, category, caller_id
3. Categorize: SN-Update-Record(table_name: incident, sys_id: X, data: {category: network, subcategory: connectivity}, instance: dev)
4. Prioritize: SN-Update-Record(table_name: incident, sys_id: X, data: {impact: 2, urgency: 2}, instance: dev)
5. Assign: SN-Assign-Incident(sys_id: X, assignment_group: <network_team>)
Escalate Incident
1. Update state: SN-Update-Record(table_name: incident, sys_id: X, data: {state: 2}, instance: dev)
2. Add notes: SN-Add-Work-Notes(sys_id: X, work_notes: Escalating to L2 per procedure)
3. Reassign: SN-Assign-Incident(sys_id: X, assignment_group: <l2_team>)
Resolve Incident
1. Resolve: SN-Resolve-Incident(sys_id: X, resolution_code: Solved (Permanently), resolution_notes: Restarted service, instance: dev)
2. Notify: SN-Add-Work-Notes(sys_id: X, work_notes: Resolution confirmed by user)
Close Incident
1. Close: SN-Close-Incident(sys_id: X, resolution_code: Solved (Permanently), resolution_notes: Service restored, close_notes: Verified with user)
REST API Endpoints
Table API
| Table |
Endpoint |
| Incident |
/api/now/table/incident |
| Change Request |
/api/now/table/change_request |
| Problem |
/api/now/table/problem |
| Task |
/api/now/table/task |
| User |
/api/now/table/sys_user |
| Group |
/api/now/table/sys_user_group |
| CI |
/api/now/table/cmdb_ci |
Common Parameters
| Parameter |
Description |
Example |
sysparm_query |
Encoded query |
active=true^priority=1 |
sysparm_fields |
Fields to return |
number,short_description,state |
sysparm_limit |
Max records |
100 |
sysparm_offset |
Skip records |
50 |
sysparm_display_value |
Display values |
all, true, false |
Best Practices
- Query and verify records before updating them.
- Prefer the narrowest table, field list, and encoded query that satisfies the task.
- Confirm state and resolution values against the target instance before closing records.
Related Skills
itsm/incident-lifecycle - Full incident lifecycle managementitsm/incident-triage - Detailed triage proceduresitsm/natural-language-queries - Natural language searchadmin/generic-crud-operations - Detailed CRUD operations
References
1---2name: quick-reference3description: ITSM quick reference card with common operations, state values, priority matrix, and encoded query examples4---56# ITSM Quick Reference78## Overview910A quick reference card for common ITSM operations in ServiceNow. Keep this handy for fast lookups of state values, priority matrices, and common query patterns.1112- **What problem does it solve?** Quick lookup for common ITSM values and operations13- **Who should use this skill?** Anyone working with incidents, changes, or problems14- **What are the expected outcomes?** Faster development with fewer documentation lookups1516## Prerequisites1718- Appropriate roles and table access for the operation being performed19- A confirmed target instance before making changes2021## Procedure2223### Incident Operations2425### Quick Actions2627| Action | MCP Tool | Key Parameters |28|--------|----------|----------------|29| List incidents | `SN-List-Incidents` | `query`, `limit` |30| Create incident | `SN-Create-Incident` | `short_description`, `caller_id`, `category` |31| Update incident | `SN-Update-Record` | `table_name: incident`, `sys_id`, `data` |32| Get incident | `SN-Get-Incident` | `sys_id` |33| Close incident | `SN-Close-Incident` | `sys_id`, `resolution_code`, `resolution_notes` |34| Assign incident | `SN-Assign-Incident` | `sys_id`, `assigned_to`, `assignment_group` |35| Add work notes | `SN-Add-Work-Notes` | `sys_id`, `work_notes` |36| Search incidents | `SN-Natural-Language-Search` | `table: incident`, natural language query |3738### Create Incident3940```41Tool: SN-Create-Incident42Parameters:43 short_description: Unable to access email44 description: User reports Outlook not connecting to server45 caller_id: <user_sys_id>46 category: software47 subcategory: email48 impact: 349 urgency: 350```5152### Close Incident5354```55Tool: SN-Close-Incident56Parameters:57 sys_id: <incident_sys_id>58 resolution_code: Solved (Permanently)59 resolution_notes: Restarted email service and cleared user cache60 close_notes: User confirmed email is working61```6263### Assign Incident6465```66Tool: SN-Assign-Incident67Parameters:68 sys_id: <incident_sys_id>69 assigned_to: <user_sys_id>70 assignment_group: <group_sys_id>71```7273## State Values7475### Incident States7677| Value | Label | Description |78|-------|-------|-------------|79| 1 | New | Newly created, not yet triaged |80| 2 | In Progress | Work has started |81| 3 | On Hold | Waiting for external input |82| 6 | Resolved | Solution implemented, pending verification |83| 7 | Closed | Verified and closed |84| 8 | Canceled | Canceled (not applicable) |8586### Change Request States8788| Value | Label | Description |89|-------|-------|-------------|90| -5 | New | Draft state |91| -4 | Assess | Assessment phase |92| -3 | Authorize | Awaiting authorization |93| -2 | Scheduled | Approved and scheduled |94| -1 | Implement | Implementation in progress |95| 0 | Review | Post-implementation review |96| 3 | Closed | Successfully completed |97| 4 | Canceled | Change canceled |9899### Problem States100101| Value | Label | Description |102|-------|-------|-------------|103| 1 | New | Newly identified |104| 2 | Assess | Under assessment |105| 3 | Root Cause Analysis | Investigating root cause |106| 4 | Fix in Progress | Working on permanent fix |107| 5 | Resolved | Root cause addressed |108| 6 | Closed | Verified and closed |109| 7 | Canceled | Problem canceled |110111### Change Types112113| Value | Label | Description |114|-------|-------|-------------|115| standard | Standard | Pre-approved, low risk |116| normal | Normal | Requires CAB approval |117| emergency | Emergency | Expedited approval process |118119## Priority Matrix120121### Impact x Urgency = Priority122123| | Urgency 1 (High) | Urgency 2 (Medium) | Urgency 3 (Low) |124|-----------|------------------|---------------------|------------------|125| **Impact 1 (High)** | Priority 1 (Critical) | Priority 2 (High) | Priority 3 (Moderate) |126| **Impact 2 (Medium)** | Priority 2 (High) | Priority 3 (Moderate) | Priority 4 (Low) |127| **Impact 3 (Low)** | Priority 3 (Moderate) | Priority 4 (Low) | Priority 5 (Planning) |128129### Priority Values130131| Value | Label | SLA Target | Description |132|-------|-------|------------|-------------|133| 1 | Critical | 1 hour | Business critical, widespread impact |134| 2 | High | 4 hours | Significant business impact |135| 3 | Moderate | 24 hours | Limited business impact |136| 4 | Low | 72 hours | Minor inconvenience |137| 5 | Planning | No SLA | Future enhancement |138139## Common Encoded Queries140141### Incident Queries142143| Description | Encoded Query |144|-------------|---------------|145| Active incidents | `active=true` |146| P1 incidents | `priority=1` |147| P1 or P2 incidents | `priority=1^ORpriority=2` |148| Unassigned incidents | `assigned_toISEMPTY` |149| Assigned incidents | `assigned_toISNOTEMPTY` |150| Created today | `sys_created_onONToday@javascript:gs.beginningOfToday()@javascript:gs.endOfToday()` |151| Created last 7 days | `sys_created_on>=javascript:gs.daysAgoStart(7)` |152| New state | `state=1` |153| In Progress | `state=2` |154| Resolved or Closed | `state=6^ORstate=7` |155| Not Closed | `state!=7` |156| My incidents | `assigned_to=javascript:gs.getUserID()` |157| My team's incidents | `assignment_group=<group_sys_id>` |158| Contains text | `short_descriptionLIKEnetwork` |159| Starts with | `numberSTARTSWITHINC00100` |160| Category is network | `category=network` |161| Ordered by priority | `ORDERBYpriority` |162| Ordered by created (newest) | `ORDERBYDESCsys_created_on` |163164### Change Request Queries165166| Description | Encoded Query |167|-------------|---------------|168| Emergency changes | `type=emergency` |169| Normal changes | `type=normal` |170| Standard changes | `type=standard` |171| Scheduled changes | `state=-2` |172| Changes this week | `start_dateONThis week@javascript:gs.beginningOfThisWeek()@javascript:gs.endOfThisWeek()` |173| High risk changes | `risk=1` |174| Pending approval | `state=-3^approval!=approved` |175176### Problem Queries177178| Description | Encoded Query |179|-------------|---------------|180| Open problems | `state<6` |181| Root cause analysis | `state=3` |182| Known errors | `known_error=true` |183| Problems with workaround | `workaroundISNOTEMPTY` |184| Related to incidents | `related_incidentsISNOTEMPTY` |185186## Field Reference187188### Common Incident Fields189190| Field | Type | Description |191|-------|------|-------------|192| `number` | String | Auto-generated (INC0010001) |193| `short_description` | String | Brief summary (required) |194| `description` | String | Detailed description |195| `caller_id` | Reference | Reporting user |196| `opened_by` | Reference | User who created record |197| `assigned_to` | Reference | Assigned technician |198| `assignment_group` | Reference | Assigned team |199| `state` | Choice | Current state |200| `impact` | Choice | Business impact (1-3) |201| `urgency` | Choice | Time sensitivity (1-3) |202| `priority` | Choice | Calculated priority (1-5) |203| `category` | Choice | Incident category |204| `subcategory` | Choice | Incident subcategory |205| `work_notes` | Journal | Internal notes |206| `comments` | Journal | Customer-visible notes |207| `resolution_code` | Choice | How resolved |208| `resolution_notes` | String | Resolution details |209| `close_code` | Choice | Closure reason |210| `close_notes` | String | Closure notes |211| `cmdb_ci` | Reference | Configuration item |212213### Common Change Fields214215| Field | Type | Description |216|-------|------|-------------|217| `number` | String | Auto-generated (CHG0010001) |218| `short_description` | String | Brief summary |219| `description` | String | Detailed description |220| `type` | Choice | standard/normal/emergency |221| `state` | Choice | Current state |222| `risk` | Choice | Risk level (1-4) |223| `impact` | Choice | Business impact (1-3) |224| `start_date` | DateTime | Planned start |225| `end_date` | DateTime | Planned end |226| `requested_by` | Reference | Requester |227| `assigned_to` | Reference | Change owner |228| `assignment_group` | Reference | Owning team |229| `cab_required` | Boolean | Needs CAB approval |230| `justification` | String | Business justification |231| `implementation_plan` | String | Implementation steps |232| `backout_plan` | String | Rollback procedure |233| `test_plan` | String | Testing steps |234235### Common Problem Fields236237| Field | Type | Description |238|-------|------|-------------|239| `number` | String | Auto-generated (PRB0010001) |240| `short_description` | String | Brief summary |241| `description` | String | Detailed description |242| `state` | Choice | Current state |243| `priority` | Choice | Priority (1-5) |244| `assigned_to` | Reference | Problem manager |245| `assignment_group` | Reference | Owning team |246| `known_error` | Boolean | Is known error |247| `workaround` | String | Temporary workaround |248| `cause_notes` | String | Root cause |249| `fix_notes` | String | Permanent fix |250| `related_incidents` | List | Related incidents |251| `cmdb_ci` | Reference | Configuration item |252253## Resolution Codes254255### Incident Resolution Codes256257| Value | Label |258|-------|-------|259| Solved (Work Around) | Temporary fix applied |260| Solved (Permanently) | Root cause addressed |261| Solved Remotely (Work Around) | Remote temporary fix |262| Solved Remotely (Permanently) | Remote permanent fix |263| Not Solved (Not Reproducible) | Cannot reproduce |264| Not Solved (Too Costly) | Fix not cost-effective |265| Closed/Resolved by Caller | User resolved |266267### Close Codes268269| Value | Label |270|-------|-------|271| Solved | Resolved successfully |272| Closed/Resolved by Caller | User resolved |273| Not Solved (Not Reproducible) | Cannot reproduce |274| Closed (Cancelled) | Request withdrawn |275276## Category Reference277278### Incident Categories279280| Category | Subcategories |281|----------|---------------|282| `hardware` | cpu, disk, keyboard, memory, monitor, mouse |283| `software` | email, operating system, application |284| `network` | connectivity, dhcp, dns, firewall, vpn |285| `database` | db2, ms sql server, oracle |286| `inquiry` | request, password reset |287288## MCP Tools Quick Reference289290### Incident Tools291292| Tool | Purpose | Required Parameters |293|------|---------|---------------------|294| `SN-List-Incidents` | Query incidents | - |295| `SN-Get-Incident` | Get single incident | `sys_id` |296| `SN-Create-Incident` | Create incident | `short_description` |297| `SN-Update-Record` | Update incident | `table_name`, `sys_id`, `data` |298| `SN-Close-Incident` | Close incident | `sys_id`, `resolution_code` |299| `SN-Assign-Incident` | Assign incident | `sys_id` |300| `SN-Add-Work-Notes` | Add work notes | `sys_id`, `work_notes` |301| `SN-Natural-Language-Search` | NL search | `table`, `query` |302303### Generic Tools304305| Tool | Purpose | Required Parameters |306|------|---------|---------------------|307| `SN-Query-Table` | Query any table | `table_name` |308| `SN-Get-Record` | Get any record | `table_name`, `sys_id` |309| `SN-Create-Record` | Create any record | `table_name`, `data` |310| `SN-Update-Record` | Update any record | `table_name`, `sys_id`, `data` |311312## Common Workflows313314### Triage New Incident315316```3171. Query: SN-Query-Table(table_name: incident, query: state=1^active=true)3182. Review: Check short_description, category, caller_id3193. Categorize: SN-Update-Record(table_name: incident, sys_id: X, data: {category: network, subcategory: connectivity}, instance: dev)3204. Prioritize: SN-Update-Record(table_name: incident, sys_id: X, data: {impact: 2, urgency: 2}, instance: dev)3215. Assign: SN-Assign-Incident(sys_id: X, assignment_group: <network_team>)322```323324### Escalate Incident325326```3271. Update state: SN-Update-Record(table_name: incident, sys_id: X, data: {state: 2}, instance: dev)3282. Add notes: SN-Add-Work-Notes(sys_id: X, work_notes: Escalating to L2 per procedure)3293. Reassign: SN-Assign-Incident(sys_id: X, assignment_group: <l2_team>)330```331332### Resolve Incident333334```3351. Resolve: SN-Resolve-Incident(sys_id: X, resolution_code: Solved (Permanently), resolution_notes: Restarted service, instance: dev)3362. Notify: SN-Add-Work-Notes(sys_id: X, work_notes: Resolution confirmed by user)337```338339### Close Incident340341```3421. Close: SN-Close-Incident(sys_id: X, resolution_code: Solved (Permanently), resolution_notes: Service restored, close_notes: Verified with user)343```344345## REST API Endpoints346347### Table API348349| Table | Endpoint |350|-------|----------|351| Incident | `/api/now/table/incident` |352| Change Request | `/api/now/table/change_request` |353| Problem | `/api/now/table/problem` |354| Task | `/api/now/table/task` |355| User | `/api/now/table/sys_user` |356| Group | `/api/now/table/sys_user_group` |357| CI | `/api/now/table/cmdb_ci` |358359### Common Parameters360361| Parameter | Description | Example |362|-----------|-------------|---------|363| `sysparm_query` | Encoded query | `active=true^priority=1` |364| `sysparm_fields` | Fields to return | `number,short_description,state` |365| `sysparm_limit` | Max records | `100` |366| `sysparm_offset` | Skip records | `50` |367| `sysparm_display_value` | Display values | `all`, `true`, `false` |368369## Best Practices370371- Query and verify records before updating them.372- Prefer the narrowest table, field list, and encoded query that satisfies the task.373- Confirm state and resolution values against the target instance before closing records.374375## Related Skills376377- `itsm/incident-lifecycle` - Full incident lifecycle management378- `itsm/incident-triage` - Detailed triage procedures379- `itsm/natural-language-queries` - Natural language search380- `admin/generic-crud-operations` - Detailed CRUD operations381382## References383384- [ServiceNow ITSM Documentation](https://docs.servicenow.com/bundle/utah-it-service-management/page/product/incident-management/concept/c_IncidentManagement.html)385- [Incident State Flow](https://docs.servicenow.com/bundle/utah-it-service-management/page/product/incident-management/concept/c_IncidentStateFlow.html)386- [Change Management](https://docs.servicenow.com/bundle/utah-it-service-management/page/product/change-management/concept/c_ITILChangeManagement.html)
Happy-Technologies-LLC