We've been rolling out BeyondTrust for privileged access management, and the technical side is solid. However, our security team's requirement for approval workflows is hitting a snag. The team doesn't want to use the BeyondTrust console for approvals; they insist on having requests flow into and be approved from our existing ServiceNow ticketing system.
I'm looking for battle-tested patterns from others who've integrated these approval workflows with an external system. The goal is a seamless user experience: request is made in BeyondTrust, a ticket is created, approval/rejection happens in ServiceNow, and the status syncs back.
From my initial exploration, I see a few potential paths:
* Using BeyondTrust's Workflow Webhooks to trigger an automation (like an Azure Logic App or AWS Step Function) that creates/updates the ticket.
* Leveraging the REST APIs of both systems in a custom middleware service, perhaps running in a container.
* Utilizing the ServiceNow IntegrationHub, if pre-built spokes exist.
The specific hurdles I'm trying to navigate:
* Handling idempotency – ensuring duplicate tickets aren't created if webhooks fire twice.
* Mapping BeyondTrust request contexts (like target system, account, duration) into meaningful ServiceNow ticket fields.
* Securely passing the approval decision and any comments back from ServiceNow to BeyondTrust to trigger the actual access grant or denial.
Has anyone built this bridge successfully? I'm particularly interested in the architectural decisions and any gotchas around error handling and state synchronization. A snippet of how you structured the payloads or configured the webhook step would be incredibly helpful.