subcategory on the incident table does get populated using Rest API
When using the command curl "https://*******.service-now.com/api/now/table/incident" --request POST --header "Accept:application/json" --header "Content-Type:application/json" --data "{\"category\":\"Security\",\"assignment_group\":\"b41d506f93464a54...