API and web service

---
title: API and web service
description: The API and Web Service category ensures that applications have appropriate authentication, authorization and session management, validate all input that traverses a trust boundary and include security controls for all API types.
locale: en-US
canonical_url: https://www.servicenow.com/docs/r/australia/platform-security/instance-security-hardening-settings/sc-api-web-service.html
release: australia
product: Instance Security Hardening Settings
classification: instance-security-hardening-settings
topic_type: reference
last_updated: "2026-09-10"
reading_time_minutes: 2
breadcrumb: [Hardening settings, Platform Security]
---

# API and web service

The API and Web Service category ensures that applications have appropriate authentication, authorization and session management, validate all input that traverses a trust boundary and include security controls for all API types.

Specific controls in this category address input validation by service type such as XDS schema validation for SOAP web services or Denial of Service protection for graphQL APIs.

-   **[Normalise REST API access policy key generation](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/australia/platform-security/instance-security-hardening-settings/sc-normalise-rest-api-access-policy-key-generation.md)**  
The **glide.rest.policy.normalize\_apply\_all\_fields** property controls how the platform builds lookup keys for REST API access policies when wildcard flags are set.
-   **[Validate SOAP content type](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/australia/platform-security/instance-security-hardening-settings/sc-soap-content-type-checking.md)**  
Use the **glide.soap.require\_content\_type\_xml** property to enable validation of a content type as text/xml and protect against invalid SOAP requests.
-   **[Prevent OAuth Clients from Using Implicit Grant](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/australia/platform-security/instance-security-hardening-settings/sc-prevent-oauth-clients-from-using-implicit-grant.md)**  
Use a system property to avoid the use of the implicit grant type.
-   **[Require authorization for PDF requests](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/australia/platform-security/instance-security-hardening-settings/sc-require-authorization-for-pdf-requests.md)**  
Use the **glide.basicauth.required.pdf** property to designate if incoming PDF requests should require basic authentication.
-   **[Require Authentication on Event Management HTTP Processor \[New in Security Center 1.3, Updated in 1.5, and removed in 2.0\]](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/australia/platform-security/instance-security-hardening-settings/sc-require-authentication-on-event-management-http-processor.md)**  
Learn how to establish secure basic authentication for inbound Amazon Simple Notification Service \(SNS\) requests when the Event Management plugin \(**com.glideapp.itom.snac**\) is enabled.
-   **[Require authorization for SOAP requests](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/australia/platform-security/instance-security-hardening-settings/sc-soap-request-authorization.md)**  
Use the **glide.basicauth.required.soap** property to designate if incoming SOAP requests should require basic authorization.
-   **[Require authorization for unload requests](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/australia/platform-security/instance-security-hardening-settings/sc-require-authorization-for-unload-requests.md)**  
Use the **glide.basicauth.required.unl** \(useUnloadFormat\) property to designate if incoming unload requests should require basic authentication.
-   **[Require authorization for csv requests](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/australia/platform-security/instance-security-hardening-settings/sc-require-authorization-for-csv-requests.md)**  
Use the **glide.basicauth.required.csv** property to designate if incoming CSV \(Comma-Separated Values\) requests should require basic authentication.
-   **[Require authorization for excel requests](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/australia/platform-security/instance-security-hardening-settings/sc-excel-request-authorization.md)**  
Use the **glide.basicauth.required.excel** property to designate if incoming Excel requests should require basic authentication.
-   **[Require authorization for import requests](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/australia/platform-security/instance-security-hardening-settings/sc-import-request-authorization.md)**  
Use the **glide.basicauth.required.importprocessor** property to designate if incoming import requests should require basic authentication.
-   **[Require authorization for JSONv2 request](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/australia/platform-security/instance-security-hardening-settings/sc-jsonv2-request-authorization.md)**  
Use the **glide.basicauth.required.jsonv2** property to designate if incoming JSONv2 requests should require basic authorization.
-   **[Require authorization for WSDL request](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/australia/platform-security/instance-security-hardening-settings/sc-wsdl-request-authorization.md)**  
Use the **glide.basicauth.required.wsdl** property to designate if incoming WSDL \(Web Services Description Language\) requests should require basic authentication.
-   **[Require authorization for XML requests](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/australia/platform-security/instance-security-hardening-settings/sc-xml-request-authorization.md)**  
Use the **glide.basicauth.required.xml** property to designate if incoming XML requests should require basic authentication.
-   **[Require authorization for XML output requests](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/australia/platform-security/instance-security-hardening-settings/sc-xml-output-authorization.md)**  
Configure this property so that basic authorization is required for all inbound XMLOutputProcessor requests.
-   **[Require Authorization for XSD Requests](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/australia/platform-security/instance-security-hardening-settings/sc-xsd-request-authorization.md)**  
Use the **glide.basicauth.required.xsd** property to designate if incoming XSD \(XML Schema Definition\) requests should require basic authentication.
-   **[Require authorization for script requests](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/australia/platform-security/instance-security-hardening-settings/sc-script-request-authorization.md)**  
Use the **glide.basicauth.required.scriptedprocessor** property to designate if incoming script requests should require basic authentication.
-   **[Require authorization for SCHEMA requests](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/australia/platform-security/instance-security-hardening-settings/sc-schema-request-authorization.md)**  
Use the **glide.basicauth.required.schema** property to require basic authorization for all Inbound Table Schema Processor requests.
-   **[Require authorization for RSS requests](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/australia/platform-security/instance-security-hardening-settings/sc-rss-request-authorization.md)**  
Use the **glide.basicauth.required.rss** property to designate if incoming RSS requests should require basic authentication.
-   **[Require authorization for API requests](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/australia/platform-security/instance-security-hardening-settings/sc-api-request-authorization.md)**  
Use the **glide.basicauth.required.api** property to enhance security for basic authorization for incoming REST requests.

**Parent Topic:**[Hardening settings](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/australia/platform-security/instance-security-hardening-settings/security-hardening-settings.md)