About Slack
The Slack connector reads workspace membership, channel configuration, and user groups. On Enterprise Grid, it also reads audit log events. It surfaces that information as artifacts in Iru Compliance. Iru authenticates with a bot OAuth token (xoxb-) obtained by installing a Slack app into your workspace. Access is read-oriented for compliance evidence; it does not send messages or change workspace settings through the scopes described here.
How It Works
Slack APIs expect the bot token in the Authorization header:| Detail | Value |
|---|---|
| Category | Communications |
| Authentication | Bearer token (bot OAuth token xoxb-) |
| Audit logs | auditlogs:read is Enterprise Grid only. Without Grid, audit-log-style evidence is not available through this API path. |
Prerequisites
- Workspace Owner or Workspace Admin rights so you can install apps.
- Ability to sign in to api.slack.com/apps for your workspace.
- Optional: Enterprise Grid if you need
auditlogs:read.
| Scope | Purpose |
|---|---|
users:read | Read member profiles |
users:read.email | Read member email addresses |
channels:read | List and read public channels |
groups:read | List and read private channels (where permitted) |
usergroups:read | Read user group configuration |
auditlogs:read | Audit logs (Enterprise Grid only) |
Connect Slack to Iru
- Slack
- Iru Compliance
Complete this tab before you connect the source in Compliance.
Open Slack API apps
In a browser, go to api.slack.com/apps and sign in with a Slack account that can create apps for the target workspace (often a workspace admin).
Create a new app
Select Create New App, then From scratch (unless your org standardizes on a manifest; this article assumes From scratch).
Name the app and pick the workspace
Enter an app name such as Iru Compliance and select the Slack workspace where Iru should install.
Add Bot Token scopes
Under Bot Token Scopes, add each scope from Prerequisites that your controls require. Add
auditlogs:read only if you are on Enterprise Grid and need audit evidence.Install the app to your workspace
From OAuth & Permissions, select Install to Workspace (or Reinstall after scope changes). Review permissions and approve.
Continue on the Iru Compliance tab.
Troubleshooting
Nothing opens when you turn the source on
Nothing opens when you turn the source on
Check pop-up blocker settings for the Iru site and try again.
not_authed / 401
not_authed / 401
Confirm the token is current, begins with
xoxb-, and the app is still installed.missing_scope
missing_scope
Add the scope under OAuth & Permissions, reinstall the app, copy the new token, and update Iru.
token_revoked
token_revoked
Reinstall the app or rotate credentials; update Iru with the new bot token.
No audit data
No audit data
auditlogs:read requires Enterprise Grid. Without it, audit-log API evidence is unavailable.Considerations
Bot tokens generally do not expire unless your…
Bot tokens generally do not expire unless your workspace enforces rotation. Follow Slack’s guidance if rotation is enabled.
Uninstalling the app revokes the token immediately.
Uninstalling the app revokes the token immediately.
Scope increases always require reinstall and a new…
Scope increases always require reinstall and a new token. Plan changes during a maintenance window.
Related Articles
Sources Management
Browse and manage every Compliance source.
Getting Started With Compliance
Frameworks, actions, and Artifacts.
Iru Overview
How Endpoint, Compliance, and Identity fit together.
Artifacts Management
Upload, review, and organize evidence from sources and actions.