slack-workspace-messaging-openapi

Getting credentials

1. Create a Slack app at Slack API.
2. Install the app in the workspace that the user wants to connect.
3. Grant only the scopes required by the workflow, such as chat:write, channels:read, groups:read, channels:history, and groups:history.
4. Copy the bot or user OAuth token generated after installation.
5. When VX Agent asks for authentication, provide the OAuth token using Bearer authentication.

Keep the token private. Do not paste it into the Swagger file, marketplace description, prompts, or chat messages.

How to use this API

Use the Slack Web API to verify the connected workspace, list conversations, read channel history, create channels, and post, update, or delete messages.

A typical workflow is:

1. Use POST /auth.test to verify the connected Slack workspace and authenticated user or bot.
2. Use GET /conversations.list to find the correct channel ID. Use channel IDs instead of deprecated usernames.
3. Use GET /conversations.history to read recent messages from an authorized channel.
4. Use POST /conversations.create to create a public or private channel only after the user confirms the channel name and purpose.
5. Use POST /chat.postMessage to send a message to a channel, direct message, or thread after confirming the channel, audience, and final content.
6. Use POST /chat.update to edit a message only after confirming the message timestamp and replacement content.
7. Use POST /chat.delete only after the user explicitly confirms the exact channel and message to delete.

For JSON POST requests, set Content-Type: application/json. Slack expects the OAuth token in the Authorization: Bearer header. Check the top-level ok field in every response, even when the HTTP request returns a successful status code.

Use thread_ts to reply in a thread. Use blocks for structured messages and include a top-level text fallback when possible for accessibility. Use pagination with cursor when listing conversations or reading large histories.

Safety and usage notes

Posting, updating, or deleting a Slack message affects real users and may trigger notifications. Always ask for confirmation immediately before posting or changing a message. Verify the workspace, channel, recipients, thread, message text, links, attachments, and whether the message should be broadcast.

Creating a channel changes the workspace structure. Require confirmation before creating public or private channels. Do not post on behalf of a user, impersonate a person, or use chat:write.customize unless the user has explicitly authorized that behavior.

Do not expose Slack OAuth tokens, private channel history, direct messages, user data, or confidential workspace content. Respect workspace policies, retention settings, and rate limits.

A 401 or invalid_auth response usually indicates an invalid, expired, or revoked token. A 403 or missing_scope response usually indicates insufficient permissions or missing channel membership. A channel_not_found response may indicate an incorrect channel ID or that the app is not a member of the channel.

Official documentation: Slack Web API and chat.postMessage.