Skip to main content
Receive an event from Slack
This is the address you give Slack as the app’s Request URL under Event Subscriptions. Slack calls it; nothing else can, because every request must carry Slack’s v0 signature over its exact body, at most five minutes old. A request that does not verify is refused with 401 before anything in it is read.
  • A url_verification request is answered with its challenge, which is how Slack checks the URL.
  • An app_mention, or a direct message to the bot, from a workspace an organisation connected is acknowledged at once and answered in its thread a moment later, from that organisation’s assistant.
  • A question from someone outside the connected workspace — a Slack Connect guest, a shared channel — or one that does not say whose it is, is acknowledged and refused, and the refusal is audited.
  • With approvals from Slack switched on, link in a direct message, approvals here, approvals off and a six-digit link code are commands, not questions: see Approve AI-employee actions from Slack. The code links a Slack account only when the user who asked for the link sends it, in the direct message the link was sent in.
  • app_uninstalled, and tokens_revoked naming the bot, disconnect the workspace.
  • Anything else is acknowledged with 200 and answered by nobody: a workspace nobody connected, an organisation that is suspended, a retry of an event already taken, or a message a bot wrote.
The organisation is always the one that connected the workspace. Nothing in the event can choose another.
Slack in MITHUNAI is in beta. This route answers 404 until your deployment’s operator registers the Slack app. It has not yet run against a real Slack workspace.

​
Response

Returns 200. For a url_verification, the body is {"challenge": "..."}.
Last modified on November 11, 2026