A ServiceNow developer is integrating with an external system using a REST message. The external system requires a custom header 'X-API-Key' to be included in every request. Where should the developer configure this header to ensure it is automatically included in all REST messages that call this endpoint?
Correct: Custom headers are defined here and automatically included in every request.
Why this answer
The 'HTTP Headers' tab in a REST message definition allows you to define custom headers that are automatically included in every request sent to that endpoint. This is the standard location for headers like 'X-API-Key' that must accompany all calls, as they are part of the HTTP request metadata, not query parameters or authentication credentials.
How to eliminate wrong answers
Option A is wrong because the 'Query Parameters' tab is for URL query string parameters (e.g., ?key=value), not HTTP headers; placing a header there would result in it being appended to the URL rather than sent as a header, causing the external system to reject the request. Option C is wrong because an 'Authentication Profile' is used for standard authentication methods (e.g., Basic Auth, OAuth) and is not designed to inject arbitrary custom headers; it would not include the 'X-API-Key' header unless the profile specifically supports custom header injection, which is not its intended purpose. Option D is wrong because a Scripted REST API defines the server-side endpoint that receives requests, not the client-side configuration for outbound REST messages; the developer is configuring the outbound call, not the endpoint itself.