​

Slack Integration Guide

​

Overview

1. Outbound (required): Svantic → Slack — alert notifications and approval requests sent to a channel
2. Inbound (optional): Slack → Svantic — user clicks an interactive button, Slack POSTs the action back to Svantic

​

Step 1: Create a Slack App

1. Go to api.slack.com/apps and click Create New App
2. Choose From scratch
3. Name it (e.g., “Svantic Alerts”) and select your workspace
4. Click Create App

​

Step 2: Configure Bot Scopes

​

Step 3: Install to Workspace

1. On the OAuth & Permissions page, scroll up and click Install to Workspace
2. Click Allow on the permission prompt
3. Copy the Bot User OAuth Token (xoxb-...) — this is your bot token

​

Step 4: Get the Channel ID and Invite the Bot

1. In Slack, navigate to the channel where you want alerts delivered
2. Right-click the channel name → View channel details
3. Scroll to the bottom and copy the Channel ID (e.g., C0123456789)
4. In the channel, invite the bot:

/invite @Svantic Alerts

​

Step 5: Register the Slack Channel in Svantic

​

Via the dashboard

1. Go to Settings → Channels → click New Channel
2. Select Slack as the type
3. Enter a name (e.g., “Engineering Slack”)
4. Enter the Bot Token (xoxb-...)
5. Enter the Channel ID (C0123456789)
6. Click Create

​

Via the API

POST /internal/channels/new
{
  "type": "slack",
  "name": "Engineering alerts",
  "config": {
    "bot_token": "xoxb-your-bot-token",
    "channel_id": "C0123456789"
  }
}

​

Step 5b: Test

​

Step 6: Enable Interactivity (Optional)

1. Toggle Interactivity to On
2. Set Request URL to: https://your-gateway-domain/integrations/slack/interactive
3. Click Save Changes

​

Step 7: Note Your Signing Secret (Optional)

​

How Approval Buttons Work

​

Outbound (Svantic → Slack)

• Simple approval (1 action field with 2-3 options): renders Slack buttons inline
• Complex form (multiple fields, sensitive data): renders a summary text with a “Complete in Dashboard” button

​

Inbound (Slack → Svantic)

1. Slack POSTs an interaction payload to https://your-gateway/integrations/slack/interactive
2. Svantic verifies the Slack signing secret:
   • Computes v0:timestamp:body → HMAC-SHA256 with signing secret
   • Compares to the X-Slack-Signature header
   • Rejects if timestamp is stale (>5 minutes)
3. Svantic extracts the action (approve or deny) and message_id from the payload
4. Svantic resolves the pending request (same logic as dashboard resolution)
5. Svantic POSTs back to Slack’s response_url to update the original message:
   • Buttons are replaced with: “Approved by @john at 3:45 PM”
   • This prevents other users from clicking already-resolved buttons

​

Race Conditions

​

Limitations

​

Security Considerations

• Never expose the signing secret. Store it in a secrets manager, not in source code.
• The bot token is sensitive. It allows posting to channels. Restrict it to the minimum required scopes.
• Verify every inbound request. The signing secret verification prevents attackers from forging Slack payloads.
• Svantic never sends sensitive field values to Slack. Credentials, passwords, and other sensitive A2UI fields are filtered out by the SlackRenderer.

​

Troubleshooting

​

Further Reading

• Notification Channels — managing all channel types
• Approvals Guide — the full approval workflow
• Notifications & Approvals — the architectural model