> ## Documentation Index
> Fetch the complete documentation index at: https://docs.app.strix.ai/llms.txt
> Use this file to discover all available pages before exploring further.

# Slack Integration

> Connect Strix to Slack for vulnerability alerts, thread discussions, and status updates

export const ScarfPixel = () => <img referrerPolicy="no-referrer-when-downgrade" src="https://static.scarf.sh/a.png?x-pxid=831669b6-b4bd-42cb-8832-2122c03e1d5f" alt="" width="1" height="1" style={{
  position: "absolute",
  width: 0,
  height: 0,
  opacity: 0,
  pointerEvents: "none"
}} />;

<ScarfPixel />

Strix connects to Slack to post vulnerability alerts and scan updates into a channel that you select. Strix also shows the Slack discussion thread in the Strix dashboard. Your team can update the status of an issue directly from Slack. This page describes the setup, the bot scopes that Strix requests, the data that Strix and Slack exchange, and the disconnect procedure.

## Overview

| | |
| - | - |
| Integration type | Slack app installed through standard OAuth 2.0 (bot token) |
| Direction | Bidirectional. Strix posts messages. Status changes made in Slack come back to Strix |
| Who can connect | Strix organization **admins** only |
| Where it posts | One default channel that an admin selects (public or private) |
| Default behavior | Sends notifications for **critical** and **high** findings only. Scan-complete and status-change notifications are off until you enable them |

## Setup

1. In Strix, go to **Settings → Integrations** and click **Connect** on the Slack card. You must be an organization admin.
2. Approve the app on the standard Slack consent screen. Slack redirects back to `https://app.strix.ai/api/integrations/slack/callback`. There, Strix stores the bot token for your workspace.
3. Select a **default channel** for notifications. The bot joins public channels automatically. For a private channel, first invite `@Strix` to the channel, then select it.
4. If necessary, change the notification settings: the severities that create alerts (`critical`, `high`, `medium`, `low`), and the notifications for scan completion and issue status changes.

## Remediation deadlines

Organization admins can set remediation deadlines on the **Slack settings** page. In **Integrations**, click **Configure** for Slack. Strix measures each deadline in days from first detection.

| Severity | Default deadline |
| - | - |
| Critical | 30 days |
| High | 30 days |
| Medium | 60 days |
| Low | 90 days |

Enter a whole number from 1 to 3650 in each field. Press Enter or move focus to save the value.

Critical and High have separate fields. You can change either deadline independently.

For a 30/30/90/180-day policy:

1. Keep **Critical** at 30.
2. Keep **High** at 30.
3. Set **Medium** to 90.
4. Set **Low** to 180.

The saved deadlines apply to existing and new issues in both Slack and email reminders. Enable **SLA reminders** to receive Slack digests. Existing organizations keep the default deadlines until an admin changes them.

You can also configure the deadlines through the API:

```bash theme={null}
curl -X PATCH "https://app.strix.ai/api/v1/settings/notifications" \
  -H "Authorization: Bearer <YOUR_API_TOKEN>" \
  -H "Content-Type: application/json" \
  -d '{"sla_critical_days":30,"sla_high_days":30,"sla_medium_days":90,"sla_low_days":180}'
```

**Required scope:** `organizations:write`. The token must have an organization admin role.

The API accepts partial updates. Omitted settings keep their current values. Changing the deadlines does not enable reminders or change notification channels.

## Bot scopes requested

| Scope | Why Strix needs it |
| - | - |
| `channels:read`, `groups:read` | List public and private channels so that an admin can select the default channel |
| `channels:join` | Join the selected public channel automatically so that Strix can post |
| `chat:write`, `chat:write.public` | Post vulnerability alerts and scan updates |
| `channels:history`, `groups:history` | Read replies **in Strix-created threads only**, to show the discussion in the Strix dashboard |
| `users:read` | Get the display names and avatars of users who replied in a Strix thread |
| `commands` | Support Slack interactions (for example, an update of the status of an issue from the message) |

The bot reads only the message threads that it started. It does not read general channel history, direct messages, or files.

## What data flows where

**Strix → Slack**:

* New-finding alerts (for the severities that you enabled): the finding title, severity, target, and a link to the issue in Strix. Strix posts them to the default channel.
* Optional scan-complete and issue status-change notifications.

**Slack → Strix**:

* The Strix dashboard shows the replies in a Strix-created thread (message text, author name, avatar) adjacent to the issue.
* Status updates from Slack (for example, when a user sets an issue to in progress, resolved, or snoozed) update the linked vulnerability in Strix. Strix records the ID of the Slack user who made the change.

## Security

* **Admin-gated**: The install and callback endpoints require an authenticated Strix org admin. Only admins can change the notification settings.
* **CSRF-protected OAuth**: The OAuth `state` is HMAC-signed and bound to the initiating organization and user. It expires after 10 minutes.
* **Token storage**: Strix keeps the bot token server-side in its database. The token applies only to your organization. The browser and other tenants cannot see it.
* **Tenant isolation**: Strix compares each inbound status update from Slack with the team ID of the workspace. Strix applies the update only to the issues of the organization that is linked to that workspace. Strix also checks each thread read against the organization of the requesting user.
* **Private channels are opt-in**: Strix does not join private channels itself. A workspace member must invite `@Strix` explicitly.
* **Audit trail**: The Strix audit log records the changes to the settings.

## Disconnecting

An org admin can disconnect Slack at any time from **Settings → Integrations**, or through the API:

```bash theme={null}
curl -X DELETE "https://app.strix.ai/api/v1/integrations/slack" \
  -H "Authorization: Bearer <YOUR_API_TOKEN>"
```

**Required scope:** `integrations:write`

The disconnect operation deletes the stored bot token and removes all Slack thread links from Strix issues. To remove the app fully from your workspace, a Slack workspace admin can also remove it in **Slack → Manage apps**.


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.