Reference

Endpoint Get Table Rows

Name

get_table_rows

Description

Get table rows [API reference]

Related Tables

[Dynamic Table]

Parameters

Parameter

Required

Options

Name: PagingRowCount

Label: Page Size (Default=2000, Max=10000)

Max can be 10000 but it may decrease performance if you fetching less than 10K rows in some requests.

YES

Name: TableName

Label: TableName

Table name

YES

Name: PagingOffset

Label: PagingOffset

Name: SysId

Label: SysId

Row 'sys_id'

Name: Fields

Label: Fields to include in response (Keep blank to get all fields -OR- Enter comma separated list)

Comma-separated field names you want to return in the response. E.g. sys_id,name,label,sys_name,sys_updated_on. Using this setting reduces the response size and speed up the processing.

Name: Query

Label: Query / Order By (Server Side Filter)

Server-side encoded query for filtering and ordering records. Supports string, numeric, date, NULL checks, AND/OR logic, and ORDER BY clauses.

Option	Value
Equals (String)	name=Test
Equals (Number)	priority=1
Not Equal	state!=closed
AND Condition	state=active^priority=1
OR Condition	state=active^ORstate=pending
IN List	stateINactive,pending,closed
NOT IN List	stateNOT INactive,closed
Starts With	nameSTARTSWITHTest
Ends With	nameENDSWITH001
Contains (LIKE)	short_descriptionLIKEerror
Does Not Contain	short_descriptionNOT LIKEpassword
Greater Than (Number)	priority>2
Less Than (Number)	priority<4
Between Numbers	priority>=2^priority<=4
Is Empty	assigned_toISEMPTY
Is Not Empty	assigned_toISNOTEMPTY
Created After Date	sys_created_on>=2026-01-01
Created Before Date	sys_created_on<=2026-01-31 23:59:59
Created Today	sys_created_on>=<>^sys_created_on<=<>
Updated Last 2 Days	sys_updated_on>=<>
Multiple Conditions Mixed	state=active^priority>1^short_descriptionLIKEerror
Order By Column	ORDERBYname
Order By Column Desc	ORDERBYDESCsys_created_on
Order By Multiple Columns	ORDERBYpriority^ORDERBYDESCsys_created_on
Filter + Order	state=active^ORDERBYsys_updated_on

Output Columns

Label	Data Type (SSIS)	Data Type (SQL)	Length	Description
sys_id	`DT_WSTR`	`nvarchar(32)`	32
[$parent.Pivot_Name$]	`DT_WSTR`	`nvarchar(2000)`	2000

If the column you are looking for is missing, consider customizing ServiceNow Connector.

Input Columns

Label	Data Type (SSIS)	Data Type (SQL)	Length	Description
There are no Static columns defined for this endpoint. This endpoint detects columns dynamically at runtime.

Examples

SSIS

Use ServiceNow Connector in API Source or in API Destination SSIS Data Flow components to read or write data.

API Source

This Endpoint belongs to the [Dynamic Table] table, therefore it is better to use it, instead of accessing the endpoint directly:

API Source - ServiceNow

Read and write ServiceNow data effortlessly. Integrate, manage, and automate incidents, tasks, attachments, and records — almost no coding required.

ServiceNow

[Dynamic Table]

There are no parameters to configure.

SSIS API Source - Read from table or endpoint

API Destination

This Endpoint belongs to the [Dynamic Table] table, therefore it is better to use it, instead of accessing the endpoint directly. Use this table and table-operation pair to get table rows:

API Destination - ServiceNow

Read and write ServiceNow data effortlessly. Integrate, manage, and automate incidents, tasks, attachments, and records — almost no coding required.

ServiceNow

[Dynamic Table]

Select, Lookup

There are no parameters to configure.

SSIS API Destination - Access table operation

ODBC application

Use these SQL queries in your ODBC application data source:

Read incidents

Gets a list of incidents from the <code>incident</code> table. You can use this pattern to read from any other table by changing the table name.

SELECT * FROM incident 

--Using Primary Key				
--SELECT * FROM any_table_here WHERE sys_id='109562a3c611227500a7b7ff98cc0dc7' --Primary Key in WHERE clause

--OR-- 

--Use below to query system / hidden tables (faster response - No Table name lookup needed in below)
SELECT * FROM get_table_rows WITH(TableName='incident', Query='number=INC0000001')

--=================================
--Examples: Using Filter Expression
--=================================
-- Incremental Load Pattern: Load only incidents updated in the last 24 hours (see FUN_TO_DATETIME function help for more information, you can use +/- d, m, y, min,h,s along with now, today, yesterday, weekstart, weekend, monthstart, monthend, yearstart, yearend functions)
--SELECT * FROM incident WITH(Query='sys_updated_on>=<<today-1d,FUN_TO_DATETIME>>')

--SELECT * FROM incident WITH(Query='number=INC0000001') --Equal condition
--SELECT * FROM incident WITH(Query='number!=INC0000001') --Not equal condition
--SELECT * FROM incident WITH(Query='numberININC0000001,INC0000002,INC0000003') --IN condition
--SELECT * FROM incident WITH(Query='number=INC0000001^state=7') --AND condition
--SELECT * FROM incident WITH(Query='number=INC0000001^ORnumber=INC0000002') --OR condition
--SELECT * FROM incident WITH(Query='numberLIKE0001') --LIKE condition
--SELECT * FROM incident WITH(Query='numberSTARTSWITHINC00') --StartWith condition
--SELECT * FROM incident WITH(Query='numberENDSWITH0001') --StartWith condition
--SELECT * FROM incident WITH(Query='number=INC0000001^state=7^NQORnumber=INC0000002') --AND / OR MIXED using NQ (NewQuery Operator)  -- (number=INC0000001 and state=7) OR (number=INC0000002)

--more information about filter here https://docs.servicenow.com/bundle/utah-platform-user-interface/page/use/common-ui-elements/reference/r_OpAvailableFiltersQueries.html


-- To read all available tables execute this query:
-- SELECT * FROM Tables

-- Other common tables:
-----------------------
-- SELECT * FROM sys_db_object
-- SELECT * FROM sys_dictionary
-- SELECT * FROM sys_user
-- SELECT * FROM sys_user_has_role
-- SELECT * FROM sys_user_grmember
-- SELECT * FROM task
-- SELECT * FROM task_sla
-- SELECT * FROM incident
-- SELECT * FROM incident_sla
-- SELECT * FROM change_request
-- SELECT * FROM cmdb_ci_computer
-- SELECT * FROM cmdb_ci_outage
-- SELECT * FROM cmdb_ci
-- SELECT * FROM sn_customerservice_case
-- SELECT * FROM kb_knowledge
-- SELECT * FROM kb_use
-- SELECT * FROM sc_req_item
-- SELECT * FROM sc_request
-- SELECT * FROM sc_task

Read incidents incrementally (by updated date)

Fetch incidents updated after a specific date. This pattern is recommended for incremental loads and scheduled sync jobs. Use this approach to avoid full table scans, reduce API calls, and improve overall performance. The date filter can be specified using either a static date value or a dynamic date expression. Dynamic date expressions allow relative date calculations and are useful for automated jobs. Examples of dynamic date expressions: <ul> <li><code>yesterday</code> – incidents updated yesterday</li> <li><code>today</code> – incidents updated today</li> <li><code>today-1d</code> – incidents updated in the last 24 hours</li> <li><code>monthstart</code> – incidents updated since the beginning of the month</li> <li><code>monthend-1d</code> – incidents updated up to the last day of the previous month</li> </ul>

-- Incrementally fetch incidents updated after a given date
SELECT *
FROM get_table_rows
WITH(
TableName='incident',

-- Load only incidents updated in the last 24 hours
Query='sys_updated_on>=<<today-1d,FUN_TO_DATETIME>>'

--OR Updated after static date time
--Query='sys_updated_on>=2025-01-01T23:23:59'
--Query='sys_updated_on>=2025-01-01'

--Other examples of placeholder function usage
--Query='sys_updated_on>=<<monthstart-7d,FUN_TO_DATETIME>>'
--Query='sys_updated_on>=<<monthstart-5d+1y,FUN_TO_DATETIME>>'

)

Read data from system tables

Gets data from system tables (e.g. <code>sys_choice</code>, <code>sys_journal_field</code>). Many tables are not listed in the <code>get_tables</code> endpoint and are hidden from UI selection. Use the <code>get_table_rows</code> endpoint to query them directly.

SELECT * FROM get_table_rows WITH(TableName='sys_choice', Query='name=incident^element=close_code')
--SELECT * FROM get_table_rows WITH(TableName='sys_journal_field', Query='name=incident^element=close_code')

Read an incident by number

Fetch a specific incident using its human-readable <code>number</code> (for example <code>INC0012345</code>). This is the most common lookup used in integrations and support workflows. The query filters the <code>incident</code> table using <code>sysparm_query</code> semantics.

-- Query a single incident by incident number
SELECT *
FROM get_table_rows
WITH(
  TableName='incident',
  Query='number=INC0012345'
)

Read incident work notes

Retrieve Work Notes added to incidents. Work notes are stored as journal entries in the <code>sys_journal_field</code> table, not directly on the incident record. This example returns all internal notes entered by agents.

-- Get work notes for all incidents
SELECT *
FROM get_table_rows
WITH(
	TableName='sys_journal_field',
	Query='name=incident^element=work_notes'
)

Read incident additional comments

Fetch Additional Comments (customer-visible notes) for incidents. These comments are typically shared with end users and customers. Data is sourced from the ServiceNow journal table.

-- Get customer-facing comments for incidents
SELECT *
FROM get_table_rows
WITH(
TableName='sys_journal_field',
Query='name=incident^element=comments'
)

Read incident tasks

Retrieve all tasks associated with a specific incident. Incident tasks are stored in the <code>incident_task</code> table and linked using the parent incident reference. You can use static date or function as above. This function expression can be in the form of [function_name][+/-][interval][interval][+/-][interval]... For example to get Last date of previous month you can do "monthend-1d". To get yesterday's date you can just type "yesterday". Valid date function names for this expression are [ now | today | yesterday | weekstart | weekend | monthstart | monthend | yearstart | yearend ]. Valid interval names are [ms (for milliseconds) | s OR sec | min | h OR hour | y OR year | d OR day |m OR month | y OR year]

-- Get all tasks for a specific incident
SELECT *
FROM get_table_rows
WITH(
    TableName='incident_task',
    Query='incident.number=INC0012345'
)

Read attachments for an incident

Retrieve all file attachments linked to a specific incident. Attachments are stored in the <code>sys_attachment</code> table. This example is commonly used before downloading or deleting attachments.

-- List attachments linked to an incident
SELECT *
FROM get_table_rows
WITH(
	TableName='sys_attachment',
	Query='table_name=incident^table_sys_id=<<INCIDENT_SYS_ID>>'
)

Read dropdown labels and values

Resolve and list dropdown (choice) field labels and values for any ServiceNow table or form screen. ServiceNow stores dropdown fields as internal values (for example <code>4</code>) while displaying user-friendly labels (such as <code>4 - Low</code>) in the UI. These mappings are defined in the <code>sys_choice</code> system table. Use this example to discover and resolve dropdown options for fields like Priority, State, Category, Close Code, and any custom choice field across all ServiceNow tables.

-- Resolve and list dropdown (choice) labels and values for any table and field
-- Replace <TABLE_NAME> and <FIELD_NAME> with your target form field (e.g. name=incident^element=priority)

SELECT *
FROM get_table_rows
WITH(
  TableName='sys_choice',
  Query='name=<TABLE_NAME>^element=<FIELD_NAME>'
)

Read incidents using reference fields

Demonstrates how to query the <code>incident</code> table using reference (foreign key) fields in ServiceNow. ServiceNow allows filtering on fields from related tables using dot-walking syntax (<code>reference_field.some_field</code>), without requiring explicit joins. Use these patterns to filter incidents by Caller, Assigned User, Assignment Group, Configuration Item, or other referenced records.

-- 1. Query incidents by caller's username (caller_id → sys_user)
SELECT *
FROM get_table_rows
WITH(
	TableName='incident',
	Query='caller_id.user_name=john.doe'
) 

-- 2. Query incidents by assigned user's display name (assigned_to → sys_user)
SELECT *
FROM get_table_rows
WITH(
	TableName='incident',
	Query='assigned_to.name=Jane Smith'
) 

-- 3. Query incidents by assignment group name (assignment_group → sys_user_group)
SELECT *
FROM get_table_rows
WITH(
	TableName='incident',
	Query='assignment_group.name=Network'
) 

-- 4. Query incidents by configuration item name (cmdb_ci → CMDB record)
SELECT *
FROM get_table_rows
WITH(
	TableName='incident',
	Query='cmdb_ci.name=SRV-APP-01'
) 

-- 5. Combine reference field and local field filters
--    (Network group + High priority incidents)
SELECT *
FROM get_table_rows
WITH(
	TableName='incident',
	Query='assignment_group.name=Network^priority=1'
)

Read selected columns (performance optimization)

By default, all column values are returned in the result set. You can instruct the ServiceNow API to send only specific columns by setting the <code>Fields</code> parameter in the <code>WITH</code> clause. This significantly speeds up the response.

SELECT number,name FROM incident WITH (Fields='number,name') --Setting Fields parameter will speed up the query

Read table using server-side filter

<h3>Server-side filtering using ServiceNow native query language</h3> This example demonstrates how to filter ServiceNow table data using the native server-side filter expression (sysparm_query) via the <code>WITH(Query='...')</code> clause. Why this matters: Server-side filtering is executed inside ServiceNow before data is returned. This dramatically improves performance, reduces network traffic, and avoids unnecessary client-side processing. Using a SQL <code>WHERE</code> clause without <code>WITH(Query=...)</code> forces the driver to retrieve more data first and then filter locally, which is slower. Always prefer server-side filters first. Use client-side filtering only when a condition cannot be expressed using ServiceNow query syntax. <hr/> <h4>ServiceNow query operators (mapped to SQL)</h4> <table border="1" cellpadding="5" cellspacing="0"> <tr><th>Operator</th><th>Meaning</th><th>SQL Equivalent</th></tr> <tr><td><code>=</code></td><td>Equals</td><td>=</td></tr> <tr><td><code>!=</code></td><td>Not equals</td><td><></td></tr> <tr><td><code>IN</code></td><td>In list</td><td>IN (...)</td></tr> <tr><td><code>LIKE</code></td><td>Contains</td><td>LIKE '%x%'</td></tr> <tr><td><code>STARTSWITH</code></td><td>Starts with</td><td>LIKE 'x%'</td></tr> <tr><td><code>ENDSWITH</code></td><td>Ends with</td><td>LIKE '%x'</td></tr> <tr><td><code>^</code></td><td>AND</td><td>AND</td></tr> <tr><td><code>^OR</code></td><td>OR (same group)</td><td>OR</td></tr> <tr><td><code>NQ</code></td><td>New Query (OR group)</td><td>OR (grouped)</td></tr> </table> Important: <ul> <li><code>^</code> always means AND</li> <li><code>^OR</code> applies OR within the same query group</li> <li><code>NQ</code> starts a new OR group (similar to adding parentheses in SQL)</li> </ul> Example: <pre> priority=1^state=2^NQpriority=2^state=3 </pre> Is equivalent to SQL: <pre> (priority = 1 AND state = 2) OR (priority = 2 AND state = 3) </pre> <hr/> <h4>Date and time filtering using ZappySys Placeholder Engine</h4> You can dynamically generate date values using placeholders. These are evaluated at runtime before the query is sent to ServiceNow. <ul> <li><code><<today,FUN_TO_DATE>></code> – today</li> <li><code><<yesterday,FUN_TO_DATE>></code> – yesterday</li> <li><code><<today-1d,FUN_TO_DATE>></code> – today minus 1 day</li> <li><code><<today-1m,FUN_TO_DATE>></code> – today minus 1 month</li> <li><code><<monthstart,FUN_TO_DATE>></code> – current month start</li> <li><code><<monthend,FUN_TO_DATE>></code> – current month end</li> <li><code><<yearstart,FUN_TO_DATE>></code> – year start</li> <li><code><<yearend,FUN_TO_DATE>></code> – year end</li> </ul> See full placeholder documentation here: <a href="https://zappysys.com/onlinehelp/odbc-powerpack/scr/odbc-format-static-placeholders.htm#fun_FUN_TO_DATETIME" target="_blank"> ZappySys Placeholder Engine – FUN_TO_DATETIME </a> <hr/> <h4>Reference documentation</h4> <ul> <li><a href="https://www.servicenow.com/docs/r/api-reference/rest-apis/c_TableAPI.html" target="_blank">ServiceNow Table API</a></li> <li><a href="https://docs.servicenow.com/bundle/utah-platform-user-interface/page/use/common-ui-elements/reference/r_OpAvailableFiltersQueries.html" target="_blank">ServiceNow Filter Operators</a></li> <li><a href="https://developer.servicenow.com/dev.do#!/learn/learning-plans/xanadu/servicenow_application_developer/app_store_learnv2_rest_xanadu_request_parameters" target="_blank">Advanced Query Parameters</a></li> </ul>

-- Basic server-side filter
SELECT * FROM incident WITH(Query='state=2')

-- Primary key lookup (fastest)
SELECT * FROM incident WHERE sys_id='109562a3c611227500a7b7ff98cc0dc7'

-- Not equal
SELECT * FROM incident WITH(Query='state!=6')

-- IN condition
SELECT * FROM incident WITH(Query='priorityIN1,2,3')

-- AND condition
SELECT * FROM incident WITH(Query='priority=1^state=2')
-- SQL: WHERE priority = 1 AND state = 2

-- OR condition (same group)
SELECT * FROM incident WITH(Query='priority=1^ORstate=2')
-- SQL: WHERE priority = 1 OR state = 2

-- AND / OR mixed using NQ
SELECT * FROM incident WITH(Query='priority=1^state=2^NQpriority=2^state=3')
-- SQL: (priority = 1 AND state = 2) OR (priority = 2 AND state = 3)

-- LIKE / StartsWith / EndsWith
SELECT * FROM incident WITH(Query='short_descriptionLIKEemail')
SELECT * FROM incident WITH(Query='numberSTARTSWITHINC')
SELECT * FROM incident WITH(Query='numberENDSWITH001')

-- Date filter using placeholders (last 1 month)
SELECT * FROM incident WITH(Query='opened_at>=<<today-1m,FUN_TO_DATE>>')

-- From month start
SELECT * FROM incident WITH(Query='opened_at>=<<monthstart,FUN_TO_DATE>>')

-- Between dates
SELECT * FROM incident WITH(Query='opened_at>=<<monthstart,FUN_TO_DATE>>^opened_at<=<<monthend,FUN_TO_DATE>>')

Read an incident by ID

Gets a single incident by its <code>sys_id</code> (primary key).

SELECT * FROM incident
WHERE sys_id = 'SYS_ID_GOES_HERE'

Read table using server-side filter

-- Basic server-side filter
SELECT * FROM incident WITH(Query='state=2')

-- Primary key lookup (fastest)
SELECT * FROM incident WHERE sys_id='109562a3c611227500a7b7ff98cc0dc7'

-- Not equal
SELECT * FROM incident WITH(Query='state!=6')

-- IN condition
SELECT * FROM incident WITH(Query='priorityIN1,2,3')

-- AND condition
SELECT * FROM incident WITH(Query='priority=1^state=2')
-- SQL: WHERE priority = 1 AND state = 2

-- OR condition (same group)
SELECT * FROM incident WITH(Query='priority=1^ORstate=2')
-- SQL: WHERE priority = 1 OR state = 2

-- AND / OR mixed using NQ
SELECT * FROM incident WITH(Query='priority=1^state=2^NQpriority=2^state=3')
-- SQL: (priority = 1 AND state = 2) OR (priority = 2 AND state = 3)

-- LIKE / StartsWith / EndsWith
SELECT * FROM incident WITH(Query='short_descriptionLIKEemail')
SELECT * FROM incident WITH(Query='numberSTARTSWITHINC')
SELECT * FROM incident WITH(Query='numberENDSWITH001')

-- Date filter using placeholders (last 1 month)
SELECT * FROM incident WITH(Query='opened_at>=<<today-1m,FUN_TO_DATE>>')

-- From month start
SELECT * FROM incident WITH(Query='opened_at>=<<monthstart,FUN_TO_DATE>>')

-- Between dates
SELECT * FROM incident WITH(Query='opened_at>=<<monthstart,FUN_TO_DATE>>^opened_at<=<<monthend,FUN_TO_DATE>>')

get_table_rows endpoint belongs to [Dynamic Table] table(s), and can therefore be used via those table(s).

SQL Server

Use these SQL queries in SQL Server after you create a data source in Data Gateway:

Read incidents

Gets a list of incidents from the <code>incident</code> table. You can use this pattern to read from any other table by changing the table name.

DECLARE @MyQuery NVARCHAR(MAX) = 'SELECT * FROM incident 

--Using Primary Key				
--SELECT * FROM any_table_here WHERE sys_id=''109562a3c611227500a7b7ff98cc0dc7'' --Primary Key in WHERE clause

--OR-- 

--Use below to query system / hidden tables (faster response - No Table name lookup needed in below)
SELECT * FROM get_table_rows WITH(TableName=''incident'', Query=''number=INC0000001'')

--=================================
--Examples: Using Filter Expression
--=================================
-- Incremental Load Pattern: Load only incidents updated in the last 24 hours (see FUN_TO_DATETIME function help for more information, you can use +/- d, m, y, min,h,s along with now, today, yesterday, weekstart, weekend, monthstart, monthend, yearstart, yearend functions)
--SELECT * FROM incident WITH(Query=''sys_updated_on>=<<today-1d,FUN_TO_DATETIME>>'')

--SELECT * FROM incident WITH(Query=''number=INC0000001'') --Equal condition
--SELECT * FROM incident WITH(Query=''number!=INC0000001'') --Not equal condition
--SELECT * FROM incident WITH(Query=''numberININC0000001,INC0000002,INC0000003'') --IN condition
--SELECT * FROM incident WITH(Query=''number=INC0000001^state=7'') --AND condition
--SELECT * FROM incident WITH(Query=''number=INC0000001^ORnumber=INC0000002'') --OR condition
--SELECT * FROM incident WITH(Query=''numberLIKE0001'') --LIKE condition
--SELECT * FROM incident WITH(Query=''numberSTARTSWITHINC00'') --StartWith condition
--SELECT * FROM incident WITH(Query=''numberENDSWITH0001'') --StartWith condition
--SELECT * FROM incident WITH(Query=''number=INC0000001^state=7^NQORnumber=INC0000002'') --AND / OR MIXED using NQ (NewQuery Operator)  -- (number=INC0000001 and state=7) OR (number=INC0000002)

--more information about filter here https://docs.servicenow.com/bundle/utah-platform-user-interface/page/use/common-ui-elements/reference/r_OpAvailableFiltersQueries.html


-- To read all available tables execute this query:
-- SELECT * FROM Tables

-- Other common tables:
-----------------------
-- SELECT * FROM sys_db_object
-- SELECT * FROM sys_dictionary
-- SELECT * FROM sys_user
-- SELECT * FROM sys_user_has_role
-- SELECT * FROM sys_user_grmember
-- SELECT * FROM task
-- SELECT * FROM task_sla
-- SELECT * FROM incident
-- SELECT * FROM incident_sla
-- SELECT * FROM change_request
-- SELECT * FROM cmdb_ci_computer
-- SELECT * FROM cmdb_ci_outage
-- SELECT * FROM cmdb_ci
-- SELECT * FROM sn_customerservice_case
-- SELECT * FROM kb_knowledge
-- SELECT * FROM kb_use
-- SELECT * FROM sc_req_item
-- SELECT * FROM sc_request
-- SELECT * FROM sc_task';

EXEC (@MyQuery) AT [LS_TO_SERVICENOW_IN_GATEWAY];

Read incidents incrementally (by updated date)

DECLARE @MyQuery NVARCHAR(MAX) = '-- Incrementally fetch incidents updated after a given date
SELECT *
FROM get_table_rows
WITH(
TableName=''incident'',

-- Load only incidents updated in the last 24 hours
Query=''sys_updated_on>=<<today-1d,FUN_TO_DATETIME>>''

--OR Updated after static date time
--Query=''sys_updated_on>=2025-01-01T23:23:59''
--Query=''sys_updated_on>=2025-01-01''

--Other examples of placeholder function usage
--Query=''sys_updated_on>=<<monthstart-7d,FUN_TO_DATETIME>>''
--Query=''sys_updated_on>=<<monthstart-5d+1y,FUN_TO_DATETIME>>''

)';

EXEC (@MyQuery) AT [LS_TO_SERVICENOW_IN_GATEWAY];

Read data from system tables

DECLARE @MyQuery NVARCHAR(MAX) = 'SELECT * FROM get_table_rows WITH(TableName=''sys_choice'', Query=''name=incident^element=close_code'')
--SELECT * FROM get_table_rows WITH(TableName=''sys_journal_field'', Query=''name=incident^element=close_code'')';

EXEC (@MyQuery) AT [LS_TO_SERVICENOW_IN_GATEWAY];

Read an incident by number

DECLARE @MyQuery NVARCHAR(MAX) = '-- Query a single incident by incident number
SELECT *
FROM get_table_rows
WITH(
  TableName=''incident'',
  Query=''number=INC0012345''
)';

EXEC (@MyQuery) AT [LS_TO_SERVICENOW_IN_GATEWAY];

Read incident work notes

DECLARE @MyQuery NVARCHAR(MAX) = '-- Get work notes for all incidents
SELECT *
FROM get_table_rows
WITH(
	TableName=''sys_journal_field'',
	Query=''name=incident^element=work_notes''
)';

EXEC (@MyQuery) AT [LS_TO_SERVICENOW_IN_GATEWAY];

Read incident additional comments

DECLARE @MyQuery NVARCHAR(MAX) = '-- Get customer-facing comments for incidents
SELECT *
FROM get_table_rows
WITH(
TableName=''sys_journal_field'',
Query=''name=incident^element=comments''
)';

EXEC (@MyQuery) AT [LS_TO_SERVICENOW_IN_GATEWAY];

Read incident tasks

DECLARE @MyQuery NVARCHAR(MAX) = '-- Get all tasks for a specific incident
SELECT *
FROM get_table_rows
WITH(
    TableName=''incident_task'',
    Query=''incident.number=INC0012345''
)';

EXEC (@MyQuery) AT [LS_TO_SERVICENOW_IN_GATEWAY];

Read attachments for an incident

DECLARE @MyQuery NVARCHAR(MAX) = '-- List attachments linked to an incident
SELECT *
FROM get_table_rows
WITH(
	TableName=''sys_attachment'',
	Query=''table_name=incident^table_sys_id=<<INCIDENT_SYS_ID>>''
)';

EXEC (@MyQuery) AT [LS_TO_SERVICENOW_IN_GATEWAY];

Read dropdown labels and values

DECLARE @MyQuery NVARCHAR(MAX) = '-- Resolve and list dropdown (choice) labels and values for any table and field
-- Replace <TABLE_NAME> and <FIELD_NAME> with your target form field (e.g. name=incident^element=priority)

SELECT *
FROM get_table_rows
WITH(
  TableName=''sys_choice'',
  Query=''name=<TABLE_NAME>^element=<FIELD_NAME>''
)';

EXEC (@MyQuery) AT [LS_TO_SERVICENOW_IN_GATEWAY];

Read incidents using reference fields

DECLARE @MyQuery NVARCHAR(MAX) = '-- 1. Query incidents by caller''s username (caller_id → sys_user)
SELECT *
FROM get_table_rows
WITH(
	TableName=''incident'',
	Query=''caller_id.user_name=john.doe''
) 

-- 2. Query incidents by assigned user''s display name (assigned_to → sys_user)
SELECT *
FROM get_table_rows
WITH(
	TableName=''incident'',
	Query=''assigned_to.name=Jane Smith''
) 

-- 3. Query incidents by assignment group name (assignment_group → sys_user_group)
SELECT *
FROM get_table_rows
WITH(
	TableName=''incident'',
	Query=''assignment_group.name=Network''
) 

-- 4. Query incidents by configuration item name (cmdb_ci → CMDB record)
SELECT *
FROM get_table_rows
WITH(
	TableName=''incident'',
	Query=''cmdb_ci.name=SRV-APP-01''
) 

-- 5. Combine reference field and local field filters
--    (Network group + High priority incidents)
SELECT *
FROM get_table_rows
WITH(
	TableName=''incident'',
	Query=''assignment_group.name=Network^priority=1''
)';

EXEC (@MyQuery) AT [LS_TO_SERVICENOW_IN_GATEWAY];

Read selected columns (performance optimization)

DECLARE @MyQuery NVARCHAR(MAX) = 'SELECT number,name FROM incident WITH (Fields=''number,name'') --Setting Fields parameter will speed up the query';

EXEC (@MyQuery) AT [LS_TO_SERVICENOW_IN_GATEWAY];

Read table using server-side filter

DECLARE @MyQuery NVARCHAR(MAX) = '-- Basic server-side filter
SELECT * FROM incident WITH(Query=''state=2'')

-- Primary key lookup (fastest)
SELECT * FROM incident WHERE sys_id=''109562a3c611227500a7b7ff98cc0dc7''

-- Not equal
SELECT * FROM incident WITH(Query=''state!=6'')

-- IN condition
SELECT * FROM incident WITH(Query=''priorityIN1,2,3'')

-- AND condition
SELECT * FROM incident WITH(Query=''priority=1^state=2'')
-- SQL: WHERE priority = 1 AND state = 2

-- OR condition (same group)
SELECT * FROM incident WITH(Query=''priority=1^ORstate=2'')
-- SQL: WHERE priority = 1 OR state = 2

-- AND / OR mixed using NQ
SELECT * FROM incident WITH(Query=''priority=1^state=2^NQpriority=2^state=3'')
-- SQL: (priority = 1 AND state = 2) OR (priority = 2 AND state = 3)

-- LIKE / StartsWith / EndsWith
SELECT * FROM incident WITH(Query=''short_descriptionLIKEemail'')
SELECT * FROM incident WITH(Query=''numberSTARTSWITHINC'')
SELECT * FROM incident WITH(Query=''numberENDSWITH001'')

-- Date filter using placeholders (last 1 month)
SELECT * FROM incident WITH(Query=''opened_at>=<<today-1m,FUN_TO_DATE>>'')

-- From month start
SELECT * FROM incident WITH(Query=''opened_at>=<<monthstart,FUN_TO_DATE>>'')

-- Between dates
SELECT * FROM incident WITH(Query=''opened_at>=<<monthstart,FUN_TO_DATE>>^opened_at<=<<monthend,FUN_TO_DATE>>'')';

EXEC (@MyQuery) AT [LS_TO_SERVICENOW_IN_GATEWAY];

Read an incident by ID

Gets a single incident by its <code>sys_id</code> (primary key).

DECLARE @MyQuery NVARCHAR(MAX) = 'SELECT * FROM incident
WHERE sys_id = ''SYS_ID_GOES_HERE''';

EXEC (@MyQuery) AT [LS_TO_SERVICENOW_IN_GATEWAY];

Read table using server-side filter

DECLARE @MyQuery NVARCHAR(MAX) = '-- Basic server-side filter
SELECT * FROM incident WITH(Query=''state=2'')

-- Primary key lookup (fastest)
SELECT * FROM incident WHERE sys_id=''109562a3c611227500a7b7ff98cc0dc7''

-- Not equal
SELECT * FROM incident WITH(Query=''state!=6'')

-- IN condition
SELECT * FROM incident WITH(Query=''priorityIN1,2,3'')

-- AND condition
SELECT * FROM incident WITH(Query=''priority=1^state=2'')
-- SQL: WHERE priority = 1 AND state = 2

-- OR condition (same group)
SELECT * FROM incident WITH(Query=''priority=1^ORstate=2'')
-- SQL: WHERE priority = 1 OR state = 2

-- AND / OR mixed using NQ
SELECT * FROM incident WITH(Query=''priority=1^state=2^NQpriority=2^state=3'')
-- SQL: (priority = 1 AND state = 2) OR (priority = 2 AND state = 3)

-- LIKE / StartsWith / EndsWith
SELECT * FROM incident WITH(Query=''short_descriptionLIKEemail'')
SELECT * FROM incident WITH(Query=''numberSTARTSWITHINC'')
SELECT * FROM incident WITH(Query=''numberENDSWITH001'')

-- Date filter using placeholders (last 1 month)
SELECT * FROM incident WITH(Query=''opened_at>=<<today-1m,FUN_TO_DATE>>'')

-- From month start
SELECT * FROM incident WITH(Query=''opened_at>=<<monthstart,FUN_TO_DATE>>'')

-- Between dates
SELECT * FROM incident WITH(Query=''opened_at>=<<monthstart,FUN_TO_DATE>>^opened_at<=<<monthend,FUN_TO_DATE>>'')';

EXEC (@MyQuery) AT [LS_TO_SERVICENOW_IN_GATEWAY];

get_table_rows endpoint belongs to [Dynamic Table] table(s), and can therefore be used via those table(s).