Slack

Required

Fields required for a valid configuration.

Path	Type	Required	Description	Default	Constraints
required	object	Yes	—	—	no extra properties
required.workspace	string	No	Slack workspace name or domain (for display and stable IDs)	—	—

Masked

Sensitive fields under(secrets/credentials).

Path	Type	Required	Description	Default	Constraints
masked	object	Yes	—	—	—

Optional

Optional configuration fields.

Path	Type	Required	Description	Default	Constraints
optional	object	No	—	—	no extra properties
optional.channels	object	No	Channel discovery and targeting controls.	—	no extra properties
optional.channels.channel_ids	array	No	Explicit channel IDs to scan. If provided, channel_types is ignored.	—	—
optional.channels.channel_ids[]	string	No	—	—	—
optional.channels.channel_types	array	No	Slack conversation types to include when listing channels	["public_channel"]	—
optional.channels.channel_types[]	enum	No	Slack conversation types to include Allowed values: public_channel, private_channel, mpim, im	—	—
optional.channels.exclude_archived	boolean	No	Exclude archived channels when listing	true	—
optional.ingestion	object	No	Throughput and payload controls for Slack ingestion.	—	no extra properties
optional.ingestion.batch_size	integer	No	Messages per API call (max 200)	200	min 1, max 200
optional.ingestion.include_thread_replies	boolean	No	Include thread replies in fetched content for detectors	false	—
optional.ingestion.rate_limit_delay_seconds	number	No	Delay between API calls to avoid rate limits	1	min 0
optional.time_range	object	No	Time window filters for message ingestion.	—	no extra properties
optional.time_range.latest	string	No	End of date range (Slack timestamp or ISO 8601)	—	—
optional.time_range.oldest	string	No	Start of date range (Slack timestamp or ISO 8601)	—	—

Extracted Metadata

Message

Field	Type	Required	Description
channel_id	string	Yes	Slack channel id
ts	string	Yes	Message timestamp
channel_name	string	No	Channel name
author	string	No	User id or bot name
thread_ts	string	No	Parent thread timestamp

Examples

Public channels compliance scan

Scan all public channels for PII and secrets exposure using a bot token

Config Payload

{
  "type": "SLACK",
  "required": {
    "workspace": "your-workspace"
  },
  "masked": {
    "bot_token": "xoxb-your-bot-token"
  },
  "optional": {
    "channels": {
      "channel_types": [
        "public_channel"
      ],
      "exclude_archived": true
    },
    "ingestion": {
      "rate_limit_delay_seconds": 1
    }
  },
  "sampling": {
    "strategy": "AUTOMATIC"
  },
  "detectors": [
    {
      "type": "PII",
      "enabled": true
    },
    {
      "type": "SECRETS",
      "enabled": true
    }
  ]
}

Schedule

{
  "enabled": true,
  "preset": "weekday_morning",
  "cron": "45 7 * * 1-5",
  "timezone": "UTC"
}

Private channels and DMs audit

Audit private channels and direct messages for sensitive data using a user token

Config Payload

{
  "type": "SLACK",
  "required": {
    "workspace": "your-workspace"
  },
  "masked": {
    "user_token": "xoxp-your-user-token"
  },
  "optional": {
    "channels": {
      "channel_types": [
        "private_channel",
        "mpim",
        "im"
      ],
      "exclude_archived": true
    }
  },
  "sampling": {
    "strategy": "AUTOMATIC"
  }
}

Schedule

{
  "enabled": true,
  "preset": "weekday_morning",
  "cron": "18 6 * * 1-5",
  "timezone": "UTC"
}

Targeted channel scan with date range

Scan specific channels within a time window — useful for incident response or focused audits

Config Payload

{
  "type": "SLACK",
  "required": {
    "workspace": "your-workspace"
  },
  "masked": {
    "bot_token": "xoxb-your-bot-token"
  },
  "optional": {
    "channels": {
      "channel_ids": [
        "C1234567890",
        "C0987654321"
      ]
    },
    "time_range": {
      "oldest": "2025-01-01T00:00:00Z",
      "latest": "2025-02-01T00:00:00Z"
    },
    "ingestion": {
      "batch_size": 200,
      "include_thread_replies": true
    }
  },
  "sampling": {
    "strategy": "AUTOMATIC"
  }
}

Schedule

{
  "enabled": true,
  "preset": "weekly",
  "cron": "52 1 * * 0",
  "timezone": "UTC"
}