[8.12] [OAS] Add closeIncident subaction for run connector API (#175267…

…) (#175355)

# Backport

This will backport the following commits from `main` to `8.12`:
- [[OAS] Add closeIncident subaction for run connector API
(#175267)](#175267)

<!--- Backport version: 9.4.3 -->

### Questions ?
Please refer to the [Backport tool
documentation](https://github.com/sqren/backport)

<!--BACKPORT [{"author":{"name":"Lisa
Cawley","email":"lcawley@elastic.co"},"sourceCommit":{"committedDate":"2024-01-23T22:12:24Z","message":"[OAS]
Add closeIncident subaction for run connector API
(#175267)","sha":"67db684deb1acc4930ce4ce3deba3d7db56522e0","branchLabelMapping":{"^v8.13.0$":"main","^v(\\d+).(\\d+).\\d+$":"$1.$2"}},"sourcePullRequest":{"labels":["release_note:skip","Feature:Actions","Team:ResponseOps","docs","v8.12.1","v8.13.0"],"title":"[OAS]
Add closeIncident subaction for run connector
API","number":175267,"url":"https://github.com/elastic/kibana/pull/175267","mergeCommit":{"message":"[OAS]
Add closeIncident subaction for run connector API
(#175267)","sha":"67db684deb1acc4930ce4ce3deba3d7db56522e0"}},"sourceBranch":"main","suggestedTargetBranches":["8.12"],"targetPullRequestStates":[{"branch":"8.12","label":"v8.12.1","branchLabelMappingKey":"^v(\\d+).(\\d+).\\d+$","isSourceBranch":false,"state":"NOT_CREATED"},{"branch":"main","label":"v8.13.0","branchLabelMappingKey":"^v8.13.0$","isSourceBranch":true,"state":"MERGED","url":"https://github.com/elastic/kibana/pull/175267","number":175267,"mergeCommit":{"message":"[OAS]
Add closeIncident subaction for run connector API
(#175267)","sha":"67db684deb1acc4930ce4ce3deba3d7db56522e0"}}]}]
BACKPORT-->

Co-authored-by: Lisa Cawley <lcawley@elastic.co>

x-pack/plugins/actions/docs/openapi/bundled.json

@@ -5263,6 +5263,65 @@
           }
         }
       },
+      "run_connector_subaction_closeincident": {
+        "title": "The closeIncident subaction",
+        "type": "object",
+        "required": [
+          "subAction",
+          "subActionParams"
+        ],
+        "description": "The `closeIncident` subaction for ServiceNow ITSM connectors.",
+        "properties": {
+          "subAction": {
+            "type": "string",
+            "description": "The action to test.",
+            "enum": [
+              "closeIncident"
+            ]
+          },
+          "subActionParams": {
+            "type": "object",
+            "required": [
+              "incident"
+            ],
+            "properties": {
+              "incident": {
+                "type": "object",
+                "anyOf": [
+                  {
+                    "required": [
+                      "correlation_id"
+                    ]
+                  },
+                  {
+                    "required": [
+                      "externalId"
+                    ]
+                  }
+                ],
+                "properties": {
+                  "correlation_id": {
+                    "type": [
+                      "null",
+                      "string"
+                    ],
+                    "description": "An identifier that is assigned to the incident when it is created by the connector. NOTE: If you use the default value and the rule generates multiple alerts that use the same alert IDs, the latest open incident for this correlation ID is closed unless you specify the external ID.\n",
+                    "maxLength": 100,
+                    "default": "{{rule.id}}:{{alert.id}}"
+                  },
+                  "externalId": {
+                    "type": [
+                      "null",
+                      "string"
+                    ],
+                    "description": "The unique identifier (`incidentId`) for the incident in ServiceNow."
+                  }
+                }
+              }
+            }
+          }
+        }
+      },
       "run_connector_subaction_createalert": {
         "title": "The createAlert subaction",
         "type": "object",
@@ -5834,6 +5893,9 @@
                   {
                     "$ref": "#/components/schemas/run_connector_subaction_closealert"
                   },
+                  {
+                    "$ref": "#/components/schemas/run_connector_subaction_closeincident"
+                  },
                   {
                     "$ref": "#/components/schemas/run_connector_subaction_createalert"
                   },

x-pack/plugins/actions/docs/openapi/bundled.yaml

@@ -3664,6 +3664,45 @@ components:
             user:
               type: string
               description: The display name for the owner.
+    run_connector_subaction_closeincident:
+      title: The closeIncident subaction
+      type: object
+      required:
+        - subAction
+        - subActionParams
+      description: The `closeIncident` subaction for ServiceNow ITSM connectors.
+      properties:
+        subAction:
+          type: string
+          description: The action to test.
+          enum:
+            - closeIncident
+        subActionParams:
+          type: object
+          required:
+            - incident
+          properties:
+            incident:
+              type: object
+              anyOf:
+                - required:
+                    - correlation_id
+                - required:
+                    - externalId
+              properties:
+                correlation_id:
+                  type:
+                    - 'null'
+                    - string
+                  description: |
+                    An identifier that is assigned to the incident when it is created by the connector. NOTE: If you use the default value and the rule generates multiple alerts that use the same alert IDs, the latest open incident for this correlation ID is closed unless you specify the external ID.
+                  maxLength: 100
+                  default: '{{rule.id}}:{{alert.id}}'
+                externalId:
+                  type:
+                    - 'null'
+                    - string
+                  description: The unique identifier (`incidentId`) for the incident in ServiceNow.
     run_connector_subaction_createalert:
       title: The createAlert subaction
       type: object
@@ -4062,6 +4101,7 @@ components:
               oneOf:
                 - $ref: '#/components/schemas/run_connector_subaction_addevent'
                 - $ref: '#/components/schemas/run_connector_subaction_closealert'
+                - $ref: '#/components/schemas/run_connector_subaction_closeincident'
                 - $ref: '#/components/schemas/run_connector_subaction_createalert'
                 - $ref: '#/components/schemas/run_connector_subaction_fieldsbyissuetype'
                 - $ref: '#/components/schemas/run_connector_subaction_getchoices'

x-pack/plugins/actions/docs/openapi/components/schemas/run_connector_request.yaml

@@ -16,6 +16,7 @@ properties:
         oneOf:
           - $ref: 'run_connector_subaction_addevent.yaml'
           - $ref: 'run_connector_subaction_closealert.yaml'
+          - $ref: 'run_connector_subaction_closeincident.yaml'
           - $ref: 'run_connector_subaction_createalert.yaml'
           - $ref: 'run_connector_subaction_fieldsbyissuetype.yaml'
           - $ref: 'run_connector_subaction_getchoices.yaml'

x-pack/plugins/actions/docs/openapi/components/schemas/run_connector_subaction_closeincident.yaml

@@ -0,0 +1,34 @@
+title: The closeIncident subaction
+type: object
+required:
+  - subAction
+  - subActionParams
+description: The `closeIncident` subaction for ServiceNow ITSM connectors.
+properties:
+  subAction:
+    type: string
+    description: The action to test.
+    enum:
+      - closeIncident
+  subActionParams:
+    type: object
+    required:
+      - incident
+    properties:
+      incident:
+        type: object
+        anyOf:
+          - required: [correlation_id]
+          - required: [externalId] 
+        properties:
+          correlation_id:
+            type: ['null', string]
+            description: >
+              An identifier that is assigned to the incident when it is created by the connector.
+              NOTE: If you use the default value and the rule generates multiple alerts that use the same alert IDs, the latest open incident for this correlation ID is closed unless you specify the external ID.
+            maxLength: 100
+            default: '{{rule.id}}:{{alert.id}}'
+          externalId:
+            type: ['null', string]
+            description: The unique identifier (`incidentId`) for the incident in ServiceNow.
+