openapi: 3.1.0
info:
  version: '1.0'
  title: Slack Admin Access Authentication API
  description: "The Slack Admin API is a set of privileged endpoints\x14primarily under admin.* with related SCIM and Audit Logs APIs\x14that lets Enterprise Grid owners and admins automate organization\x11 wide management and governance. It covers user lifecycle (provision, suspend, assign roles), workspace and channel administration across workspaces (create, move, archive channels; manage membership and settings), app governance (approve/deny or allowlist/ban apps and install them to workspaces), invite request handling, and security/compliance controls such as information barriers, session and authentication policies, and org\x11level analytics exports. These APIs require elevated admin scopes and are commonly used to power automated onboarding/offboarding, centralized channel and app controls, and integrations with identity, ITSM, and compliance systems."
tags:
- name: Authentication
paths:
  /openid.connect.token:
    post:
      tags:
      - Authentication
      summary: Exchange OpenID Connect Token
      description: Exchanges an authorization code for an OpenID Connect access token and ID token.
      operationId: postOpenIdConnectToken
      requestBody:
        required: true
        content:
          application/x-www-form-urlencoded:
            schema:
              required:
              - client_id
              - client_secret
              - code
              type: object
              properties:
                client_id:
                  type: string
                  description: The Slack app's client ID.
                client_secret:
                  type: string
                  description: The Slack app's client secret.
                code:
                  type: string
                  description: The authorization code received from the Sign in with Slack flow.
                redirect_uri:
                  type: string
                  description: The redirect URI that was used in the authorization request.
                grant_type:
                  type: string
                  description: The grant type, must be "authorization_code".
                  enum:
                  - authorization_code
                  - refresh_token
                refresh_token:
                  type: string
                  description: The refresh token, required when grant_type is refresh_token.
      responses:
        '200':
          description: Successful response with tokens
          content:
            application/json:
              schema:
                type: object
                properties:
                  ok:
                    type: boolean
                  access_token:
                    type: string
                    description: The OpenID Connect access token.
                  token_type:
                    type: string
                    description: The token type (Bearer).
                  id_token:
                    type: string
                    description: A signed JWT ID token containing the user's identity claims.
                  refresh_token:
                    type: string
                    description: A refresh token for obtaining new access tokens.
                  expires_in:
                    type: integer
                    description: Token expiration time in seconds.
              example:
                ok: true
                access_token: xoxp-1234
                token_type: Bearer
                id_token: eyJhbGciOiJSUzI1NiJ9.example
        default:
          description: Error response
          content:
            application/json:
              schema:
                type: object
                properties:
                  ok:
                    type: boolean
                  error:
                    type: string
              example:
                ok: false
                error: invalid_client_id
  /openid.connect.userInfo:
    get:
      tags:
      - Authentication
      summary: Get OpenID Connect User Info
      description: Retrieves identity information about a user authenticated via Sign in with Slack.
      operationId: getOpenIdConnectUserInfo
      parameters:
      - name: token
        in: query
        description: OpenID Connect access token.
        required: true
        schema:
          type: string
      responses:
        '200':
          description: Successful response with user identity
          content:
            application/json:
              schema:
                type: object
                properties:
                  ok:
                    type: boolean
                  sub:
                    type: string
                    description: Subject identifier (the user's Slack ID).
                  https://slack.com/user_id:
                    type: string
                    description: The user's Slack user ID.
                  https://slack.com/team_id:
                    type: string
                    description: The user's team ID.
                  email:
                    type: string
                    description: The user's email address.
                  email_verified:
                    type: boolean
                    description: Whether the email address has been verified.
                  name:
                    type: string
                    description: The user's display name.
                  picture:
                    type: string
                    description: URL to the user's profile picture.
                  given_name:
                    type: string
                    description: The user's given name.
                  family_name:
                    type: string
                    description: The user's family name.
              example:
                ok: true
                sub: U0R7JM
                email: krane@example.com
                email_verified: true
                name: Krane
                picture: https://secure.gravatar.com/avatar/example.jpg
        default:
          description: Error response
          content:
            application/json:
              schema:
                type: object
                properties:
                  ok:
                    type: boolean
                  error:
                    type: string
              example:
                ok: false
                error: not_authed
      security:
      - slackAuth:
        - openid