BeyondTrust Entitle delivers just-in-time (JIT) access management: instead of standing privileges, users receive temporary, time-bound access to roles and bundles of entitlements. The BeyondTrust Entitle Spoke brings that capability into ServiceNow, letting any workflow list available entitlements, check a user's eligibility, and create and track access requests — directly from Flow Designer or server-side script.
The spoke provides five IntegrationHub actions (List Bundles, List Roles, Get User Eligibility, Create Access Request, Get Access Request) plus the EntitleClient script include for scoped applications. Every call returns a normalized result with a stable error-code set, so flows branch reliably on outcomes instead of parsing raw HTTP responses. Access requests can be submitted on behalf of another user — ideal for onboarding and fulfillment scenarios — and eligibility results are automatically paginated and aggregated.
Setup takes minutes: configure one Connection & Credential Alias with your regional Entitle endpoint and API token. Rotating the token later requires no code or flow changes. The spoke installs no tables, scheduled jobs, or UI, and serves as the certified integration foundation for the BeyondTrust Entitle application for ServiceNow.
- 5 ready-to-use Flow Designer actions covering the Entitle just-in-time access lifecycle: list roles and bundles, check per-user eligibility, create and track access requests
- On-behalf-of requests — submit Entitle access requests for any user, ideal for ITSM fulfillment and onboarding flows
- Reliable flow branching via normalized outputs and stable error codes; eligibility results are auto-paginated
- 5-minute setup — one Connection & Credential Alias; rotate API tokens with zero code or flow changes
v26.1.1 — Initial Release
First release of the BeyondTrust Entitle Spoke. Includes:
- 5 IntegrationHub actions: List Bundles, List Roles, Get User Eligibility, Create Access Request, Get Access Request
- EntitleClient script include for server-side use from other scoped applications
- Normalized success/error contract with stable error codes for flow branching
- Single Connection & Credential Alias configuration supporting all Entitle regions (Global, US, Canada)
ServiceNow requirements
- ServiceNow IntegrationHub plugin (com.glide.hub.integration)
- Flow Designer (included in the base platform)
- Outbound HTTPS access from the instance to the BeyondTrust Entitle API (api.entitle.io, api.us.entitle.io, or api.ca.entitle.io). No MID Server required.
- No dependency on ITSM, ITOM, or other ServiceNow products — the spoke works with any application that can call a Flow Designer action or scoped script include.
BeyondTrust requirements
- An active BeyondTrust Entitle tenant
- An Entitle admin API token for authentication