---
sourceDocument: Australia API Reference
sourceDocumentLink: https://servicenow-prod.fluidtopics.net/r/api-reference

 Release :

    - australia

ft:locale :

    - en-US

ft:publication_title :

    - Australia API Reference

ft:clusterId :

    - crapiref

bundleId :

    - crapiref

workflow :

    - Creator


---

# Create Access Control Lists (ACLs) for Live Connect

# Create Access Control Lists (ACLs) for Live Connect {#ariaid-title1}

Release version: Australia  
Updated March 12, 2026  
![](https://www.servicenow.com/docs/portal-asset/ico-clock) 2 minutes to read  
Configure table-level access control using the egress_sql and read operations to grant user accounts (personal and service accounts) query access to specific tables through Live Connect.

## Before you begin

Confirm the following:

* You have assigned the sn_odbc_rest_access or sn_jdbc_rest_access role to a user account (personal or service account).
* You have identified which ServiceNow tables must be accessible via Live Connect.

Role required: security_admin

## About this task

Access to tables through the Live Connect is not granted globally. For each table that a user account needs to query, the user account must have explicit read access. You can grant this access in any of the following ways:

* Create two access control lists (ACL), one for the egress_sql operation (which controls Live Connect data export) and one for the read operation (which controls record-level access).
* Assign a role to a user account that includes read permissions for the table.

A user account can only query tables for which it has explicit read access through either method.

By default, Live Connect checks access at the table, row, and field level for every query. This follows ServiceNow's secure-by-default approach. Live Connect validates all ACLs in your instance record by record. This may result in longer response times. This is expected.

If your use case does not require row and field-level checks, you can turn them off. Assign the sn_live_connect_privileged_mode role to the user account (personal or service account). For example, you might build a
dashboard used by multiple people or a Business Intelligence integration. Table-level ACL checks remain in effect and can't be turned off.  
The following configurations are required for each table:

* egress_sql ACL: Allows Live Connect to access the table but does not grant read permission to the data.
* Read access: The user account must have explicit read access through either an explicit read ACL or an assigned role with read permissions.
{#create-acls-sql-api__ul_wbg_412_hkc}

## Procedure

1. Navigate to AllSystem SecurityAccess Control (ACL).
2. Select New.
3. On the Access Control form, configure the first ACL for the egress_sql operation.  
   This operation controls whether data can be exported via Live Connect.{#create-acls-sql-api__entry__2}

   | Field | Value |
   |-|-|
   | Operation | Select egress_sql from the drop-down list. |
   | Decision Type | Select Allow if from the drop-down list. |
   | Name | Select the table to grant access to (for example, incident \[incident\]. |
   | Requires role | Enter the role assigned to your user account (for example, sn_odbc_rest_access or sn_jdbc_rest_access). **Optional** : Add the sn_live_connect_privileged_mode role to turn off row and field-level checks at the user account level. |
   [ ]

4. Select and hold (or right-click) the form header, and select Save.
5. Create the second ACL for the same table by selecting New.
6. On the Access Control form, configure the second ACL for the read operation:  
   {#create-acls-sql-api__entry__12}

   | Field | Value |
   |-|-|
   | Operation | Select read from the drop-down list. This operation controls record-level access to the table. |
   | Decision Type | Select Allow if from the drop-down list. |
   | Name | Select the same table you specified in the egress_sql ACL. |
   | Requires role | Enter the same role you specified in the egress_sql ACL. |
   [ ]

7. Select and hold (or right-click) the form header and select Save.
8. **Optional:** To grant access to additional tables, repeat steps 2 through 7 for each table.  
   Note:  
   Access is granted on a per-table basis.

## Result

You have successfully configured table-level access control for Live Connect. The user account can query the tables for which both egress_sql and read ACLs have been created, subject to the role requirements you specified.

*[\>]: and then