​
Overview

The Slack Webhooks API lets Allternit receive inbound messages from Slack via the Slack Events API. When a user sends a message in a connected Slack channel, the API routes it to a Gizzi agent session and posts the assistant’s reply back to the same thread.

​
Base URL

This endpoint is public because Slack signs every request with its own signature. Verification is performed using the Slack signing secret rather than the standard Allternit Bearer token. See Authentication for user-facing authentication details.

​
Endpoints

The binding routes sit under the authenticated API prefix. The events endpoint below is public.

​
Request signature

Slack signs each request with X-Slack-Signature and a timestamp in X-Slack-Request-Timestamp. The signature is verified over the string v0:{timestamp}:{raw_body}. Requests with timestamps outside a 5-minute window are rejected.

​
URL verification

When configuring the Events Subscriptions URL, Slack sends a url_verification event:
Response:

​
Message events

For event_callback events with a plain message subtype (no bot_id), the API spawns a background task that:
  1. Reuses or creates a Gizzi session for the channel/thread pair.
  2. Sends the message text to the session.
  3. Polls for the assistant’s completed reply.
  4. Posts the reply to the same Slack thread via chat.postMessage.
A channel bound to a bot goes to that bot: each Slack thread becomes one task thread on the bot, and the turn runs with the bot’s instructions and memory. Unbound channels share one default agent and model. Handling is text-only (no file or image attachments). Edits, deletes, reactions and bot echoes are recorded on the channel binding and never start a new turn. The endpoint immediately returns 200 OK to avoid Slack retries.

​
Configuration

The following environment variables must be set:

​
Example event

​
Response

​
Error codes