<h2>CMDB Instance API returns INVALID_INPUT_DATA ("No record with sys_id... or is a duplicate") when a user updates a CI outside their session domain</h2><br/><div style="overflow-x:auto"><article><div ><h2 >Issue </h2><section><style type="text/css"><!-- /*NS Branding Styles*/ --> .ns-kb-css-body-editor-container { p { font-size: 12pt; font-family: Lato; color: var(--now-color--text-primary, #000000); } span { font-size: 12pt; font-family: Lato; color: var(--now-color--text-primary, #000000); } h2 { font-size: 24pt; font-family: Lato; color: var(--now-color--text-primary, black); } h3 { font-size: 18pt; font-family: Lato; color: var(--now-color--text-primary, black); } h4 { font-size: 14pt; font-family: Lato; color: var(--now-color--text-primary, black); } a { font-size: 12pt; font-family: Lato; color: var(--now-color--link-primary, #00718F); } a:hover { font-size: 12pt; color: var(--now-color--link-primary, #024F69); } a:target { font-size: 12pt; color: var(--now-color--link-primary, #032D42); } a:visited { font-size: 12pt; color: var(--now-color--link-primary, #00718f); } ul { font-size: 12pt; font-family: Lato; } li { font-size: 12pt; font-family: Lato; } img { display: ; max-width: ; width: ; height: ; } } </style> <div class="ns-kb-css-body-editor-container"> <p style="padding-left: 40px;">On a domain-separated instance, updating a CI attribute via the CMDB Instance API fails with INVALID_INPUT_DATA for users whose session domain does not exactly match the CI's sys_domain — even though the CI's sys_id is valid, is not a duplicate, and the user has full ACL/role access to the field. The identification engine performs its own strict domain match on this API and ignores standard sys_user_visibility grants unless a specific property is enabled.</p> <span id="ns-kb-css-end-div-identifier" style="display: none; pointer-events: none;"></span></div></section></div><div ><h2 >Symptoms</h2><section><style type="text/css"><!-- /*NS Branding Styles*/ --> .ns-kb-css-body-editor-container { p { font-size: 12pt; font-family: Lato; color: var(--now-color--text-primary, #000000); } span { font-size: 12pt; font-family: Lato; color: var(--now-color--text-primary, #000000); } h2 { font-size: 24pt; font-family: Lato; color: var(--now-color--text-primary, black); } h3 { font-size: 18pt; font-family: Lato; color: var(--now-color--text-primary, black); } h4 { font-size: 14pt; font-family: Lato; color: var(--now-color--text-primary, black); } a { font-size: 12pt; font-family: Lato; color: var(--now-color--link-primary, #00718F); } a:hover { font-size: 12pt; color: var(--now-color--link-primary, #024F69); } a:target { font-size: 12pt; color: var(--now-color--link-primary, #032D42); } a:visited { font-size: 12pt; color: var(--now-color--link-primary, #00718f); } ul { font-size: 12pt; font-family: Lato; } li { font-size: 12pt; font-family: Lato; } img { display: ; max-width: ; width: ; height: ; } } </style> <div class="ns-kb-css-body-editor-container"> <ul style="list-style-position: inside;"><li>A PATCH/PUT to the CMDB Instance API fails with INVALID_INPUT_DATA: "No record with sys_id [x] exist in table [y] or is a duplicate record with [duplicate_of] field set to a master CI."</li><li>GET on the same sys_id/endpoint succeeds — only the update fails.</li><li>The identical request succeeds for an admin/high-privilege user (or via REST API Explorer under an elevated session) but fails for the actual end user.</li><li>The target CI is confirmed valid: the sys_id exists, is not reclassified, and duplicate_of is empty.</li><li>Access Analyzer confirms the acting user has read/write/execute/modify on the field via role and ACL — permissions are not the issue.</li><li>The instance has Domain Separation configured, and the acting user's session domain differs from the CI's sys_domain (e.g., the CI is in global, the user's domain is a separate top-level domain that is not a descendant of global).</li></ul> <span id="ns-kb-css-end-div-identifier" style="display: none; pointer-events: none;"></span></div></section></div><div ><h2 >Release</h2><section><style type="text/css"><!-- /*NS Branding Styles*/ --> .ns-kb-css-body-editor-container { p { font-size: 12pt; font-family: Lato; color: var(--now-color--text-primary, #000000); } span { font-size: 12pt; font-family: Lato; color: var(--now-color--text-primary, #000000); } h2 { font-size: 24pt; font-family: Lato; color: var(--now-color--text-primary, black); } h3 { font-size: 18pt; font-family: Lato; color: var(--now-color--text-primary, black); } h4 { font-size: 14pt; font-family: Lato; color: var(--now-color--text-primary, black); } a { font-size: 12pt; font-family: Lato; color: var(--now-color--link-primary, #00718F); } a:hover { font-size: 12pt; color: var(--now-color--link-primary, #024F69); } a:target { font-size: 12pt; color: var(--now-color--link-primary, #032D42); } a:visited { font-size: 12pt; color: var(--now-color--link-primary, #00718f); } ul { font-size: 12pt; font-family: Lato; } li { font-size: 12pt; font-family: Lato; } img { display: ; max-width: ; width: ; height: ; } } </style> <div class="ns-kb-css-body-editor-container"> <p style="padding-left: 40px;">Any release</p> <span id="ns-kb-css-end-div-identifier" style="display: none; pointer-events: none;"></span></div></section></div><div ><h2 >Cause</h2><section><style type="text/css"><!-- /*NS Branding Styles*/ --> .ns-kb-css-body-editor-container { p { font-size: 12pt; font-family: Lato; color: var(--now-color--text-primary, #000000); } span { font-size: 12pt; font-family: Lato; color: var(--now-color--text-primary, #000000); } h2 { font-size: 24pt; font-family: Lato; color: var(--now-color--text-primary, black); } h3 { font-size: 18pt; font-family: Lato; color: var(--now-color--text-primary, black); } h4 { font-size: 14pt; font-family: Lato; color: var(--now-color--text-primary, black); } a { font-size: 12pt; font-family: Lato; color: var(--now-color--link-primary, #00718F); } a:hover { font-size: 12pt; color: var(--now-color--link-primary, #024F69); } a:target { font-size: 12pt; color: var(--now-color--link-primary, #032D42); } a:visited { font-size: 12pt; color: var(--now-color--link-primary, #00718f); } ul { font-size: 12pt; font-family: Lato; } li { font-size: 12pt; font-family: Lato; } img { display: ; max-width: ; width: ; height: ; } } </style> <div class="ns-kb-css-body-editor-container"> <ul style="list-style-position: inside;"><li>The CMDB Instance API's identification engine performs its own sys_id/domain validation, which is separate from the platform's standard ACL/domain-visibility model.</li><li>By default — glide.identification_engine.platform_domain_separation_enabled is false, or the property doesn't exist (same effective behaviour as false) — the identification engine disables the platform's normal domain-visibility logic (self + descendant domains + sys_user_visibility/sys_user_group_visibility grants) and instead requires an exact match between the session's own domain and the CI's sys_domain.</li></ul> <span id="ns-kb-css-end-div-identifier" style="display: none; pointer-events: none;"></span></div></section></div><div ><h2 >Resolution</h2><section><style type="text/css"><!-- /*NS Branding Styles*/ --> .ns-kb-css-body-editor-container { p { font-size: 12pt; font-family: Lato; color: var(--now-color--text-primary, #000000); } span { font-size: 12pt; font-family: Lato; color: var(--now-color--text-primary, #000000); } h2 { font-size: 24pt; font-family: Lato; color: var(--now-color--text-primary, black); } h3 { font-size: 18pt; font-family: Lato; color: var(--now-color--text-primary, black); } h4 { font-size: 14pt; font-family: Lato; color: var(--now-color--text-primary, black); } a { font-size: 12pt; font-family: Lato; color: var(--now-color--link-primary, #00718F); } a:hover { font-size: 12pt; color: var(--now-color--link-primary, #024F69); } a:target { font-size: 12pt; color: var(--now-color--link-primary, #032D42); } a:visited { font-size: 12pt; color: var(--now-color--link-primary, #00718f); } ul { font-size: 12pt; font-family: Lato; } li { font-size: 12pt; font-family: Lato; } img { display: ; max-width: ; width: ; height: ; } } </style> <div class="ns-kb-css-body-editor-container"> <ol style="list-style-position: inside;"><li>Compare the CI's sys_domain to the acting user's domain (sys_user.domain). If they differ and are not in a parent/descendant relationship, this is the likely cause.</li><li>Add the user/user group to sys_user_visibility/sys_user_group_visibility and mention the domain on which you want to have visibility.</li><li>Create or update the sys_properties record:<br /> - Name: glide.identification_engine.platform_domain_separation_enabled<br /> - Type: true|false<br /> - Value: true</li><li>This makes the identification engine defer to the platform's standard domain-visibility logic instead of its own strict match — so an existing (or newly added) sys_user_visibility grant for the user into the CI's domain will now be honoured.</li><li>Re-test the update for the affected user.<br /><br /><strong>Note:</strong><br />This property is engine-wide. Enabling it changes domain-checking behaviour for all CMDB Instance API / identification-engine operations on the instance, not just the reported CI/user. Recommend routing through the change process rather than treating it as a narrow point fix, and reviewing the broader domain-separation design impact before enabling.<br /><br />Adding a sys_user_visibility grant by itself, without this property set to true, does not resolve the issue.</li></ol> <span id="ns-kb-css-end-div-identifier" style="display: none; pointer-events: none;"></span></div></section></div></article></div>