Slack Audit connector setup

Polls the Slack Audit Logs API and, optionally, org-wide team inventory from the Admin API.

What you need first

Requirement	Details
Slack plan	Enterprise Grid (or Enterprise Select)
Slack app install	Organization (org-level app), not workspace-only
	Commercial Slack only. This connector calls slack.com / api.slack.com. GovSlack uses separate endpoints and is not supported yet.
	Use the Slack connector (workspace install) for messages, access logs, and workspace inventory.

---

1. Create a Slack app

1. Open the Slack API apps dashboard and sign in.
2. Create New App → From scratch.
3. Name the app (e.g. Perpetual Slack Audit) and pick any workspace in your org.
4. Click Create App.

OAuth scopes

1. User Token Scopes: auditlogs:read
2. Bot Token Scopes: users:read (required for org-level Enterprise Grid apps)
3. Features → Org Level Apps → Enable Org-Readiness

For Admin teams list, also add user scope admin.teams:read.

Audit log access must be approved by an Owner of the Enterprise organization during OAuth consent.

---

2. Install the app on your organization

From Basic Information, copy Client ID and Client Secret.

1. OAuth & Permissions → Redirect URLs: add Perpetual's OAuth redirect URI (from step 3).
2. Manage Distribution → Share Your App with Other Workspaces → activate public distribution (remove hard-coded URLs if prompted).
3. Open the shareable install link, choose your organization (not a single workspace), and allow the app.
4. Complete OAuth via Perpetual's Connect flow in step 3.

---

3. Perpetual credential

1. Log in to Perpetual. Open Settings from the user/org control at the bottom left of the sidebar (click your name → Settings), then go to Credentials → New Credential.
2. Choose OAuth 2.0 Authorization Code.
3. Fill in:

Field	Value
Name	Unique identifier using letters, digits, and underscores only (e.g. slack_audit).
Allowed URL patterns	*.slack.com
Authorization URL	https://slack.com/oauth/v2/authorize
Token URL	https://slack.com/api/oauth.v2.access
Client ID / Client Secret	From Slack Basic Information
User scopes	auditlogs:read (add admin.teams:read if enabling Admin teams list)
Scopes	Leave empty unless you also need bot scopes

4. Save the credential. Copy the Redirect URI into the Slack app's Redirect URLs if needed.
5. Click Connect, sign in as an Enterprise org owner, and approve. Status should show Connected.

---

4. Create the Slack Audit connector

1. Go to Datasets → Connectors → Create Connector.
2. Select Slack Audit.
3. Connector name: unique identifier (letters, numbers, underscores).
4. Configure:
   • Slack API access: select the org-level credential from step 3.
   • Poll interval (minutes): default 5 for audit log polling. Admin teams list runs at most once per 24 hours.
   • Enable streams:

Setting	Default	Slack API	Notes
Audit logs	On	GET /audit/v1/logs	Requires auditlogs:read and org-level install
Admin teams list	Off	admin.teams.list	Requires admin.teams:read

At least one stream must stay enabled.

5. Optionally check Deploy, then save.

First run backfills roughly the last 24 hours of audit events, then advances cursors on subsequent polls.

---

Reference

• Slack Audit Logs API
• Using the Audit Logs API