Slack Events

Signed Slack callback

Configure the Slack interface, including its bot token, signing secret and public callback URL. These are Slack callbacks authenticated by provider signatures; an AgentOS bearer key does not replace that protocol.

Send X-Slack-Request-Timestamp and X-Slack-Signature, signed over the exact raw body. Missing headers return 400; an invalid signature or timestamp outside the five-minute window returns 403. A missing server signing secret is a configuration failure.

A successful acknowledgement does not mean the agent finished its response. Supported work runs as an in-process background task. Signed retries carrying X-Slack-Retry-Num are acknowledged without reprocessing, so a restart during processing can lose work; this is not a durable or exactly-once queue.

Event body

The body is raw JSON from Slack. A signed url_verification event with challenge returns {"challenge":"the-received-challenge"}. Ordinary event callbacks carry an event object; supported events return {"status":"ok"} while processing continues.

The generated absence of a request-body schema does not mean that this endpoint accepts an empty body or a generic Agent run request.

curl --request POST 'https://example.com/slack/events'

{  "challenge": "string"}