System Overview

Slack is a collaboration platform that enables real-time communication, file sharing, and knowledge discovery across teams. Moveworks Enterprise Search integrates with Slack to enable Live Search — allowing users to securely search for Slack messages and content through Moveworks. This setup guide describes how to configure the Slack app and connect it to Moveworks using the provided app manifest.

Authentication

The Moveworks Enterprise Search Slack app uses OAuth 2.0 for authentication. During setup, Slack admins authorize Moveworks to securely access limited workspace data via read-only scopes.****

Permissions Enforcement

Moveworks adheres to Slack’s permission boundaries at all times. Search results are restricted to the authorizing user’s access level, ensuring that Moveworks only returns Slack messages and content the user is permitted to view.

Access Requirements

Moveworks connects with your Slack workspace using a dedicated Live Search Integration app. This app allows Moveworks Enterprise Search to perform secure, real-time searches on behalf of authorized users within Slack.

Pre-requisites

Before you get started, make sure you have everything you need:

1. Admin permissions : Slack Workspace Admin or Org Admin permissions are required to create and install Slack apps in your enterprise workspace.
2. App setup requirements : You must create one Slack application specifically for Live Search Integration (OAuth 2.0 with User Token).
   • Enables Moveworks to execute Slack searches securely using the RTS (search:read.*) user scopes: search:read.public, search:read.private, search:read.mpim, search:read.im, search:read.files, search:read.users.
   • Uses OAuth 2.0 credentials — Client ID and Client Secret.
   • Requires the following redirect URIs:

     https://<your-org>.moveworks.com/auth/oauthCallback
     https://www.moveworks.com/

Setup Slack Apps

Create the Live Search Integration App

1. Visit https://api.slack.com/apps and click Create New App → From an App Manifest.
2. Select your workspace and paste the following manifest, replacing {org} with your Moveworks organization name ((e.g.https://acme.moveworks.com/auth/oauthCallback ).

1
{
2
    "display_information": {
3
        "name": "Moveworks Enterprise Search"
4
    },
5
    "features": {
6
        "bot_user": {
7
            "display_name": "Moveworks Enterprise Search",
8
            "always_online": false
9
        }
10
    },
11
    "oauth_config": {
12
        "redirect_urls": [
13
            "https://{org}.moveworks.com/auth/oauthCallback",
14
            "https://www.moveworks.com"
15
        ],
16
        "scopes": {
17
            "user": [
18
                "search:read.public",
19
                "search:read.private",
20
                "search:read.mpim",
21
                "search:read.im",
22
                "search:read.files",
23
                "search:read.users"
24
            ],
25
            "bot": [
26
                "users:read",
27
                "channels:read",
28
                "groups:read",
29
                "usergroups:read"
30
            ]
31
        }
32
    },
33
    "settings": {
34
        "org_deploy_enabled": false,
35
        "socket_mode_enabled": false,
36
        "token_rotation_enabled": false
37
    }
38
}

1
"settings": {
2
    "org_deploy_enabled": true,
3
    "socket_mode_enabled": false,
4
    "token_rotation_enabled": false
5
}

3. After creating the app, navigate to OAuth & Permissions:

• Confirm that the RTS user scopes are present under User Token Scopes: search:read.public, search:read.private, search:read.mpim, search:read.im, search:read.files, search:read.users.
• Verify that the redirect URI matches your Moveworks org callback URL.

1. Navigate to the Install App section in your Slack app’s left-hand menu and install the app to your workspace.
2. Retrieve the Client ID and Client Secret from Basic Information section. These will be required later when setting up the Slack connector in Moveworks Setup.

Testing your credentials

You can validate access by running the following Slack API calls:

1. Validate ChatBot Token
   Query the following endpoint using the Bot User OAuth Token (starting with xoxb-).

   

   $
   curl --location 'https://slack.com/api/auth.test' \
   >
     --header 'Authorization: Bearer xoxb-<bot_token>'

   If your credentials are valid, the API will return a JSON response containing your workspace and bot user information, for example:

   1
   {
   2
     "ok": true,
   3
     "url": "https://yourworkspace.slack.com/",
   4
     "team": "Your Workspace Name",
   5
     "user": "your-bot-name",
   6
     "team_id": "T12345678",
   7
     "user_id": "U12345678"
   8
   }

   If “ok”: true appears in the response, your bot token is active and authorized.

   Copy the workspace/org identifier from the response — you will paste it into the Workspace Team ID field during Connector Creation. Which field to copy depends on whether the response includes an enterprise_id:

   • Single-workspace install (no enterprise_id in the response): copy the team_id value (starts with T, e.g., T12345678).
   • Enterprise Grid org-level install (the response also includes an enterprise_id): copy the enterprise_id value (starts with E, e.g., E12345678). In an org-level auth.test response, team_id carries the same E-prefixed value as enterprise_id, so either field works — copy enterprise_id to be explicit. Example:

   1
   {
   2
     "ok": true,
   3
     "url": "https://yourorg.enterprise.slack.com/",
   4
     "team": "Your Enterprise Org",
   5
     "user": "your-bot-name",
   6
     "team_id": "E12345678",
   7
     "user_id": "U12345678",
   8
     "bot_id": "B12345678",
   9
     "enterprise_id": "E12345678"
   10
   }

2. Validate Live Search Scope
   Authorize the Live Search app for a test user, then complete the OAuth 2.0 flow to obtain a user token and validate it:

   1. Get the Authorization (Sharable) URL
      1. Go to your Live Search app in the Slack API dashboard.
      2. Under **Manage Distribution → copy the Sharable URL.
      3. It will look like this:

         https://slack.com/oauth/v2/authorize?client_id=<CLIENT_ID>&user_scope=search:read.public,search:read.private,search:read.mpim,search:read.im,search:read.files,search:read.users
      4. Paste this URL into your browser and authorize the app using a Slack account from your workspace.
      5. After authorizing, you will be redirected to your Moveworks callback URL:

         https://www.moveworks.com
         Copy the value of <AUTH_CODE> from the URL — you’ll use it in the next step.
   2. Exchange the Authorization Code for a User Token
      Run the following cURL command to exchange the authorization code for a user token:

      $
      curl --location 'https://slack.com/api/oauth.v2.access' \
      >
        --header 'Content-Type: application/x-www-form-urlencoded' \
      >
        --data-urlencode 'client_id=<CLIENT_ID>' \
      >
        --data-urlencode 'client_secret=<CLIENT_SECRET>' \
      >
        --data-urlencode 'code=<AUTH_CODE>'
      You will receive a JSON response similar to:

      $
      {
      >
        "ok": true,
      >
        "authed_user": {
      >
          "id": "U12345",
      >
          "access_token": "xoxp-user1234567890"
      >
        },
      >
        "scope": "search:read.public,search:read.private,search:read.mpim,search:read.im,search:read.files,search:read.users",
      >
        "token_type": "user"
      >
      }
      Copy the authed_user.access_token value — this is the user access token that Moveworks will use for search queries.
   3. Validate the Token
      Test that the token has the correct RTS (search:read.*) scopes by calling the Real-Time Search endpoint:

      $
      curl --location 'https://slack.com/api/assistant.search.context' \
      >
        --header 'Authorization: Bearer <user_access_token>' \
      >
        --header 'Content-Type: application/json' \
      >
        --data '{"query":"test","channel_types":["public_channel","private_channel","mpim","im"]}'
      If successful, a JSON response ("ok": true) with matching search context will be returned. (If the token is missing the RTS scopes, the call returns an error such as missing_scope.)

Setup in Moveworks

Connector Creation

1. Log in to your org’s MyMoveworks portal
2. Navigate to Moveworks Setup > Connectors > Built-in Connectors
3. Click Create New
4. Search and Select Slack (Next Gen)
5. Click on Next: Add Creds
6. Input the following details and click Save
   1. Connector Name : Name this connector for your future reference. Once set, this name cannot be changed.
   2. Workspace Team ID: Paste the identifier you copied earlier from the auth.test response — the team_id (starts with T, e.g., T12345678) for a single-workspace install, or the enterprise_id (starts with E, e.g., E12345678) for an Enterprise Grid org-level install.
   3. Workspace-specific Slack Bot Token: Paste the Bot User OAuth token you copied earlier (must start with xoxb-).
   4. Client ID: Paste the Client ID you copied earlier from the Live Search Slack app (App Credentials).
   5. Client Secret: Paste the Client Secret you copied earlier from the Live Search Slack app (App Credentials).
   6. Region (optional): Select Commercial or GOV to match your Slack environment.

Initialising setup

1. Log in to your org’s MyMoveworks portal
2. Navigate to Moveworks Setup > Search > Configure Search > Max Capacity
3. Click on Create New or Get Started
4. Select Slack from the dropdown list and click on Get Started
5. You will be redirected to the Slack ingestion overview page. In the overview page, you will find few info blocks and few configuration blocks.
   1. System Overview: This presents an overview of Slack support from Moveworks
   2. Connector Selection: In this configuration block, you are required to select the required connector to enable Moveworks to connect and fetch data

Configuring Slack for Enterprise Search

Connector selection and validation

1. Once you click on Select Connector, a connector setup screen will appear as follows

2. Select the connector (from the dropdown) that you have created in the Connector Creation step.

   Please note: Only the Slack (Next Gen) connectors will appear in this list.

3. Once the connector is selected, you need to click on Start Validation to validate the connector credentials and required scopes. Validation runs in two stages:

   Connector Validation

   This is a mandatory step in order to save the configuration and move to the next step.

   Stage 1 — Connector scopes (Bot token). Moveworks validates that the connector’s bot token has the right scopes to fetch:

   • Channels: scopes to fetch channels information
   • Users: scopes to fetch user data
   • Groups: scopes to fetch user groups data

   Each check confirms both the scopes and that the fetch returns data — the workspace must contain at least one channel, one user, and one user group. For example, if a workspace has no user groups, the Groups check fails even when the scopes are correct; create at least one user group in that workspace and re-run validation.

   For Enterprise Grid org-level installs, Moveworks runs these checks against a single workspace resolved from the org token, so make sure every workspace where the app is installed has at least one channel, one user, and one user group.

   

   Once Stage 1 passes, the second stage runs:

   Stage 2 — Live Search (Real-Time Search). Moveworks validates the Real-Time Search (assistant.search.context) endpoint using the user (RTS) scope of the user configuring the Max Capacity flow:

   • Content: scopes to fetch content via live search
   

4. If both stages validate successfully, you will see a green info banner as follows.

   1. If there are any credentials or scope issues, you will receive an error message as follows. Click on View Details to identify the issue.

5. Once the connector is validated successfully, you will be able to Save the configuration.

6. Input the unique configuration name and Save.

7. Once the configuration is saved, you can view the unique configuration name at the top of the screen. You can also click the pencil 🖊️ icon to edit the configuration name.

8. Additionally, you will see a banner at the top of the screen with an Enable Live Search button. Click it to activate the Slack Live Search feature for your Enterprise Search web application.

Audience configuration

Live Search does not serve results until you set the audience. From the configuration’s home page, open the Target audience tab and choose who can search — source permissions are always enforced on top of your selection.

Audience configuration is the same for every Max Capacity connector. For the full steps and options, see Step 4: Define Target Audience in the Max Capacity Setup overview.