sourcey
Add your company

agents:catalog.jsonSKILL.mdmcp.jsonopenapi.yml

← Slack

Agent report card

Can an agent use Slack Web API through Workspace app operations?

Grade B+: Self-service is tier- or condition-limited, or a bounded vendor review exposes status.

Observedrev sha256:fea89fefd481…barrier checks 0/5 verified

Agent ReadinessB+Limited

Five-stage assessment

Where agent autonomy holds and where it breaks

Five states · each from its own evidence · lifecycle order, not a journey
  1. EvaluateReady
  2. Sign upReady
  3. PayLimited
  4. ProvisionReady
  5. OperateLimited
  1. 01

    Evaluate

    Ready

    The exact service and stable evaluation or access entrypoints are publicly discoverable.

    The Slack Web API is publicly documented with stable HTTPS RPC-style endpoints in the form https://slack.com/api/METHOD_FAMILY.method.

    Applicable terms are stable, readable, retrievable, and materially complete.

    Eligibility conditions and required inputs are explicit and decidable.

    Price or no-charge status, variables, currency, and material conditions are explicit.

    Verified structured artifacts accelerate discovery of the evaluation surface.

    Evidence and actions6 signals

    Can an agent decide every material eligibility condition before commitment?

    supported: fresh

    Eligibility conditions and required inputs are explicit and decidable.

    Slack workspace members can install apps by default, and workspace owners can enable app approval. The features are available on all subscriptions and supported for all members.

    eligibility_decidability: Ready: tested 6 Sept

    Method public-semantic-assessment 2026-09-06

    Can an agent estimate cost or confirm no-charge status before commitment?

    supported: fresh

    Price or no-charge status, variables, currency, and material conditions are explicit.

    Slack provides an explicit Free plan forever at $US0, which includes 90 days of message history, up to 10 apps, 1:1 huddles, and direct messages.

    pricing_decidability: Ready: tested 6 Sept

    Method public-semantic-assessment 2026-09-06

    Can an agent find the exact service and its stable entrypoints?

    supported: fresh

    The exact service and stable evaluation or access entrypoints are publicly discoverable.

    The Slack Web API is publicly documented with stable HTTPS RPC-style endpoints in the form https://slack.com/api/METHOD_FAMILY.method.

    service_discovery: Ready: tested 6 Sept

    Method public-semantic-assessment 2026-09-06

    Are verified structured discovery artifacts available?

    supported: fresh

    Verified structured artifacts accelerate discovery of the evaluation surface.

    Slack developer documentation explicitly points to an llms.txt structured evaluation artifact ('LLM? Read llms.txt').

    structured_evaluation_discovery: Ready: tested 6 Sept

    Method public-semantic-assessment 2026-09-06

    Can an agent retrieve and understand the applicable commitment terms?

    supported: fresh

    Applicable terms are stable, readable, retrievable, and materially complete.

    Slack provides retrievable, readable, and stable applicable legal terms including the Main Services Agreement, User Terms of Service, Slack Supplemental Terms, and API Terms of Service.

    terms_access: Ready: tested 6 Sept

    Method public-semantic-assessment 2026-09-06

    Does the vendor deliberately describe access for web agents?

    supported: fresh

    Current admissible evidence does not resolve this finding.

    The retained documentation fragments discuss OAuth authentication, tokens, and API usage, but do not contain explicit web agent or crawler access policies (such as robots.txt rules or web bot user-agent directives).

    verified_web_agent_access: Unknown: tested 6 Sept

    Method public-semantic-assessment 2026-09-06

  2. 02

    Sign up

    Ready

    A stable canonical route begins the required access bootstrap.

    Slack explicitly declares a stable route to get started with an email address at https://slack.com/get-started.

    Scoped revocable credentials or delegated authorization have explicit consent and resumption boundaries.

    Evidence and actions5 signals

    Can an agent operate the access controls and safe handoffs deterministically?

    supported: fresh

    Current admissible evidence does not resolve this finding.

    The retained evidence for https://slack.com/get-started provides metadata and title text ('Login | Slack') but does not contain actionable controls, forms, fields, or validation details needed to demonstrate agent operability.

    access_control_operability: Unknown: tested 6 Sept

    Method public-semantic-assessment 2026-09-06

    Is there a stable route to begin obtaining service access?

    supported: fresh

    A stable canonical route begins the required access bootstrap.

    Slack explicitly declares a stable route to get started with an email address at https://slack.com/get-started.

    access_entrypoint_stability: Ready: tested 6 Sept

    Method public-semantic-assessment 2026-09-06

    Can an agent obtain access without an unsupported CAPTCHA boundary?

    supported: fresh

    Current admissible evidence does not resolve this finding.

    The retained captures for https://slack.com/get-started do not contain explicit declarations or observed page content regarding CAPTCHAs or bot verification challenges.

    captcha_compatible_access: Unknown: tested 6 Sept

    Method public-semantic-assessment 2026-09-06

    Can an agent obtain scoped, revocable authority for this service?

    supported: fresh

    Scoped revocable credentials or delegated authorization have explicit consent and resumption boundaries.

    Slack documents an OAuth flow where apps request scoped permissions, users grant consent, temporary authorization codes are exchanged for tokens, and API access tokens can be revoked via the auth.revoke method.

    delegated_identity_access: Ready: tested 6 Sept

    Method public-semantic-assessment 2026-09-06

    Can required phone verification be completed through a supported boundary?

    supported: fresh

    Current admissible evidence does not resolve this finding.

    The retained evidence for https://slack.com/get-started does not mention phone or SMS verification requirements.

    phone_verification_compatible: Unknown: tested 6 Sept

    Method public-semantic-assessment 2026-09-06

  3. 03

    Pay

    Limited

    Self-service is tier- or condition-limited, or a bounded vendor review exposes status.

    Slack documents a self-service path to change subscription details and purchase paid tiers via the billing page, but Enterprise+ plan purchases require contacting the sales team.

    Charge or no-charge status, currency, recurrence, and material conditions are disclosed.

    Evidence and actions4 signals

    Can an agent construct checkout, hand off approval safely, and resume?

    supported: fresh

    Current admissible evidence does not resolve this finding.

    The retained text mentions a checkout option when changing subscription details or payment methods, but it does not establish deterministic checkout construction, approval handoff, and resumption.

    checkout_operability: Unknown: tested 6 Sept

    Method public-semantic-assessment 2026-09-06

    Is the exact commercial commitment disclosed before authorization?

    supported: fresh

    Charge or no-charge status, currency, recurrence, and material conditions are disclosed.

    Slack explicitly discloses the commercial commitment details on its pricing page, including price points ($US8.75 and $US18 per user/month monthly, or $US7.25 and $US15 per user/month annually) and currency.

    commitment_disclosure: Ready: tested 6 Sept

    Method public-semantic-assessment 2026-09-06

    Can payment be authorized within scoped agent or explicit human authority?

    supported: fresh

    Current admissible evidence does not resolve this finding.

    The retained documentation describes managing payment methods like credit cards and ACH bank transfers, but it does not document scoped delegation or explicit human authorization rails with receipts.

    payment_authorization: Unknown: tested 6 Sept

    Method public-semantic-assessment 2026-09-06

    Is a direct self-service path to paid access documented?

    supported: fresh

    Self-service is tier- or condition-limited, or a bounded vendor review exposes status.

    Slack documents a self-service path to change subscription details and purchase paid tiers via the billing page, but Enterprise+ plan purchases require contacting the sales team.

    self_service_purchase: Limited: tested 6 Sept

    Method public-semantic-assessment 2026-09-06

    What would improve this stage

    • Document a direct purchase path or bounded vendor review with machine-readable status.
  4. 04

    Provision

    Ready

    Provisioning is machine-triggerable or follows deterministically from an allowed handoff.

    Message posting can be initiated synchronously via the chat.postMessage API endpoint. Workspace app installation follows a machine-triggerable OAuth flow initiated by redirecting users with requested scopes.

    Credentials, grants, or configuration are delivered through a documented agent-usable flow.

    A synchronous success response returns a usable created resource or access material; otherwise asynchronous work exposes progress, terminal state, reconciliation, and a documented bound.

    Evidence and actions3 signals

    Can usable access material be delivered securely to an authorized agent?

    supported: fresh

    Credentials, grants, or configuration are delivered through a documented agent-usable flow.

    Slack's OAuth flow allows an app to obtain an access token by requesting scopes, receiving user approval, and exchanging a temporary authorization code by calling oauth.v2.access, which returns an HTTP response containing an access token.

    access_material_delivery: Ready: tested 6 Sept

    Method public-semantic-assessment 2026-09-06

    Can an agent determine successful provisioning completion and reconcile asynchronous failure?

    supported: fresh

    A synchronous success response returns a usable created resource or access material; otherwise asynchronous work exposes progress, terminal state, reconciliation, and a documented bound.

    A synchronous postMessage API call returns an ok: true response along with the created message object and timestamp ID (ts). Callers should check the ok parameter in the response, which returns explicit error codes like too_many_attachments on failure.

    provisioning_completion: Ready: tested 6 Sept

    Method public-semantic-assessment 2026-09-06

    Can provisioning be initiated within supported agent authority?

    supported: fresh

    Provisioning is machine-triggerable or follows deterministically from an allowed handoff.

    Message posting can be initiated synchronously via the chat.postMessage API endpoint. Workspace app installation follows a machine-triggerable OAuth flow initiated by redirecting users with requested scopes.

    provisioning_operability: Ready: tested 6 Sept

    Method public-semantic-assessment 2026-09-06

  5. 05

    Operate

    Limited

    Safe failure handling is documented only partially.

    Slack documents rate-limiting error conditions, returning an HTTP 429 Too Many Requests response with a Retry-After header indicating the retry delay in seconds. However, the evidence leaves idempotency, cancellation, and reconciliation semantics unaddressed.

    Only part of the credential lifecycle is agent-operable.

    Every essential target has a stable documented agent-usable interface alternative.

    Request-time authentication is documented and usable under scoped agent authority.

    Essential operations have stable readable request, response, and effect semantics.

    Evidence and actions6 signals

    Is an agent-native protocol interface verified against the essential targets?

    supported: fresh

    Current admissible evidence does not resolve this finding.

    The retained excerpts describe REST or RPC interfaces, SDKs and CLIs for Slack Web API; they contain no first-party statement that an agent-native protocol interface is absent, and several navigation excerpts mention MCP resources without establishing coverage of the assessed targets.

    agent_protocol_interface: Unknown: tested 6 Sept

    • workspace-api

    Method public-semantic-assessment 2026-09-06

    Can an agent manage credential expiry, rotation, revocation, compromise, and recovery?

    supported: fresh

    Only part of the credential lifecycle is agent-operable.

    Slack OAuth documentation establishes token revocation via auth.revoke and token rotation with expiring access tokens, but does not document an end-to-end programmatic process for handling token compromise recovery or secret rotation within delegated authority.

    credential_lifecycle: Limited: tested 6 Sept

    Method public-semantic-assessment 2026-09-06

    Can an agent handle applicable failure modes safely?

    supported: fresh

    Safe failure handling is documented only partially.

    Slack documents rate-limiting error conditions, returning an HTTP 429 Too Many Requests response with a Retry-After header indicating the retry delay in seconds. However, the evidence leaves idempotency, cancellation, and reconciliation semantics unaddressed.

    failure_contract: Limited: tested 6 Sept

    Method public-semantic-assessment 2026-09-06

    Can an agent authenticate service operations with scoped authority?

    supported: fresh

    Request-time authentication is documented and usable under scoped agent authority.

    Slack Web API request-time authentication is documented using OAuth 2.0 bearer tokens, passed via the Authorization HTTP header (Authorization: Bearer xoxb-...) or as POST parameters, under scoped authority requested during the OAuth flow.

    operation_authentication: Ready: tested 6 Sept

    Method public-semantic-assessment 2026-09-06

    Are essential operation inputs, outputs, and effects stable and decidable?

    supported: fresh

    Essential operations have stable readable request, response, and effect semantics.

    Essential operations and parameters are documented across the targets: chat.postMessage defines required token and channel arguments with expected JSON response format and error table; rate-limits defines tiers, HTTP 429 status, and Retry-After header behavior; and Web API specifies HTTP POST URL-encoded and JSON body formats with top-level ok boolean response structures.

    operation_contract: Ready: tested 6 Sept

    • workspace-api

    Method public-semantic-assessment 2026-09-06

    Can an agent perform every essential assessment target through a usable interface?

    supported: fresh

    Every essential target has a stable documented agent-usable interface alternative.

    Every essential target is accessible through documented machine-usable HTTP RPC endpoints and SDKs/CLIs, such as POST https://slack.com/api/chat.postMessage.

    target_interface_access: Ready: tested 6 Sept

    • workspace-api

    Method public-semantic-assessment 2026-09-06

    What would improve this stage

    • Document applicable structured errors, retry, cancellation, and reconciliation semantics.
    • Provide scoped expiry, rotation, revocation, compromise, and recovery operations.

What works

  • Evaluate: The exact service and stable evaluation or access entrypoints are publicly discoverable.
  • Sign up: A stable canonical route begins the required access bootstrap.
  • Provision: Provisioning is machine-triggerable or follows deterministically from an allowed handoff.

What blocks agents

No stage is established as blocked.

Where autonomy is limited

  • Pay: Self-service is tier- or condition-limited, or a bounded vendor review exposes status.
  • Operate: Safe failure handling is documented only partially.

What this grade establishes

14 of 14 graded signals have current supporting evidence. 0 of 5 additional barrier checks are verified.Unknown checks are not a pass or a confirmed blocker. This report is not proof of an end-to-end purchase or service session.

How the grade is derived

A through C grades count Limited stages; D and F reflect Blocked stages by lifecycle severity.

Coverage is complete only when every graded signal has supported, fresh, non-conflicting evidence. Barrier and informational signals do not change coverage; only fresh, supported barrier values that passed their admission evidence rule participate in stage outcomes.

Each stage takes its worst graded signal or verified barrier. A fresh, supported mandatory barrier that passed its admission evidence rule can block that stage; incomplete or stale barrier evidence remains context only. The overall grade is derived from the five stage states.

Distribution

The grade’s badge

One stable image resolving the record’s current live facts, linking to the canonical page. Embed it once; it keeps itself current. Placement is never evidence and never affects rank.

Live sourcey badge for Slack Agent Readiness grade B+
[![sourcey record](https://sourcey.com/badges/agent-readiness/arp_01kzf0m4xj3k8sa6c2w9nq4vf7.svg)](https://sourcey.com/log/slack/agent-readiness/slack-web-api/workspace-app-operations)

Improve the report

Correct it, rerun it, or improve the funnel.

Report outdated evidenceRequest reassessmentClaim this record
Profile
arp_01kzf0m4xj3k8sa6c2w9nq4vf7
Projection
sha256:8836d33f10e32c36dbe4d9ad70f348904e790adeb8989febe5df11d8c50f2347
Policy
service-use-2026-09-07-blocking-barriers-r12 · sha256:fc9e8f046d86fcf19ab2f1bc547219e503cdc11ffa135d020db7285965cd7d1d

Every request carries these exact identifiers.How report cards are assessed →View the exact declaration