Email Notifications & Templates
Notification Overview
ServiceNow notifications are automated messages sent to users when specific conditions are met on platform records. They are the primary mechanism for keeping users informed about record state changes, assignments, and important events.
What Triggers Notifications?
Notifications can be triggered by three fundamental mechanisms:
Record Insert / Update
Fires when a record is created (inserted) or modified (updated) in a specified table. The most common trigger type. You define which table and optionally which field changes matter.
Example: Send notification when an Incident is inserted with High priority, or when the State field changes to "Resolved."
Event-Based
Fires when a named platform event is queued. Business Rules or Scripts fire events using gs.eventQueue(), and a notification listens for that event name. Decouples the triggering logic from the notification.
Example: A Business Rule fires incident.assigned event; a notification listens for that event and emails the assignee.
Time-Based
Fires based on a time condition relative to a date/time field on a record — e.g., send a reminder X days before a contract expires, or escalate if an incident has been open for more than 4 hours.
Example: Email requester 2 days before SLA breach. Runs on a scheduled interval checking eligible records.
The sys_notification Table
All notification rules are stored in the sys_notification table. You can access and manage them via:
- Navigate to: System Notification > Email > Notifications
- Direct table: type
sys_notification.listin the Filter Navigator - Each record in this table defines one complete notification rule
- Notifications can be active or inactive — only active notifications fire
Three Delivery Types
| Delivery Type | Description | Use Case |
|---|---|---|
| Standard HTML or plain-text email sent to recipients via configured mail server. Most common type. | Incident assignments, approvals, SLA warnings, status updates | |
| SMS | Short text message to a user's mobile device. Requires a configured SMS provider / integration. | Critical P1 alerts, on-call pages, urgent escalations |
| Meeting Invitation | Calendar invitation (iCal format) sent to recipients. Creates a calendar event in the recipient's calendar application. | Change advisory board meetings, scheduled maintenance windows |
Notification vs. Event vs. Email Client — Key Distinctions
sys_notification that defines when to send, who receives it, and what message to deliver. It is the complete notification rule record.sysevent table using gs.eventQueue(). An event carries a name and optional parameters but has no delivery logic of its own — notifications listen for events.Notification Rule Anatomy (CRITICAL for Exam)
Understanding every field in a notification rule is essential for the CSA exam. Each field controls a distinct aspect of when, how, and to whom the notification is sent.
Core Fields
| Field | What It Controls | Example / Notes |
|---|---|---|
| Name | Descriptive label for the notification rule | Incident Assigned to User |
| Table | Which table this notification monitors. Changes to records in this table can trigger the notification. | Incident [incident] |
| Active | Whether the notification is enabled. Inactive notifications never fire. | Checkbox — must be checked for the notification to work |
| Weight | Integer priority value used for deduplication. When multiple notifications would fire for the same record/event, only the one with the highest weight is sent. Default weight is 0. | 50 — higher number = higher priority |
| Category | Groups notifications for subscription management. Users can opt out of entire categories (if the notification is subscribable). | Incident, Change, Approval |
| Subscribable | If checked, users can opt in/out via Notification Preferences. If unchecked (mandatory), users cannot unsubscribe. | Mandatory approval notifications should not be subscribable |
When to Send (Trigger Tab)
assigned_to changes, ignoring all other updates.gs.eventQueue(). Enter the event name — e.g., incident.assigned. Decouples trigger logic from notification config.Weight and Deduplication — Exam Critical
Example: Two notifications fire on Incident update — one with weight 10, one with weight 50. Only the weight-50 notification is delivered. If both have weight 0, both fire (no deduplication).
Conditions (Who Qualifies)
The Conditions section uses a filter condition builder to determine which records trigger the notification. Only records matching all conditions will generate the notification.
- Works like any standard record filter in ServiceNow
- Example:
Priority is 1 - CriticalANDState is not Resolved - If no conditions are set, the notification fires for all matching inserts/updates
- Conditions are evaluated server-side against the current record state
Who Receives — Recipients Tab
The Recipients tab is one of the most important sections for the exam. It defines exactly who gets the email. Multiple recipient types can be combined.
| Recipient Type | Description | Example |
|---|---|---|
| Users | Specific named user records. Hardcodes individual users as always receiving this notification. | Always notify the IT manager: John Smith |
| Groups | All members of a specified group receive the notification. Dynamic — group membership changes apply automatically. | Notify all members of Service Desk group |
| Roles | All users with a specified role. Broader than groups — any user with that role on the instance receives it. | All users with itil_manager role |
| Field values (record fields) | Dynamic recipient pulled from a reference field on the triggering record. The user in that field gets notified. Most flexible and most common for record-specific notifications. | Opened by, Assigned to, Watch list |
Send Condition
Advanced Tab: Subject, Message, Devices
- Subject: The email subject line. Supports
${field_name}variable substitution for dynamic content. - Message (HTML): The body of the email. Full HTML is supported. Can reference an Email Template or contain inline content with variable substitution.
- Message (Text): Plain-text fallback for email clients that do not render HTML.
- Device: The delivery channel — Email, SMS, or Meeting Invitation. Defaults to Email.
- Content type: HTML or plain text message format.
Email Templates
Email Templates allow you to create reusable HTML message bodies and subject lines that multiple notification rules can reference, maintaining consistency across communications and avoiding duplication.
- Stored in the
sys_email_templatetable - Navigate to: System Notification > Email > Templates
- A template defines reusable Subject and Message content
- Notification rules can reference a template, inheriting its content
- Individual notifications can override template content if needed
Variable Substitution Syntax
Both templates and inline notification messages support dynamic variable insertion using a dollar-sign bracket syntax. Variables are resolved at send time against the triggering record.
| Syntax | What It Inserts | Example |
|---|---|---|
${field_name} |
The value of a field on the triggering record itself. | ${number} → INC0001234 |
${table.field} |
A field from a related (dot-walked) record via a reference field. Traverses the relationship at send time. | ${caller_id.email} → the caller's email address${assignment_group.name} → group name |
${URI} |
The full URL to the record on the instance. Inserts a clickable link to open the record directly. | Generates: https://instance.service-now.com/nav_to.do?uri=incident.do?sys_id=... |
${URI_REF} |
An HTML anchor tag wrapping the record number as a clickable link. More user-friendly than raw URI. | Renders as: INC0001234 |
$[link] |
Inserts a formatted hyperlink to the record. Common shorthand for generating a "View Record" link in the email body. | Renders as a "Click here to view the record" style link |
${field_name}— inserts a field value from the current (triggering) record${table.field}— dot-walk to related record field (e.g.,${caller_id.name})$[link]— inserts the record URL as a clickable hyperlink${subject}— inserts the value of the subject field within the message body
${...} (field value) and $[...] (link/URL syntax).
Template Example Structure
<!-- Subject line -->
[${number}] Your incident has been updated: ${short_description}
<!-- Message HTML body -->
<p>Dear ${caller_id.first_name},</p>
<p>Your incident <strong>${number}</strong> has been updated.</p>
<table>
<tr><td><strong>State:</strong></td><td>${state}</td></tr>
<tr><td><strong>Assigned To:</strong></td><td>${assigned_to.name}</td></tr>
<tr><td><strong>Priority:</strong></td><td>${priority}</td></tr>
</table>
<p>$[link]</p>
<p>Thank you,<br>IT Service Desk</p>
Shared Templates vs. Notification-Specific Content
sys_email_template that multiple notification rules reference. Changes to the template propagate to all notifications using it. Best for consistent corporate branding or standard message structures used across many notifications.Notification Subscriptions
ServiceNow gives users control over which notifications they receive through a Notification Preferences system. Administrators control which notifications can be opted out of and which are mandatory.
How Users Manage Preferences
- Users access preferences via: Profile icon > Notification Preferences (or System Settings > Notifications)
- The preferences UI shows all subscribable notification categories and individual notifications
- Users can opt in or opt out per notification, per category, and per device type (email vs. SMS)
- Admin-set mandatory notifications do not appear in the opt-out list — users cannot disable them
Mandatory vs. Subscribable Notifications
| Type | Subscribable Checkbox | User Can Opt Out? | Typical Use Case |
|---|---|---|---|
| Mandatory | Unchecked (not subscribable) | No — always sent | Security alerts, compliance notifications, approval requests |
| Subscribable | Checked | Yes — user may opt out | Status updates, informational digests, non-critical updates |
Notification Categories and Devices
- Categories group related notifications together (e.g., all "Incident" notifications in one category). Users can enable/disable an entire category at once.
- Devices represent delivery channels. A single notification can have preferences managed per device — a user may want Incident email alerts but not SMS alerts for the same event.
- Categories are configured on notification records and help users navigate their preferences UI.
sys_notif_subscription Table
User subscription preferences are stored in the sys_notif_subscription table. Each record represents a user's explicit opt-in or opt-out choice for a specific notification.
- Navigate to:
sys_notif_subscription.listin the Filter Navigator - Contains: User, Notification, Device, Subscribed (yes/no)
- Administrators can view and manage subscriptions for users from this table
- If no subscription record exists for a user, the notification's default behavior (send or don't send) applies
Email Digest vs. Immediate Delivery
Events
Events are a core part of the ServiceNow automation architecture. They decouple the action that triggers something from the action that responds to it, enabling clean separation of concerns and reusable event-driven logic.
The Event Pattern
gs.eventQueue(). The event is written to the Event Queue (sysevent table). A background processor reads the queue and executes any registered handlers — including sending notifications that are configured to listen for that event name.
This pattern means: the notification definition does not need to contain any complex trigger logic. The complexity lives in the Business Rule; the notification simply declares "send me when event X fires."
gs.eventQueue() — The Event Firing Method
// Signature:
gs.eventQueue(eventName, record, param1, param2);
// Example: fire an event when an incident is assigned
// Typically called from a Business Rule (After, on update)
gs.eventQueue('incident.assigned', current, current.assigned_to, current.assignment_group);
// eventName — string matching a registered event in the Event Registry
// record — the GlideRecord context (current, previous, etc.)
// param1 — optional parameter 1 (max 256 chars), accessible in notification as ${event.parm1}
// param2 — optional parameter 2 (max 256 chars), accessible in notification as ${event.parm2}
gs.eventQueue() takes the event name as its first argument. The event name must match a registered event in the Event Registry. Know the method signature and the fact that it is asynchronous — the event is queued, not executed inline.
Event Registry (sysevent_register)
- The Event Registry (
sysevent_registertable) contains all defined/registered event names on the instance - Navigate to: System Policy > Events > Registry
- Before you can fire an event, it should be registered here (though it will still queue even if unregistered)
- Each registration record includes: Event Name, Table, Description, fired by (which system component)
- Best practice: always register custom events before using them in scripts
Event Log (sysevent)
- The Event Log (
syseventtable) is the actual queue of fired events - Navigate to: System Policy > Events > Event Log or
sysevent.list - Each row represents one queued event instance, with columns for: Event Name, Table, Record sys_id, Param1, Param2, State (ready, processed, error), Processing time
- The event processor runs periodically and changes State from "ready" to "processed"
- Invaluable for debugging: if a notification is not firing, check the Event Log to verify the event was actually queued and processed
Business Rule → Event → Notification Pattern (Exam Scenario)
| Step | Component | Action |
|---|---|---|
| 1 | User saves a record | Incident is updated; assigned_to field changes |
| 2 | Business Rule (After, Update) | Detects assigned_to changed, calls gs.eventQueue('incident.assigned', current, ...) |
| 3 | Event Log (sysevent) | Event record created with name incident.assigned, state = ready |
| 4 | Event Processor (background job) | Reads the event queue, finds the incident.assigned event, triggers registered handlers |
| 5 | Notification rule | Notification configured with "When: Event fired = incident.assigned" matches and queues the email |
| 6 | Email sent | Assignee receives email notification about their new incident assignment |
Inbound Email Actions
Inbound Email Actions allow ServiceNow to automatically process incoming emails and take actions on records — creating new records, updating existing ones, or running scripts based on email content.
- Stored in the
sys_email_inbound_actiontable - Navigate to: System Notification > Inbound Actions
- ServiceNow's mail server receives incoming email, which is then matched against inbound action rules
- Multiple inbound actions can be defined; they are evaluated in order by the Order field
- An inbound action can stop processing further rules once matched (like a catch-all)
Inbound Action Anatomy
| Field | Description | Example |
|---|---|---|
| Name | Descriptive name for the inbound action rule | Create Incident from Email |
| Active | Whether the rule is enabled | Must be checked to process emails |
| Order | Integer execution order. Lower numbers run first. First matching rule wins (by default). | 100 |
| Type | Reply (match email to existing record by correlation ID) or New (always create a new record) | Reply or New record |
| Target table | The table on which to create or update records | Incident [incident] |
| Conditions | Filter conditions on the email itself (e.g., subject contains a keyword, from a specific domain). Determines if this rule applies to the incoming email. | Subject contains "URGENT" |
| Action script | Server-side script executed when the rule matches. Has access to current (the target record), email (the incoming email object), and email_action. |
Set fields, call APIs, create related records |
Reply Separators
When a user replies to a notification email, ServiceNow must extract the new content from the reply and ignore the quoted original message. Reply separators define the delimiter between new and quoted content.
- Navigate to: System Notification > Inbound Actions > Reply Separators
- Default separator patterns match common email client quotation markers (e.g.,
--- Reply above this line ---) - Only the text above the separator is processed as new content and added to the record
- Custom separators can be added to handle non-standard email clients or formats
Email-to-Record Correlation
Common Inbound Action Use Cases
Email-to-Incident
An email to support@company.com automatically creates an Incident record. Subject becomes short_description; body becomes description. Caller is matched by sender email address.
Reply Updates Work Notes
A technician's email reply to a notification email adds a work note to the incident. Uses reply separator to extract only the new content.
Auto-close via Email
If a user replies "Resolved" or "Close ticket", an inbound action script can change the incident state to Resolved automatically.
Key Exam Facts & Common Traps
This section consolidates the highest-frequency exam points on notifications and templates. Review these carefully before exam day.
${field_name}— inserts the value of a field on the triggering record${table.field}— dot-walk syntax to traverse a reference field (e.g.,${caller_id.name})$[link]— inserts the record's URL as a clickable link (note: square brackets, not curly)${subject}— inserts the subject line content within the message body
${...} (field value) with $[...] (link / special variable).
gs.eventQueue(). Simply having the notification configured to listen for an event does nothing unless something actually fires that event. The Business Rule or script is the initiating component.
sys_notification— the notification rule (when, who, what trigger)sys_email_template— the reusable message template (subject and body HTML)sysevent— the event log / queue of fired eventssysevent_register— the event registry (registered event names)sys_notif_subscription— user subscription preferencessys_email_inbound_action— inbound email action rules
- Verify the notification rule is Active
- Check that the trigger condition actually fired (is the record matching the "When to send" and "Conditions"?)
- For event-triggered: check the Event Log (
sysevent.list) — was the event queued? Was it processed? - Check the Email Log (System Mailboxes > Outbound > Sent) to see if the email was generated but possibly filtered or bounced
- Verify the recipient actually has a valid email address in their user record
- Check if the user has opted out (if the notification is subscribable) in
sys_notif_subscription.list
Quick Reference — All Key Tables
| Table Name | Navigator Path | Contains |
|---|---|---|
sys_notification |
System Notification > Email > Notifications | All notification rules (when, who, what) |
sys_email_template |
System Notification > Email > Templates | Reusable email subject and body templates |
sysevent |
System Policy > Events > Event Log | Queue of fired event instances |
sysevent_register |
System Policy > Events > Registry | Registered event name definitions |
sys_notif_subscription |
sys_notif_subscription.list | User opt-in/opt-out subscription records |
sys_email_inbound_action |
System Notification > Inbound Actions | Rules for processing incoming emails |
- Trigger fires — record insert/update matches notification rule, or event is queued
- Conditions evaluated — does the record match all filter conditions?
- Weight deduplication — if multiple notifications match, highest weight wins per recipient
- Recipients resolved — users, groups, roles, and field-value recipients are expanded to a list of users
- Subscription check — mandatory notifications go to all; subscribable notifications skip users who opted out
- Template/message rendered — variable substitution resolves
${...}and$[...]placeholders - Email queued and sent — message enters the outbound mail queue and is delivered