# Discovery API for eDiscovery and DLP

*Slack Developer Study Guide · APIs for Managing Your Slack · Last updated October 21, 2026 · https://www.certifyforce.com/study-guide/slack-developer/apis-for-managing-your-slack/discovery-api-for-ediscovery-and-dlp*

When the Discovery API is the answer: permitted security and compliance uses only, approved eDiscovery partners that archive read-only versus DLP partners that quarantine or remove, edits and deletions preserved by retention and legal holds, and the content types it exports.

- Certification: Salesforce Slack Developer
- Exam section: APIs for Managing Your Slack
- Study guide: https://www.certifyforce.com/study-guide/slack-developer

**Official exam objective:**

> Recommend when to use the Discovery API for data-loss prevention, compliance archiving or eDiscovery.

## What the exam expects

- Recommend the Discovery API, through an approved partner app, when an Enterprise org must collect, archive or police message and file content for security or compliance.
- Choose between an eDiscovery partner (read-only capture into an external archive) and a DLP partner (read and write, quarantine or remove in Slack).
- Refuse uses outside the permitted cases, such as analytics or sentiment dashboards, and point to the right API instead.
- Explain what the Discovery API exports, including edits and deletions preserved by retention policies or legal holds.
- Reject look-alike answers: the Audit Logs API, standard exports and bot-token scripts.

Key terms: **Discovery API** (Slack's API for exporting or acting on an Enterprise org's messages and files through approved third-party apps); **eDiscovery** (collecting and preserving communications for legal cases or compliance records); **DLP** (data loss prevention: scanning content against policies and enforcing them); **legal hold** (preserves a custodian's data regardless of deletion); **partner app** (an approved third-party eDiscovery or DLP product).

## Key facts

| Fact | Detail | Source |
|---|---|---|
| Permitted uses | Security and compliance only: eDiscovery, archiving, DLP | [Discovery APIs guide](https://slack.com/help/articles/360002079527) |
| Who enables it | Primary Org Owner or an Org Owner requests; then all Org Owners can use it | [Discovery APIs guide](https://slack.com/help/articles/360002079527) |
| Plan | Enterprise plans | [Discovery APIs guide](https://slack.com/help/articles/360002079527) |
| How it is used | Through approved third-party eDiscovery or DLP apps | [Discovery APIs guide](https://slack.com/help/articles/360002079527) |
| eDiscovery access | Typically read-only; cannot quarantine, remove or tag in Slack | [Discovery APIs guide](https://slack.com/help/articles/360002079527) |
| DLP access | Read and write; quarantined content can be reviewed or removed | [Discovery APIs guide](https://slack.com/help/articles/360002079527) |
| History | From the start of the org, plus edits and deletions preserved by retention or legal holds | [Discovery APIs guide](https://slack.com/help/articles/360002079527) |
| Data points | Messages, files, canvases, lists, emoji reactions, Slackbot conversations; JSON by default | [Discovery APIs guide](https://slack.com/help/articles/360002079527) |
| Legal holds | Preserve custodians' data but give no access to the content | [Using the Legal Holds API](https://docs.slack.dev/admins/legal-holds-api/) |
| Sandboxes | No Discovery API unless you are in the partner program | [Developer sandboxes](https://docs.slack.dev/tools/developer-sandboxes/) |

## Check yourself

- Why can't a product team use the Discovery API for an engagement dashboard?
- When is a DLP partner the right choice over an eDiscovery partner?
- When can the Discovery API return a deleted message?
- Which content types does the Discovery API export?

## Sources

- [A guide to Slack's Discovery APIs](https://slack.com/help/articles/360002079527)
- [Admin resources](https://docs.slack.dev/admins/)
- [Using the Legal Holds API](https://docs.slack.dev/admins/legal-holds-api/)
- [Using the Audit Logs API](https://docs.slack.dev/admins/audit-logs-api/)
- [Export your workspace data](https://slack.com/help/articles/201658943-Export-your-workspace-data)
- [admin.analytics.getFile method](https://docs.slack.dev/reference/methods/admin.analytics.getFile)
- [chat.delete method](https://docs.slack.dev/reference/methods/chat.delete)
- [Developer sandboxes](https://docs.slack.dev/tools/developer-sandboxes/)

## About the full unit

The "Core concepts", "Exam traps" and "Worked scenario" sections of this unit, its 6 linked practice questions, and unlimited timed mock exams are included with the Slack Developer pack (USD $19): https://www.certifyforce.com/practice-exams