Slack

Create one Slack app for Team Server, then create scoped integrations for the teams and channels that should receive policy-violation alerts.

App and Integration Model

The Slack app holds permissions, the OAuth callback, Client ID, and Client Secret. Create it once per Team Server.
A Team Server integration selects a workspace, channels, notification options, pipelines, and deployments. Create one for each audience.

Several integrations can reuse the same app credentials and may target different Slack workspaces.

Prerequisites

Team Server available at the public HTTPS URL in settings.tenant.base_url
Operator or Administrator role in Team Server
Permission to create and install a Slack app
workers.mode configured in Team Server; BackgroundAsync is recommended
Outbound HTTPS from Team Server to slack.com:443
A pipeline or deployment reporting policy violations

Slack compares OAuth redirect URLs exactly. The callback is:

https://team-server.example.com/api/integrations/slack/callback

It is derived from settings.tenant.base_url. See Tenant.

Delivery Rules

Delivery is event-driven; there is no Slack scheduler job. Team Server groups all violations from one build or workload into one alert.

An integration posts only when:

its app is installed;
notifications are enabled;
at least one channel is selected;
the pipeline or deployment is in scope; and
the outcome is enforced, or observed outcomes are enabled.

Each matching integration posts independently, so overlapping scopes produce multiple alerts.

Required Slack Permissions

Team Server generates an app definition with these bot scopes:

Scope	Purpose
`channels:read`	List public channels
`groups:read`	List private channels that contain the app
`chat:write`	Post to channels the app has joined
`chat:write.public`	Post to public channels without joining

channels:join is not required. Leave organization-wide deployment, Socket Mode, and token rotation disabled. Team Server sends messages but receives no Slack events, and it does not refresh rotating tokens.

Create and Install the App

1. Generate the App

In Team Server, open Integrations, then Slack under Notify.
Select Get Started or Create.
Select Create app in Slack.
Review the generated definition in Slack and select Create.

The app is named Endura Team Server and its bot user is Endura. If the app already exists, reuse its credentials.

2. Enter Credentials

In the Slack app’s Basic Information page, copy its Client ID and Client Secret. In Team Server:

give the integration a unique audience-oriented name;
enter the Client ID and Client Secret; and
select Continue.

Slack credentials are stored per integration. They do not belong in production.yaml, and there are no SLACK_* environment variables.

3. Install into a Workspace

Select Add to Slack.
Choose the workspace.
Review the requested permissions and select Allow.
Confirm that Team Server shows the workspace and Active status.

If the workspace requires app approval, return and repeat Add to Slack after approval. Installing an existing integration into a different workspace clears its channel selections because Slack channel IDs are workspace-specific.

Configure Alerts

Select Channels

The channel selector lists public channels and private channels that include Endura. To use a private channel:

run /invite @Endura in Slack;
reload the Team Server integration page; and
select the channel and save.

Removing the app from a private channel stops delivery there without changing the integration’s Active status.

An integration with no selected channels is intentionally muted.

Choose Outcomes and Mentions

Option	Default	Effect
Post an alert when a violation is detected	On	Master delivery switch
Also alert on observed violations	Off	Include `observed` outcomes in addition to `prevented` and `terminated`
Mention `@here` on every alert	Off	Notify online members in each target channel

Enable observed outcomes in a low-traffic channel while tuning an observe-mode policy. Disable them before routine enforcement alerts if the additional traffic is not useful. Reserve @here for an on-call channel.

Scope Pipelines and Deployments

Pipelines and deployments are scoped independently:

Selection	Result
All Pipelines	Current and future pipeline build violations
Selected pipelines	Only those pipeline build violations
No pipelines with All off	No build alerts
All Deployments	Current and future workload violations
Selected deployments	Only those workload violations
No deployments with All off	No workload alerts

Both All options are enabled on a new integration. Narrow the scope before selecting high-traffic channels. See Access Scope for the pipeline/build and deployment/workload relationships.

Test and Verify

Test Channel Connectivity

Select one or more channels and click Test. The test uses the current form selections, including unsaved selections.

A successful test proves only that the bot token can post to those channels. It does not evaluate scope, outcome options, the notification switch, or background workers.

An authentication failure can mark the integration Inactive.

Test End-to-End Delivery

Confirm Active status, notifications enabled, and at least one selected channel.
Assign an observe or enforce policy to an in-scope pipeline.
Enable observed outcomes when testing an observe-mode policy.
Run a build that violates the policy.
Confirm that Team Server records the violation and Slack receives one grouped alert.
Follow the alert link back to the correct build or workload.

If Team Server records the violation but Slack is silent, use the checklist below.

Route Alerts to Teams

Create separate integrations for audiences that need different scopes:

Integration	Scope	Channels
Platform Security	All pipelines and deployments	`#security-alerts`
Payments On-Call	Selected payment pipelines, no deployments	`#payments-oncall`
Production Hosts	No pipelines, all deployments	`#sre-prod`

Overlapping integrations both post. Reduce noise by narrowing scopes, channel selections, or observed outcomes.

Edit or Delete an Integration

You can edit the name, channels, notification options, and scope. The workspace and credentials are fixed after installation; create a replacement integration to change them.

Deleting an integration revokes its bot token and uninstalls the app from that workspace before removing the record. Record its channels and scope first.

A Workspace Uninstall Can Affect Other Integrations

If several integrations target the same workspace, test each remaining integration after deleting one. Reinstall any integration whose token was revoked.

Deleting a Team Server integration does not delete the Slack app definition or its Client ID and Client Secret.

Troubleshooting

Alerts Are Not Arriving

Check in this order:

The integration is installed and Active.
Notify is on and channels are selected.
The affected pipeline or deployment is in scope.
Observed outcomes are enabled when the policy is in observe mode.
Endura is still a member of each private channel.
Test succeeds for the target channel.
workers.mode is configured.
Team Server Application Logs show no Slack error.

If Team Server cannot reach slack.com:443, logs report slack unreachable instead of a Slack error code.

OAuth and Installation Errors

Error	Resolution
`invalid_client_id`	Recopy the Client ID from Basic Information.
`bad_client_secret`	Recopy the current Client Secret, then reinstall.
`bad_redirect_uri`	Register `{base_url}/api/integrations/slack/callback` exactly.
`invalid_code`	Start Add to Slack again; the code expired or was reused.
`access_denied`	Repeat installation and approve the consent request.
`missing_scope`	Recreate the app from Team Server’s definition or add the missing scope and reinstall.

Posting Errors

Error	Resolution
`invalid_auth`, `token_revoked`, `token_expired`, `not_authed`	Disable token rotation, then replace and reinstall the integration.
`account_inactive`	Reactivate the workspace or bot, then reinstall.
`channel_not_found`	Reload and select a current channel in the installed workspace.
`not_in_channel`	Invite Endura to the private channel, reload, and reselect it.
`is_archived`	Unarchive the channel or select another.
`restricted_action`	Adjust workspace or channel app policy.
`ratelimited`	Team Server retries using Slack’s requested delay; reduce duplicate integrations if persistent.

Authentication errors mark an integration Inactive. Channel, policy, and rate-limit errors affect only that delivery attempt.

Integration Is Inactive

update_status periodically rechecks stored Slack credentials. A revoked or uninstalled token changes the integration to Inactive. There is no in-place reconnect for a dead token: record the settings, delete the integration, create a replacement, and reinstall it.

Team Server URL Changed

Existing tokens continue to post, but new installs fail until the Slack app’s redirect URL is changed to:

{new_base_url}/api/integrations/slack/callback

Links in previously sent alerts keep their original hostname. Update the Slack app before attempting a reinstall.