diff --git a/x-pack/plugins/actions/docs/openapi/bundled.json b/x-pack/plugins/actions/docs/openapi/bundled.json
index a2debc66a17a7..635c0e9484192 100644
--- a/x-pack/plugins/actions/docs/openapi/bundled.json
+++ b/x-pack/plugins/actions/docs/openapi/bundled.json
@@ -5263,6 +5263,65 @@
           }
         }
       },
+      "run_connector_subaction_closeincident": {
+        "title": "The closeIncident subaction",
+        "type": "object",
+        "required": [
+          "subAction",
+          "subActionParams"
+        ],
+        "description": "The `closeIncident` subaction for ServiceNow ITSM connectors.",
+        "properties": {
+          "subAction": {
+            "type": "string",
+            "description": "The action to test.",
+            "enum": [
+              "closeIncident"
+            ]
+          },
+          "subActionParams": {
+            "type": "object",
+            "required": [
+              "incident"
+            ],
+            "properties": {
+              "incident": {
+                "type": "object",
+                "anyOf": [
+                  {
+                    "required": [
+                      "correlation_id"
+                    ]
+                  },
+                  {
+                    "required": [
+                      "externalId"
+                    ]
+                  }
+                ],
+                "properties": {
+                  "correlation_id": {
+                    "type": [
+                      "null",
+                      "string"
+                    ],
+                    "description": "An identifier that is assigned to the incident when it is created by the connector. NOTE: If you use the default value and the rule generates multiple alerts that use the same alert IDs, the latest open incident for this correlation ID is closed unless you specify the external ID.\n",
+                    "maxLength": 100,
+                    "default": "{{rule.id}}:{{alert.id}}"
+                  },
+                  "externalId": {
+                    "type": [
+                      "null",
+                      "string"
+                    ],
+                    "description": "The unique identifier (`incidentId`) for the incident in ServiceNow."
+                  }
+                }
+              }
+            }
+          }
+        }
+      },
       "run_connector_subaction_createalert": {
         "title": "The createAlert subaction",
         "type": "object",
@@ -5834,6 +5893,9 @@
                   {
                     "$ref": "#/components/schemas/run_connector_subaction_closealert"
                   },
+                  {
+                    "$ref": "#/components/schemas/run_connector_subaction_closeincident"
+                  },
                   {
                     "$ref": "#/components/schemas/run_connector_subaction_createalert"
                   },
diff --git a/x-pack/plugins/actions/docs/openapi/bundled.yaml b/x-pack/plugins/actions/docs/openapi/bundled.yaml
index 50856a35f9399..295b9bfbb0308 100644
--- a/x-pack/plugins/actions/docs/openapi/bundled.yaml
+++ b/x-pack/plugins/actions/docs/openapi/bundled.yaml
@@ -3664,6 +3664,45 @@ components:
             user:
               type: string
               description: The display name for the owner.
+    run_connector_subaction_closeincident:
+      title: The closeIncident subaction
+      type: object
+      required:
+        - subAction
+        - subActionParams
+      description: The `closeIncident` subaction for ServiceNow ITSM connectors.
+      properties:
+        subAction:
+          type: string
+          description: The action to test.
+          enum:
+            - closeIncident
+        subActionParams:
+          type: object
+          required:
+            - incident
+          properties:
+            incident:
+              type: object
+              anyOf:
+                - required:
+                    - correlation_id
+                - required:
+                    - externalId
+              properties:
+                correlation_id:
+                  type:
+                    - 'null'
+                    - string
+                  description: |
+                    An identifier that is assigned to the incident when it is created by the connector. NOTE: If you use the default value and the rule generates multiple alerts that use the same alert IDs, the latest open incident for this correlation ID is closed unless you specify the external ID.
+                  maxLength: 100
+                  default: '{{rule.id}}:{{alert.id}}'
+                externalId:
+                  type:
+                    - 'null'
+                    - string
+                  description: The unique identifier (`incidentId`) for the incident in ServiceNow.
     run_connector_subaction_createalert:
       title: The createAlert subaction
       type: object
@@ -4062,6 +4101,7 @@ components:
               oneOf:
                 - $ref: '#/components/schemas/run_connector_subaction_addevent'
                 - $ref: '#/components/schemas/run_connector_subaction_closealert'
+                - $ref: '#/components/schemas/run_connector_subaction_closeincident'
                 - $ref: '#/components/schemas/run_connector_subaction_createalert'
                 - $ref: '#/components/schemas/run_connector_subaction_fieldsbyissuetype'
                 - $ref: '#/components/schemas/run_connector_subaction_getchoices'
diff --git a/x-pack/plugins/actions/docs/openapi/components/schemas/run_connector_request.yaml b/x-pack/plugins/actions/docs/openapi/components/schemas/run_connector_request.yaml
index 13b0623a01ab8..a3764b93a642e 100644
--- a/x-pack/plugins/actions/docs/openapi/components/schemas/run_connector_request.yaml
+++ b/x-pack/plugins/actions/docs/openapi/components/schemas/run_connector_request.yaml
@@ -16,6 +16,7 @@ properties:
         oneOf:
           - $ref: 'run_connector_subaction_addevent.yaml'
           - $ref: 'run_connector_subaction_closealert.yaml'
+          - $ref: 'run_connector_subaction_closeincident.yaml'
           - $ref: 'run_connector_subaction_createalert.yaml'
           - $ref: 'run_connector_subaction_fieldsbyissuetype.yaml'
           - $ref: 'run_connector_subaction_getchoices.yaml'
diff --git a/x-pack/plugins/actions/docs/openapi/components/schemas/run_connector_subaction_closeincident.yaml b/x-pack/plugins/actions/docs/openapi/components/schemas/run_connector_subaction_closeincident.yaml
new file mode 100644
index 0000000000000..a53c4f90b226e
--- /dev/null
+++ b/x-pack/plugins/actions/docs/openapi/components/schemas/run_connector_subaction_closeincident.yaml
@@ -0,0 +1,34 @@
+title: The closeIncident subaction
+type: object
+required:
+  - subAction
+  - subActionParams
+description: The `closeIncident` subaction for ServiceNow ITSM connectors.
+properties:
+  subAction:
+    type: string
+    description: The action to test.
+    enum:
+      - closeIncident
+  subActionParams:
+    type: object
+    required:
+      - incident
+    properties:
+      incident:
+        type: object
+        anyOf:
+          - required: [correlation_id]
+          - required: [externalId] 
+        properties:
+          correlation_id:
+            type: ['null', string]
+            description: >
+              An identifier that is assigned to the incident when it is created by the connector.
+              NOTE: If you use the default value and the rule generates multiple alerts that use the same alert IDs, the latest open incident for this correlation ID is closed unless you specify the external ID.
+            maxLength: 100
+            default: '{{rule.id}}:{{alert.id}}'
+          externalId:
+            type: ['null', string]
+            description: The unique identifier (`incidentId`) for the incident in ServiceNow.
+ 
\ No newline at end of file