Slack

Create one Slack app per Team Server, then integrations for each audience. Integrations can share app credentials and target different workspaces.

App and Integration Model

The app holds permissions, OAuth callback, Client ID, and Client Secret. Each integration selects one workspace, channels, notification options, pipelines, and deployments.

Prerequisites

Operator or Administrator access to Team Server and permission to create/install a Slack app
Public HTTPS settings.tenant.base_url
Outbound access to slack.com:443 and configured workers, preferably BackgroundAsync
A pipeline or deployment reporting violations

Slack requires this exact OAuth callback, derived from the tenant URL:

{base_url}/api/integrations/slack/callback

Required Slack Permissions

Team Server generates these bot scopes:

Scope	Purpose
`channels:read`	List public channels
`groups:read`	List private channels containing the app
`chat:write`	Post to joined channels
`chat:write.public`	Post to public channels without joining

No channels:join is needed. Keep organization-wide deployment, Socket Mode, and token rotation disabled. Team Server receives no Slack events and cannot refresh rotating tokens.

Create and Install the App

1. Generate the App

Open Integrations > Notify > Slack, select Get Started or Create, then Create app in Slack. Review the definition and select Create.

The generated app and bot are named Endura Security. An existing app can reuse its credentials and retains its displayed name.

2. Enter Credentials

Copy Client ID and Client Secret from Slack’s Basic Information. Enter them with a unique integration name in Team Server and select Continue.

Credentials are stored per integration, not in production.yaml or SLACK_* variables.

3. Install into a Workspace

Select Add to Slack, choose a workspace, and Allow permissions. Confirm the workspace and Active status in Team Server. If approval is required, repeat installation after approval.

The workspace cannot be changed later. If it is wrong, create a replacement integration; channel IDs are workspace-specific.

Configure Alerts

Select Channels

Select destinations and save. Public channels are listed automatically. For private channels, invite @Endura Security (or the existing bot’s displayed name), reload the integration, then select the channel.

Removing the bot from a private channel stops its alerts without changing Active status. No selected channels mutes delivery.

Choose Outcomes and Mentions

Option	Default
Post an alert when a violation is detected	On
Also alert on observed violations	Off
Mention `@here` on every alert	Off

Enable observed outcomes while tuning an observe-mode policy. Use @here for channels whose online members need every alert.

Scope Pipelines and Deployments

New integrations select All Pipelines and All Deployments. Narrow scope before sending to busy channels. See scope and delivery rules.

Test and Verify

Test Channel Connectivity

Select channels and Test. The test uses current selections, including unsaved changes. It confirms posting, not scope, outcome options, notification enablement, or workers. Authentication failure can mark the integration Inactive.

Test End-to-End Delivery

Confirm Active status, enable notifications, and save channels and scope.
Run an in-scope build with a controlled violation; enable observed outcomes for observe mode.
Confirm the grouped alert and its run link. Later batches can produce more alerts.

Route Alerts to Audiences

Use separate integrations for different audiences, such as all resources in #security-alerts, selected payment pipelines in #payments-oncall, or all deployments in #sre-prod. Overlapping integrations both post; narrow scope, channels, and observed outcomes to reduce noise.

Edit or Delete an Integration

Edit the name, channels, options, and scope in place. Changing app credentials or workspace requires a replacement integration.

Deletion attempts bot-token revocation, then removes the record even if revocation fails. Record channels and scope first.

Integrations sharing one app installation may share its bot authorization. Deleting one can revoke the others’ access; test and replace affected integrations.

Revocation deactivates the bot and removes channel memberships. It does not uninstall the app or delete its definition and credentials; remove the app separately in Slack when unused.

Troubleshooting

Alerts Are Not Arriving

Check installation, Active status, notification enablement, channels, scope, and observed outcomes. Confirm private-channel membership and run Test. If posting works, check workers and application logs.

For connectivity errors, verify DNS, HTTPS, and TLS access to slack.com:443; for unexpected responses, retry and check Slack status.

OAuth and Installation Errors

Slack code	Action
`invalid_client_id`, `bad_client_secret`	Recopy credentials from Basic Information and reinstall.
`bad_redirect_uri`	Register the exact callback above.
`invalid_code`, `access_denied`	Restart Add to Slack and approve consent.
`missing_scope`	Use Team Server’s app definition or add the scope, then reinstall.

Posting Errors

Slack code	Action
`invalid_auth`, `token_revoked`, `token_expired`, `not_authed`	Disable token rotation; replace and reinstall the integration.
`account_inactive`	Reactivate the workspace or bot and reinstall.
`missing_scope`	Reinstall with the required scopes.
`channel_not_found`	Reload and select a current channel in the installed workspace.
`not_in_channel`	Invite the bot, reload, and reselect the private channel.
`is_archived`	Unarchive or select another channel.
`restricted_action`	Adjust workspace or channel app policy.
`ratelimited`	Team Server retries with Slack’s delay; reduce duplicates if persistent.

Authentication errors mark the integration Inactive. Channel, policy, and rate-limit errors affect that delivery attempt.

Integration Is Inactive

status_reconcile rechecks credentials. For a revoked or uninstalled token, record settings, delete the integration, and reinstall a replacement. Invalid tokens cannot reconnect in place.

Team Server URL Changed

Update the app callback to {new_base_url}/api/integrations/slack/callback before new installations. Existing tokens keep posting; old alert links retain their original hostname.

Email Microsoft Teams