ServiceNow scripting commonly uses JavaScript, but the execution context determines which APIs and data are available. A client script runs in the browser and can respond to form events. A server script runs in the platform's server context. Don't copy a client API into a server rule and expect it to work.
Use supported platform interfaces and scoped APIs for integrations. Validate untrusted input, handle missing references, and use service identities with the access they need. Hardcoding a broad administrator account into an integration hides responsibility and increases the impact of a mistake. Test empty responses, duplicate deliveries, and failures as well as the happy path. A script that works once with one record can still fail during a recurring import or retried webhook.