| \n\nField\n\n | \n\nDescription\n\n |
|---|---|
| \n\nName\n\n | \n\nName for the HMAC configuration.\n\n |
| \n\nApplication\n\n | \n\nScope of the configuration.\n\n |
| \n\nDescription\n\n | \n\nDetailed description about the configuration.\n\n |
| \n\nHash Algorithm\n\n | \n\nChoose the Hash Algorithm. Options available:- HmacSHA256\n- HmacSHA384\n- HmacSHA512\n\n\n |
| \n\nHMAC util script\n\n | \n\nUtility script for HMAC.**Note:** If you validate HMAC authentication using Request body, Time stamp and Secret with no Key Id, then do the following:\n\n- Create a customized script include as HMAC util script\n- Use that script include util to interpret the passed in timestamp, and request body.\nFor every shared secret created in the ServiceNow® instance, there is a key ID. You need to configure the key ID into Default key id in HMAC auth profile.\n\n |
| \n\nField\n\n | \n\nDescription\n\n |
|---|---|
| \n\nName\n\n | \n\nName to identify the authentication policy.\n\n |
| \n\nApplication\n\n | \n\nScope of the authentication policy.\n\n |
| \n\nConfiguration for HMAC\n\n | \n\nSelect the HMAC configuration that was created.\n\n |
| \n\nAuth Parameter\n\n | \n\nSelect the auth parameter for the authentication request. You can select the default options or create a new auth parameter:- x-sn-hmac-signature-256: Auth Header\n- x-sn-hmac-signature-256: Query Parameter\n\n\n |
| \n\nDefault Key ID of Shared Secret\n\n | \n\nThe token information that can be updated in this field for using HMAC.\n\n |
| \n\nField\n\n | \n\nDescription\n\n |
|---|---|
| \n\nName\n\n | \n\nName to identify the REST API HMAC secret.\n\n |
| \n\nDescription\n\n | \n\nDescription for the REST API HMAC secret.\n\n |
| \n\nActive\n\n | \n\nStatus of the REST API HMAC secret.\n\n |
| \n\nUser\n\n | \n\nUser associated to the REST API HMAC secret. Use the look-up icon to select the user.\n\n |
| \n\nKey ID\n\n | \n\nKey ID that must be sent as part of the REST call. Key ID is generated after submitting the form.\n\n |
| \n\nShared Secret\n\n | \n\nShared secrets of the user. For example, the password.\n\n |
| \n\nSource\n\n | \n\nSource of the record.\n\n |
| \n\nExpiry\n\n | \n\nTime after which the credential is no longer valid. Empty value means no expiration.**Note:** For more information, about expiry of token, see [Cleaning up token Expiry](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/australia/platform-security/authentication/token-expiry-api-and-hmac.md) .\n\n |
| \n\nField\n\n | \n\nDescription\n\n |
|---|---|
| \n\nName\n\n | \n\nUnique name of the API access policy.\n\n |
| \n\nActive\n\n | \n\nOption to make the API access policy active.\n\n |
| \n\nREST API\n\n | \n\nThe REST API to which the access policy is applied. For example, **Attachment API**.\n\n |
| \n\nREST API PATH\n\n | \n\nAPI path of the REST API. This field is auto-populated based on the selected REST API. For example, **now/attachment**.\n\n |
| \n\nHTTP Method\n\n | \n\nMethod used for interacting with the API. This field is auto-populated based on the selected REST API.\n\n |
| \n\nVersion\n\n | \n\nVersion of the API. For example, **v1**. This field is auto-populated based on the selected REST API.**Note:** If you want to create an authentication policy for all versions of a REST API, you must create individual policies for each version.\n\n |
| \n\nResource\n\n | \n\nChild resource of the REST API. This field is auto-populated based on the selected REST API. For example, **/now/attachment**\n\n |
| \n\nApplication\n\n | \n\nScope of the application.\n\n |
| \n\nGlobal\n\n | \n\nEnable this field to apply auth policy to all methods, versions, and resources for the API.**Note:** Token Based Auth isn’t allowed in the Global REST API Policy.\n\n |
| \n\nApply to all methods\n\n | \n\nEnable this field to apply the auth policy for the API to all the methods, versions, and resources for the API.\n\n |
| \n\nApply to all resources\n\n | \n\nEnable this field to apply the auth policy for the API to all the versions.\n\n |
| \n\nApply to all versions\n\n | \n\nEnable this field to apply the auth policy for the API to all the resources.\n\n |