feat: Add ServiceNow integration

docs/components/ServiceNow.mdx

@@ -0,0 +1,198 @@
+---
+title: "ServiceNow"
+---
+
+Manage and react to incidents in ServiceNow
+
+## Triggers
+
+<CardGrid>
+  <LinkCard title="On Incident" href="#on-incident" description="Listen to incident events from ServiceNow" />
+</CardGrid>
+
+import { CardGrid, LinkCard } from "@astrojs/starlight/components";
+
+## Actions
+
+<CardGrid>
+  <LinkCard title="Create Incident" href="#create-incident" description="Create a new incident in ServiceNow" />
+</CardGrid>
+
+## Instructions
+
+Requires a ServiceNow instance with API access. The following roles are needed on your ServiceNow instance:
+
+**Integration account** (for Basic Auth or OAuth):
+- **itil** — read/write access to the Incident table
+
+Optionally, enable **Web Service Access Only** on the integration account to restrict it to API-only use.
+
+**On Incident trigger**: Setting up the Business Rule on ServiceNow requires the **admin** role. This is a one-time setup.
+
+<a id="on-incident"></a>
+
+## On Incident
+
+The On Incident trigger starts a workflow execution when ServiceNow incident events are received via webhook.
+
+### Use Cases
+
+- **Incident automation**: Automate responses when incidents are created or updated
+- **Notification workflows**: Send notifications when new incidents are created
+- **Integration workflows**: Sync incidents with external systems
+- **Escalation handling**: Handle incident updates automatically
+
+### Configuration
+
+- **Events**: Select which incident events to listen for (insert, update, delete)
+
+### Scoping
+
+Incident scoping (e.g. filtering by assignment group, category, or priority) is configured in the ServiceNow Business Rule conditions. This allows control over which incidents trigger the webhook.
+
+### Required Permissions
+
+Creating the Business Rule in ServiceNow requires the **admin** role. This is a one-time setup step.
+
+### Business Rule Setup
+
+This trigger provides a webhook URL and a ready-to-use Business Rule script:
+
+1. In ServiceNow, navigate to **System Definition > Business Rules** and create a new rule
+2. Set the table to `incident`, set **When** to **after**, and check **insert**, **update**, and/or **delete** as needed
+3. Check **Advanced** and paste the generated script into the **Script** field
+4. The script uses `sn_ws.RESTMessageV2` to send incident data to the webhook URL with the secret for authentication
+
+### Event Data
+
+Each incident event includes the full incident record from ServiceNow, including:
+- **sys_id**: Unique identifier
+- **number**: Human-readable incident number
+- **short_description**: Brief summary
+- **state**: Current state
+- **urgency**: Urgency level
+- **impact**: Impact level
+- **assignment_group**: Assigned group
+- **assigned_to**: Assigned user
+
+### Example Data
+
+```json
+{
+  "data": {
+    "assigned_to": {
+      "display_value": "John Smith",
+      "value": "681ccaf9c0a8016400b98a06818d57c7"
+    },
+    "assignment_group": {
+      "display_value": "Network",
+      "value": "d625dccec0a8016700a222a0f7900d06"
+    },
+    "caller_id": {
+      "display_value": "Jane Doe",
+      "value": "6816f79cc0a8016401c5a33be04be441"
+    },
+    "category": "Network",
+    "description": "The production web server is not responding to requests.",
+    "impact": "2",
+    "number": "INC0010001",
+    "opened_at": "2026-01-19 12:00:00",
+    "opened_by": {
+      "display_value": "Jane Doe",
+      "value": "6816f79cc0a8016401c5a33be04be441"
+    },
+    "priority": "3",
+    "short_description": "Server is unresponsive",
+    "state": "1",
+    "subcategory": "DNS",
+    "sys_created_on": "2026-01-19 12:00:00",
+    "sys_id": "a1b2c3d4e5f6g7h8i9j0",
+    "sys_updated_on": "2026-01-19 12:00:00",
+    "urgency": "2"
+  },
+  "timestamp": "2026-01-19T12:00:00Z",
+  "type": "servicenow.incident.insert"
+}
+```
+
+<a id="create-incident"></a>
+
+## Create Incident
+
+The Create Incident component creates a new incident in ServiceNow using the Table API.
+
+### Use Cases
+
+- **Alert escalation**: Create incidents from monitoring alerts
+- **Error tracking**: Automatically create incidents when errors are detected
+- **Manual incident creation**: Create incidents from workflow events
+- **Integration workflows**: Create incidents from external system events
+
+### Required Permissions
+
+The ServiceNow integration account needs:
+- **itil** role — grants read/write access to the Incident table
+
+### Configuration
+
+- **Short Description**: A brief summary of the incident (required, supports expressions)
+- **Description**: Detailed description of the incident (optional, supports expressions)
+- **Urgency**: Incident urgency level (1-High, 2-Medium, 3-Low)
+- **Impact**: Incident impact level (1-High, 2-Medium, 3-Low)
+- **Category**: Incident category (select from list)
+- **Subcategory**: Incident subcategory (depends on the selected category)
+- **Assignment Group**: The group responsible for resolving the incident (select from list)
+- **Assigned To**: The user assigned to resolve the incident (select from list)
+- **Caller**: The user reporting the incident (select from list)
+
+### Output
+
+Returns the created incident object from the ServiceNow Table API, including:
+- **sys_id**: Unique identifier
+- **number**: Human-readable incident number (e.g. INC0010001)
+- **state**: Current incident state
+- **short_description**: Incident summary
+- **created_on**: Creation timestamp
+
+### Example Output
+
+```json
+{
+  "data": {
+    "result": {
+      "assigned_to": {
+        "link": "https://dev12345.service-now.com/api/now/table/sys_user/681ccaf9c0a8016400b98a06818d57c7",
+        "value": "681ccaf9c0a8016400b98a06818d57c7"
+      },
+      "assignment_group": {
+        "link": "https://dev12345.service-now.com/api/now/table/sys_user_group/d625dccec0a8016700a222a0f7900d06",
+        "value": "d625dccec0a8016700a222a0f7900d06"
+      },
+      "caller_id": {
+        "link": "https://dev12345.service-now.com/api/now/table/sys_user/6816f79cc0a8016401c5a33be04be441",
+        "value": "6816f79cc0a8016401c5a33be04be441"
+      },
+      "category": "Network",
+      "description": "The production web server is not responding to requests.",
+      "impact": "2",
+      "number": "INC0010001",
+      "opened_at": "2026-01-19 12:00:00",
+      "opened_by": {
+        "link": "https://dev12345.service-now.com/api/now/table/sys_user/6816f79cc0a8016401c5a33be04be441",
+        "value": "6816f79cc0a8016401c5a33be04be441"
+      },
+      "priority": "3",
+      "short_description": "Server is unresponsive",
+      "state": "1",
+      "subcategory": "DNS",
+      "sys_created_on": "2026-01-19 12:00:00",
+      "sys_id": "a1b2c3d4e5f6g7h8i9j0",
+      "sys_updated_on": "2026-01-19 12:00:00",
+      "urgency": "2"
+    }
+  },
+  "timestamp": "2026-01-19T12:00:00Z",
+  "type": "servicenow.incident"
+}
+```
+