Slack

Required

Fields required for a valid configuration.

Path	Type	Required	Description	Default	Constraints
required	object	Yes	—	—	no extra properties
required.workspace	string	No	Slack workspace name or domain, used for permalinks and stable asset IDs (example: acme or acme.slack.com)	—	—

Masked

Sensitive fields under(secrets/credentials).

Path	Type	Required	Description	Default	Constraints
masked	object	Yes	Bot-token authentication. Install the app into the workspace and copy its bot token; user tokens are not supported.	—	no extra properties
masked.bot_token	string	Yes	Slack bot token, starts with xoxb-. Needs the scopes channels:read, groups:read, im:read, mpim:read, channels:history, groups:history, im:history, mpim:history, users:read and files:read.	—	—

Optional

Optional configuration fields.

Path	Type	Required	Description	Default	Constraints
optional	object	No	—	—	no extra properties
optional.attachments	object	No	Files shared in messages. Each file becomes its own asset, and its text is extracted with the same parser used for local files (PDF, Office, images via OCR, audio and video transcription).	—	no extra properties
optional.attachments.exclude_file_extensions	array	No	Skip files with these extensions (example: .mp4, .zip)	—	—
optional.attachments.exclude_file_extensions[]	string	No	—	—	—
optional.attachments.include_attachments	boolean	No	Emit files shared in messages as scannable assets	true	—
optional.attachments.include_file_extensions	array	No	Only download files with these extensions (example: .pdf, .docx). Empty means all extensions.	—	—
optional.attachments.include_file_extensions[]	string	No	—	—	—
optional.attachments.max_attachment_bytes	integer	No	Skip files larger than this many bytes (default 25 MB)	26214400	min 1024, max 524288000
optional.channels	object	No	Which conversations to discover and scan.	—	no extra properties
optional.channels.auto_join_public_channels	boolean	No	Join public channels the bot is not a member of before reading them. conversations.history returns not_in_channel otherwise. Requires the channels:join scope.	false	—
optional.channels.channel_ids	array	No	Explicit conversation IDs to scan (example: C0123456789). When set, channel_types is ignored.	—	—
optional.channels.channel_ids[]	string	No	—	—	—
optional.channels.channel_types	array	No	Conversation types to include when listing channels. The bot only sees private channels and group DMs it has been invited to.	["public_channel","private_channel","mpim","im"]	—
optional.channels.channel_types[]	enum	No	Slack conversation types to include. public_channel and private_channel are named channels, mpim is a group direct message, im is a one-to-one direct message. Allowed values: public_channel, private_channel, mpim, im	—	—
optional.channels.exclude_archived	boolean	No	Skip archived channels when listing	true	—
optional.ingestion	object	No	Throughput and message-content controls.	—	no extra properties
optional.ingestion.batch_size	integer	No	Messages requested per API call (Slack caps this at 200)	200	min 1, max 200
optional.ingestion.include_thread_replies	boolean	No	Fetch each thread's replies and scan them alongside the parent message. Costs one extra API call per threaded message.	true	—
optional.ingestion.rate_limit_delay_seconds	number	No	Extra pause between API calls. Slack's 429 responses are retried automatically; this only smooths out sustained traffic.	1	min 0
optional.time_range	object	No	Limit ingestion to messages inside a time window.	—	no extra properties
optional.time_range.latest	string	No	End of the range, as a Slack timestamp or an ISO 8601 datetime	—	—
optional.time_range.oldest	string	No	Start of the range, as a Slack timestamp or an ISO 8601 datetime	—	—

Extracted Metadata

Message

Field	Type	Required	Description
channel_id	string	Yes	Slack channel id
ts	string	Yes	Message timestamp
channel_name	string	No	Channel name
author	string	No	User id or bot name
thread_ts	string	No	Parent thread timestamp
reply_count	integer	No	Number of replies in this message's thread

Attachment

Field	Type	Required	Description
filename	string	No	Original file name
mime_type	string	No	MIME type
size_bytes	integer	No	Raw byte size
channel_id	string	Yes	Slack channel id the file was shared in
file_id	string	Yes	Slack file id
file_name	string	Yes	Original file name
message_ts	string	No	Timestamp of the message the file was shared in
channel_name	string	No	Channel name
author	string	No	User id that shared the file

Examples

Workspace-wide compliance scan

Scan public and private channels, group DMs and direct messages for PII and secrets, including thread replies and shared files

Config Payload

{
  "type": "SLACK",
  "required": {
    "workspace": "your-workspace"
  },
  "masked": {
    "bot_token": "xoxb-your-bot-token"
  },
  "optional": {
    "channels": {
      "channel_types": [
        "public_channel",
        "private_channel",
        "mpim",
        "im"
      ],
      "exclude_archived": true
    },
    "ingestion": {
      "include_thread_replies": true,
      "rate_limit_delay_seconds": 1
    },
    "attachments": {
      "include_attachments": true,
      "max_attachment_bytes": 26214400
    }
  },
  "sampling": {
    "strategy": "AUTOMATIC"
  },
  "detectors": [
    {
      "type": "PII",
      "enabled": true
    },
    {
      "type": "SECRETS",
      "enabled": true
    }
  ]
}

Schedule

{
  "enabled": true,
  "preset": "weekday_morning",
  "cron": "45 7 * * 1-5",
  "timezone": "UTC"
}

Public channels only

Lower-risk baseline that reads public channels and skips file downloads — useful for a first run against a large workspace

Config Payload

{
  "type": "SLACK",
  "required": {
    "workspace": "your-workspace"
  },
  "masked": {
    "bot_token": "xoxb-your-bot-token"
  },
  "optional": {
    "channels": {
      "channel_types": [
        "public_channel"
      ],
      "exclude_archived": true,
      "auto_join_public_channels": true
    },
    "ingestion": {
      "include_thread_replies": false
    },
    "attachments": {
      "include_attachments": false
    }
  },
  "sampling": {
    "strategy": "AUTOMATIC"
  },
  "detectors": [
    {
      "type": "SECRETS",
      "enabled": true
    }
  ]
}

Schedule

{
  "enabled": true,
  "preset": "weekday_morning",
  "cron": "18 6 * * 1-5",
  "timezone": "UTC"
}

Targeted channel scan with date range

Scan specific conversations inside a time window — for incident response or a focused audit

Config Payload

{
  "type": "SLACK",
  "required": {
    "workspace": "your-workspace"
  },
  "masked": {
    "bot_token": "xoxb-your-bot-token"
  },
  "optional": {
    "channels": {
      "channel_ids": [
        "C1234567890",
        "C0987654321"
      ]
    },
    "time_range": {
      "oldest": "2025-01-01T00:00:00Z",
      "latest": "2025-02-01T00:00:00Z"
    },
    "ingestion": {
      "batch_size": 200,
      "include_thread_replies": true
    },
    "attachments": {
      "include_attachments": true,
      "exclude_file_extensions": [
        ".mp4",
        ".mov",
        ".zip"
      ]
    }
  },
  "sampling": {
    "strategy": "ALL"
  }
}

Schedule

{
  "enabled": true,
  "preset": "weekly",
  "cron": "52 1 * * 0",
  "timezone": "UTC"
}