---
title: "Accept a signed Slack Events API delivery"
method: POST
path: "/webhooks/slack/events"
tags: ["Webhooks"]
---

# Accept a signed Slack Events API delivery

`POST /webhooks/slack/events`

## Request

- Base URL: `https://api.medianfi.com/api/v1`
- URL: `https://api.medianfi.com/api/v1/webhooks/slack/events`
- Auth: none required

Inbound half of the bidirectional Slack thread mirror, mounted only when SLACK_SIGNING_SECRET is set. This route has no bearer session. Slack signs the exact raw request bytes, so the route parses the body as raw and verifies the HMAC before any JSON decoding. Deliveries are acked immediately and processed asynchronously, because Slack retries anything not acked within three seconds; retries are idempotent on (channel, message timestamp). Messages authored by the Median bot are ignored, which is what stops the mirror from echoing forever.

## Headers

- `X-Slack-Request-Timestamp` string, required
- `X-Slack-Signature` string, required

## Request body

- object
  - `type` 'url_verification' | 'event_callback', required: url_verification is the one-time Request URL handshake.
  - `challenge` string: Echoed back verbatim during the url_verification handshake.
  - `team_id` string: Slack workspace ID; joined with the channel to resolve the Median company.
  - `event` object: The Slack event. Only `message` events are acted on; app_mention would arrive as a duplicate delivery of the same message.
    - `type` string
    - `subtype` string
    - `channel` string
    - `user` string
    - `bot_id` string
    - `text` string
    - `ts` string
    - `thread_ts` string: Present on replies; equals the parent message ts, which is how a Slack thread maps to a Median thread.

## Response `200`

Delivery accepted. Returns the challenge during url_verification, otherwise an empty body. Always returned once the signature is valid, including when downstream processing fails, so Slack does not retry.

- object
  - `challenge` string

## Other responses

- `400`: Body was not valid JSON
- `401`: Missing, stale, or invalid Slack signature

---

[API](https://skmtc.dev/medianfi/apis/median-api.md) · [All operations](https://skmtc.dev/medianfi/apis/median-api/llms.txt) · [OpenAPI document](https://skmtc.dev/medianfi/apis/median-api/revisions/20090ea32b0d?raw)