Slack Plugin Example

Navigic's first-party Slack plugin is the current reference implementation for a remote HTTP plugin. It is useful because Slack is both a provider integration and a channel integration: it receives Slack events, normalizes them for Navigic, and executes Slack Web API operations when an agent is allowed to reply.

Reference Shape

The Slack plugin exposes host-facing routes:

It also exposes Slack-facing routes:

Manifest Highlights

The Slack manifest declares:

• apiVersion: "navigic.plugin/v1";
• runtime.kind: "remote-http";
• provider OAuth scopes such as app_mentions:read, chat:write, channels:read, and groups:read;
• events such as slack.app_mention and slack.slash_command;
• channel capability channelType: "slack";
• operations validate_channel, send_reply, post_ephemeral, and format_message;
• outbound domain slack.com;
• redaction fields for authorization, access tokens, Slack signatures, and credential leases.

Operation Patterns

format_message is a no-side-effect operation. It can be allowed by default because it does not call Slack.

validate_channel reads provider state and needs Slack read scopes.

send_reply and post_ephemeral send external messages. They require:

• approval.defaultMode: "ask";
• idempotency: "required";
• requiredScopes: ["chat:write"];
• a scoped credential lease with a non-expired expiresAt.

Security Patterns

The Slack implementation follows these patterns that other plugins should copy:

• verify Slack signatures with the raw request body before parsing;
• reject stale Slack timestamps;
• require host bearer authentication on the execute route;
• reject expired credential leases;
• require idempotency keys for write operations;
• back write idempotency with durable storage;
• release idempotency reservations for retryable provider failures;
• avoid storing customer Slack bot tokens in the plugin service;
• redact provider secrets, authorization headers, and credential lease material from logs.

Availability Boundary

The Slack plugin is a first-party reference and managed integration. It does not mean arbitrary third-party plugins can be installed from the dashboard today. Use the protocol docs to build a conforming service, then coordinate managed review and onboarding with Navigic.

For workspace administrators connecting Slack during managed preview, see Install a Plugin.

Related Topics

• Build a Plugin
• Install a Plugin
• Manifest Reference
• Execute Endpoint
• Security Review Checklist