ServiceNow · Schema
ServiceNow Incident
A ServiceNow incident record used for tracking disruptions to IT services, reporting issues, and managing resolution workflows within IT Service Management.
AutomationCloud ServicesDigital WorkflowsEnterprise PlatformIT Service ManagementITSMProcessesT1Workflow AutomationWorkflows
Properties
| Name | Type | Description |
|---|---|---|
| sys_id | string | The unique 32-character system identifier for the incident record. |
| number | string | The human-readable incident number, prefixed with INC. |
| short_description | string | A brief summary of the incident used as the primary display title. |
| description | stringnull | A detailed description of the incident including symptoms and impact. |
| state | string | The current state of the incident: 1=New, 2=In Progress, 3=On Hold, 6=Resolved, 7=Closed, 8=Canceled. |
| impact | string | The impact level: 1=High, 2=Medium, 3=Low. |
| urgency | string | The urgency level: 1=High, 2=Medium, 3=Low. |
| priority | string | The calculated priority: 1=Critical, 2=High, 3=Moderate, 4=Low, 5=Planning. |
| severity | string | The severity level: 1=High, 2=Medium, 3=Low. |
| category | stringnull | The category of the incident, such as Inquiry, Software, Hardware, or Network. |
| subcategory | stringnull | The subcategory providing further classification within the category. |
| contact_type | stringnull | The method through which the incident was reported, such as phone, email, or self-service. |
| caller_id | object | The user who reported the incident. |
| assigned_to | object | The user assigned to work on the incident. |
| assignment_group | object | The group responsible for resolving the incident. |
| opened_by | object | The user who created the incident record. |
| opened_at | string | The date and time the incident was opened. |
| resolved_by | object | The user who resolved the incident. |
| resolved_at | stringnull | The date and time the incident was resolved. |
| closed_by | object | The user who closed the incident. |
| closed_at | stringnull | The date and time the incident was closed. |
| close_code | stringnull | The code indicating how the incident was resolved. |
| close_notes | stringnull | Notes recorded at the time of resolution or closure. |
| cmdb_ci | object | The configuration item affected by the incident. |
| business_service | object | The business service impacted by the incident. |
| company | object | The company associated with the incident. |
| location | object | The location associated with the incident. |
| notify | string | Notification preference: 1=Do Not Notify, 2=Send Notifications, 3=Send Notifications for state changes. |
| work_notes | stringnull | Internal work notes visible only to the fulfillment team. |
| comments | stringnull | Additional comments visible to the caller. |
| reopen_count | integer | The number of times the incident has been reopened. |
| reassignment_count | integer | The number of times the incident has been reassigned. |
| escalation | string | The escalation level: 0=Normal, 1=Overdue, 2=Moderate, 3=High. |
| upon_reject | stringnull | Action to take when an approval is rejected. |
| upon_approval | stringnull | Action to take when an approval is granted. |
| active | boolean | Whether the incident record is active. |
| knowledge | boolean | Whether the incident has been flagged as a knowledge candidate. |
| made_sla | boolean | Whether the incident resolution met the SLA target. |
| sys_created_on | string | The date and time the record was created. |
| sys_created_by | string | The user who created the record. |
| sys_updated_on | string | The date and time the record was last updated. |
| sys_updated_by | string | The user who last updated the record. |
| sys_mod_count | integer | The number of times the record has been modified. |
| sys_class_name | string | The table class name for the record. |
| sys_domain | object | The domain of the record. |