Webhooks

Accept a signed Slack Events API delivery

Inbound half of the bidirectional Slack thread mirror, mounted only when SLACK_SIGNING_SECRET is set. This route has no bearer session. Slack signs the exact raw request bytes, so the route parses the body as raw and verifies the HMAC before any JSON decoding. Deliveries are acked immediately and processed asynchronously, because Slack retries anything not acked within three seconds; retries are idempotent on (channel, message timestamp). Messages authored by the Median bot are ignored, which is what stops the mirror from echoing forever.

post/webhooks/slack/events

Request

  • Base URL: https://api.medianfi.com/api/v1
  • URL: https://api.medianfi.com/api/v1/webhooks/slack/events
  • Auth: none required

Headers

X-Slack-Request-Timestampstring required

Unix timestamp included in the signature base string; rejected beyond five minutes of skew.

X-Slack-Signaturestring required

Hex HMAC-SHA256 over "v0:{timestamp}:{raw body}", keyed with the app signing secret.

Request body

type'url_verification' | 'event_callback' required

url_verification is the one-time Request URL handshake.

challengestring

Echoed back verbatim during the url_verification handshake.

team_idstring

Slack workspace ID; joined with the channel to resolve the Median company.

Response

Delivery accepted. Returns the challenge during url_verification, otherwise an empty body. Always returned once the signature is valid, including when downstream processing fails, so Slack does not retry.

challengestring

Changes

No recorded changes to this operation across all 1 revision of this API.