System Overview

Slack is a collaboration platform that enables real-time communication, file sharing, and knowledge discovery across teams. Moveworks Enterprise Search integrates with Slack to enable Live Search — allowing users to securely search for Slack messages and content through Moveworks. This setup guide describes how to configure the Slack app and connect it to Moveworks using the provided app manifest.

Authentication

The Moveworks Enterprise Search Slack app uses OAuth 2.0 for authentication. During setup, Slack admins authorize Moveworks to securely access limited workspace data via read-only scopes.****

Permissions Enforcement

Moveworks adheres to Slack’s permission boundaries at all times. Search results are restricted to the authorizing user’s access level, ensuring that Moveworks only returns Slack messages and content the user is permitted to view.

Access Requirements

Moveworks connects with your Slack workspace using a dedicated Live Search Integration app. This app allows Moveworks Enterprise Search to perform secure, real-time searches on behalf of authorized users within Slack.

Pre-requisites

Before you get started, make sure you have everything you need:

1. Admin permissions : Slack Workspace Admin or Org Admin permissions are required to create and install Slack apps in your enterprise workspace.
2. App setup requirements : You must create one Slack application specifically for Live Search Integration (OAuth 2.0 with User Token).
   • Enables Moveworks to execute Slack searches securely using the RTS (search:read.*) user scopes: search:read.public, search:read.private, search:read.mpim, search:read.im, search:read.files, search:read.users.
   • Uses OAuth 2.0 credentials — Client ID and Client Secret.
   • Requires the following redirect URIs:

     https://<your-org>.moveworks.com/auth/oauthCallback
     https://www.moveworks.com/

Setup Slack Apps

Create the Live Search Integration App

1. Visit https://api.slack.com/apps and click Create New App → From an App Manifest.
2. Select your workspace and paste the following manifest, replacing {org} with your Moveworks organization name ((e.g.https://acme.moveworks.com/auth/oauthCallback ).

1
{
2
    "display_information": {
3
        "name": "Moveworks Enterprise Search"
4
    },
5
    "features": {
6
        "bot_user": {
7
            "display_name": "Moveworks Enterprise Search",
8
            "always_online": false
9
        }
10
    },
11
    "oauth_config": {
12
        "redirect_urls": [
13
            "https://{org}.moveworks.com/auth/oauthCallback",
14
            "https://www.moveworks.com"
15
        ],
16
        "scopes": {
17
            "user": [
18
                "search:read.public",
19
                "search:read.private",
20
                "search:read.mpim",
21
                "search:read.im",
22
                "search:read.files",
23
                "search:read.users"
24
            ],
25
            "bot": [
26
                "users:read",
27
                "channels:read",
28
                "groups:read",
29
                "usergroups:read"
30
            ]
31
        }
32
    },
33
    "settings": {
34
        "org_deploy_enabled": false,
35
        "socket_mode_enabled": false,
36
        "token_rotation_enabled": false
37
    }
38
}

1
"settings": {
2
    "org_deploy_enabled": true,
3
    "socket_mode_enabled": false,
4
    "token_rotation_enabled": false
5
}

3. After creating the app, navigate to OAuth & Permissions:

• Confirm that the RTS user scopes are present under User Token Scopes: search:read.public, search:read.private, search:read.mpim, search:read.im, search:read.files, search:read.users.
• Verify that the redirect URI matches your Moveworks org callback URL.

1. Navigate to the Install App section in your Slack app’s left-hand menu and install the app to your workspace.
2. Retrieve the Client ID and Client Secret from Basic Information section. These will be required later when setting up the Slack connector in Moveworks Setup.

Testing your credentials (Optional)

You can validate access by running the following Slack API calls:

1. Validate ChatBot Token
   Query the following endpoint using the Bot User OAuth Token (starting with xoxb-).

   1
   curl --location 'https://slack.com/api/auth.test' \
   2
     --header 'Authorization: Bearer xoxb-<bot_token>'
   If your credentials are valid, the API will return a JSON response containing your workspace and bot user information, for example:

   1
   {
   2
     "ok": true,
   3
     "url": "https://yourworkspace.slack.com/",
   4
     "team": "Your Workspace Name",
   5
     "user": "your-bot-name",
   6
     "team_id": "T12345678",
   7
     "user_id": "U12345678"
   8
   }
   If “ok”: true appears in the response, your bot token is active and authorized.
2. Validate Live Search Scope
   Authorize the Live Search app for a test user, then complete the OAuth 2.0 flow to obtain a user token and validate it:
   1. Get the Authorization (Sharable) URL
      1. Go to your Live Search app in the Slack API dashboard.
      2. Under **Manage Distribution → copy the Sharable URL.
      3. It will look like this:

         https://slack.com/oauth/v2/authorize?client_id=<CLIENT_ID>&user_scope=search:read.public,search:read.private,search:read.mpim,search:read.im,search:read.files,search:read.users
      4. Paste this URL into your browser and authorize the app using a Slack account from your workspace.
      5. After authorizing, you will be redirected to your Moveworks callback URL:

         https://www.moveworks.com
         Copy the value of <AUTH_CODE> from the URL — you’ll use it in the next step.
   2. Exchange the Authorization Code for a User Token
      Run the following cURL command to exchange the authorization code for a user token:

      1
      curl --location 'https://slack.com/api/oauth.v2.access' \
      2
        --header 'Content-Type: application/x-www-form-urlencoded' \
      3
        --data-urlencode 'client_id=<CLIENT_ID>' \
      4
        --data-urlencode 'client_secret=<CLIENT_SECRET>' \
      5
        --data-urlencode 'code=<AUTH_CODE>'
      You will receive a JSON response similar to:

      1
      {
      2
        "ok": true,
      3
        "authed_user": {
      4
          "id": "U12345",
      5
          "access_token": "xoxp-user1234567890"
      6
        },
      7
        "scope": "search:read.public,search:read.private,search:read.mpim,search:read.im,search:read.files,search:read.users",
      8
        "token_type": "user"
      9
      }
      Copy the authed_user.access_token value — this is the user access token that Moveworks will use for search queries.
   3. Validate the Token
      Test that the token has the correct RTS (search:read.*) scopes by calling the Real-Time Search endpoint:

      1
      curl --location 'https://slack.com/api/assistant.search.context' \
      2
        --header 'Authorization: Bearer <user_access_token>' \
      3
        --header 'Content-Type: application/json' \
      4
        --data '{"query":"test","channel_types":["public_channel","private_channel","mpim","im"]}'
      If successful, a JSON response ("ok": true) with matching search context will be returned. (If the token is missing the RTS scopes, the call returns an error such as missing_scope.)

Setup in Moveworks

Connector Creation

1. Log in to your org’s MyMoveworks portal
2. Navigate to Moveworks Setup > Connectors > Built-in Connectors
3. Click Create New
4. Search and Select Slack (Next Gen)
5. Click on Next: Add Creds
6. Input the following details and click Save
   1. Connector Name : Name this connector for your future reference. Once set, this name cannot be changed.
   2. Workspace Team ID: Paste the Team ID you copied earlier (starts with T, e.g., T12345678).
   3. Workspace-specific Slack Bot Token: Paste the Bot User OAuth token you copied earlier (must start with xoxb-).
   4. Client ID: Paste the Client ID you copied earlier from the Live Search Slack app (App Credentials).
   5. Client Secret: Paste the Client Secret you copied earlier from the Live Search Slack app (App Credentials).
   6. Region (optional): Select Commercial or GOV to match your Slack environment.

Initialising setup

1. Log in to your org’s MyMoveworks portal
2. Navigate to Moveworks Setup > Search > Configure Search > Max Capacity
3. Click on Create New or Get Started
4. Select Slack from the dropdown list and click on Get Started
5. You will be redirected to the Slack ingestion overview page. In the overview page, you will find few info blocks and few configuration blocks.
   1. System Overview: This presents an overview of Slack support from Moveworks
   2. Connector Selection: In this configuration block, you are required to select the required connector to enable Moveworks to connect and fetch data

Configuring Slack for Enterprise Search

Connector selection and validation

1. Once you click on Select Connector, a connector setup screen will appear as follows

2. Select the connector (from the dropdown) that you have created in the Connector Creation step.

   Please note: Only the Slack (Next Gen) connectors will appear in this list.

3. Once the connector is selected, you need to click on Start Validation to validate the connector credentials and required scope.

   Connector Validation

   This is a mandatory step in order to save the configuration and move to the next step.

   Moveworks validates the selected connector to check:

   • Channels: Moveworks validates if connector has right scopes to fetch channels information
   • Users: Moveworks validates if connector has right scopes to fetch user data
   • Groups: Moveworks validates if connector has right scopes to fetch user groups data

   

4. If the connector is validated successfully, you will see a green info banner as follows.

   1. If there are any credentials or scope issues, you will receive an error message as follows. Click on View Details to identify the issue. Refer to this step-by-troubleshoot guide (link to be added) to rectify any validation errors.

5. Once the connector is validated successfully, you will be able to Save the configuration.

6. Input the unique configuration name and Save.

7. Once the configuration is saved, you can view the unique configuration name at the top of the screen. You can also click the pencil 🖊️ icon to edit the configuration name.

8. Additionally, you will see a banner at the top of the screen with an Enable Live Search button. Click it to activate the Slack Live Search feature for your Enterprise Search web application.