Help Needed: Inbound Email Action to Close Incident via Email Reply

[ShariqhM]

Hi ServiceNow Community,

I’m working on an Inbound Email Action that should automatically close an incident when a user replies to an email with a subject containing the pattern:

For example: CLOSE INC0010001

I’ve written a script that extracts the incident number from the subject and attempts to close the incident. However, I’m ensuring that mandatory fields like caller_id and short_description are present before closing the record.

Despite this setup, the action doesn’t seem to be working as expected. I’ve verified the subject format and checked the logs, but I’m not seeing any updates to the incident.

Could someone please help me:

• Validate the script logic.
• Suggest improvements or best practices.
• Confirm if there are any known limitations with using reply subjects in inbound actions.

Any guidance or examples would be greatly appreciated!

Thanks in advance.

[Rafael Batistot]

Hi @ShariqhM 

May you try this Script

 // 1. Extract subject
    var subj = email.subject.toUpperCase().trim();

    // 2. Regex to capture incident number in subject like: CLOSE INC0010001
    var match = subj.match(/CLOSE\s+(INC\d{7})/);

    if (!match) {
        gs.log("Inbound Close Incident: No valid incident number found in subject: " + subj);
        action.setAbortAction(true);
        return;
    }

    var incNumber = match[1]; // e.g. "INC0010001"
    gs.log("Inbound Close Incident: Found " + incNumber);

    // 3. Find Incident
    var gr = new GlideRecord('incident');
    gr.addQuery('number', incNumber);
    gr.query();

    if (!gr.next()) {
        gs.log("Inbound Close Incident: Incident " + incNumber + " not found.");
        action.setAbortAction(true);
        return;
    }

    // 4. Validate mandatory fields (caller, short_description)
    if (gs.nil(gr.caller_id) || gs.nil(gr.short_description)) {
        gs.log("Inbound Close Incident: Mandatory fields missing on " + incNumber);
        action.setAbortAction(true);
        return;
    }

    // 5. Close the Incident
    gr.state = 7;  // Closed
    gr.close_code = "Closed/Resolved by Caller";
    gr.close_notes = "Closed automatically via email reply.";
    gr.update();

[GlideFather · Accepted solution]

Hi @ShariqhM,

from ITIL perspective this isn't considered a good practice... Incident shall be first resolved and then closed.

Are you sure you want to enable the closure and by email?