> ## Documentation Index
> Fetch the complete documentation index at: https://docs.app.strix.ai/llms.txt
> Use this file to discover all available pages before exploring further.

# Slack Integration

> Connect Strix to Slack for vulnerability alerts, thread discussions, and status updates

export const ScarfPixel = () => <img referrerPolicy="no-referrer-when-downgrade" src="https://static.scarf.sh/a.png?x-pxid=831669b6-b4bd-42cb-8832-2122c03e1d5f" alt="" width="1" height="1" style={{
  position: "absolute",
  width: 0,
  height: 0,
  opacity: 0,
  pointerEvents: "none"
}} />;

<ScarfPixel />

Strix integrates with Slack to post vulnerability alerts and scan updates into a channel of your choice, mirror the discussion thread back into the Strix dashboard, and let your team update an issue's status directly from Slack. This page covers setup, the bot scopes requested, what data is exchanged, and how to disconnect.

## Overview

|                  |                                                                                                                          |
| ---------------- | ------------------------------------------------------------------------------------------------------------------------ |
| Integration type | Slack app installed via standard OAuth 2.0 (bot token)                                                                   |
| Direction        | Bidirectional: Strix posts messages; status changes made in Slack sync back to Strix                                     |
| Who can connect  | Strix organization **admins** only                                                                                       |
| Where it posts   | A single default channel chosen by an admin (public or private)                                                          |
| Default behavior | Notifies on **critical** and **high** findings only; scan-complete and status-change notifications are off until enabled |

## Setup

1. In Strix, go to **Settings → Integrations** and click **Connect** on the Slack card. You must be an organization admin.
2. Approve the app on Slack's standard consent screen. Slack redirects back to `https://app.strix.ai/api/integrations/slack/callback`, where Strix stores the bot token for your workspace.
3. Choose a **default channel** for notifications. For public channels the bot joins automatically; for private channels, invite `@Strix` to the channel first, then select it.
4. Optionally adjust notification settings: which severities create alerts (`critical`, `high`, `medium`, `low`), and whether to notify on scan completion and on issue status changes.

## Bot scopes requested

| Scope                                | Why Strix needs it                                                                                |
| ------------------------------------ | ------------------------------------------------------------------------------------------------- |
| `channels:read`, `groups:read`       | List public/private channels so an admin can pick the default channel                             |
| `channels:join`                      | Auto-join the selected public channel so posting succeeds                                         |
| `chat:write`, `chat:write.public`    | Post vulnerability alerts and scan updates                                                        |
| `channels:history`, `groups:history` | Read replies **in Strix-created threads only**, to mirror the discussion into the Strix dashboard |
| `users:read`                         | Resolve display names/avatars of users who replied in a Strix thread                              |
| `commands`                           | Support Slack interactions (e.g. updating an issue's status from the message)                     |

The bot only ever reads message threads that it started; it does not read general channel history, DMs, or files.

## What data flows where

**Strix → Slack**:

* New-finding alerts (for severities you've enabled): finding title, severity, target, and a link to the issue in Strix, posted to the default channel.
* Optional scan-complete and issue status-change notifications.

**Slack → Strix**:

* Replies in a Strix-created thread (message text, author name, avatar) are displayed alongside the issue in the Strix dashboard.
* Status updates triggered from Slack (e.g. marking an issue in progress, resolved, or snoozed) update the linked vulnerability in Strix, recorded with the acting Slack user's ID.

## Security

* **Admin-gated**: the install and callback endpoints require an authenticated Strix org admin, and notification settings can only be changed by admins.
* **CSRF-protected OAuth**: the OAuth `state` is HMAC-signed, bound to the initiating organization and user, and expires after 10 minutes.
* **Token storage**: the bot token is stored server-side in Strix's database, scoped to your organization, and never exposed to the browser or other tenants.
* **Tenant isolation**: inbound status updates from Slack are verified against the workspace's team ID and only applied to issues owned by the organization linked to that workspace; thread reads are checked against the requesting user's organization.
* **Private channels are opt-in**: Strix never joins private channels itself — a workspace member must invite `@Strix` explicitly.
* **Audit trail**: settings changes are recorded in the Strix audit log.

## Disconnecting

An org admin can disconnect Slack at any time from **Settings → Integrations**, or via the API:

```bash theme={null}
curl -X DELETE "https://app.strix.ai/api/v1/integrations/slack" \
  -H "Authorization: Bearer <YOUR_API_TOKEN>"
```

**Required scope:** `integrations:write`

Disconnecting deletes the stored bot token and clears all Slack thread links from Strix issues. To fully remove the app from your workspace, a Slack workspace admin can also remove it under **Slack → Manage apps**.