# Org roles and tokens for management APIs

*Slack Developer Study Guide · APIs for Managing Your Slack · Last updated October 21, 2026 · https://www.certifyforce.com/study-guide/slack-developer/apis-for-managing-your-slack/org-roles-and-tokens-for-management-apis*

Which Slack role must install or enable each management API and which token it yields: Org Admin or Owner for admin.* scopes, Org Owner only for the SCIM app and Audit Logs, Primary Org Owner or Org Owner for Discovery, plus org-level installs, xoxp user tokens and the same-or-fewer-permissions rule.

- Certification: Salesforce Slack Developer
- Exam section: APIs for Managing Your Slack
- Study guide: https://www.certifyforce.com/study-guide/slack-developer

**Official exam objective:**

> Identify the required user role to generate a token to use APIs to automate a Slack workspace or org administration.

## What the exam expects

- Identify the role that must install, or request, each management API in an Enterprise org: Admin API (`admin.*` scopes), SCIM, Audit Logs and Discovery.
- Identify the token each one uses (an `xoxp` user token from an org-level install) and why bot, app-level and configuration tokens do not work.
- Explain why the install must target the Enterprise org, not a workspace, and read the errors a wrong role or wrong target produces.
- Apply the SCIM rule that a token acts only on accounts with the same or fewer permissions, and the Business+ SCIM roles.

Key terms: **Primary Org Owner** (the single top owner of an Enterprise org); **Org Owner** and **Org Admin** (org-level roles above Workspace Owners and Admins); **org-level install** (choosing the Enterprise org, not a workspace, on the OAuth install screen); **user token** (`xoxp`, issued for the installing user and carrying their access); **token-generating account** (the installer whose role the token inherits).

## Key facts

| Fact | Detail | Source |
|---|---|---|
| `admin.*` scopes | Installed by an Org Admin or Owner on the entire org | [admin.apps:write scope](https://docs.slack.dev/reference/scopes/admin.apps.write) |
| Admin scope token type | User token only | [admin.apps:write scope](https://docs.slack.dev/reference/scopes/admin.apps.write) |
| User token prefix | `xoxp-`, issued for the installing user | [Tokens](https://docs.slack.dev/authentication/tokens/) |
| SCIM app in an Enterprise org | Only Org Owners install; Org Owners and Admins can use it | [Using the SCIM API](https://docs.slack.dev/admins/scim-api/) |
| SCIM token reach | Same or fewer permissions than the generating account | [Using the SCIM API](https://docs.slack.dev/admins/scim-api/) |
| Audit Logs token | `xoxp` of an Enterprise org owner; admin tokens not supported | [Methods & actions](https://docs.slack.dev/reference/audit-logs-api/methods-actions-reference/) |
| `user_not_authorized` | Audit Logs installer is not an Org Owner | [Methods & actions](https://docs.slack.dev/reference/audit-logs-api/methods-actions-reference/) |
| Discovery enablement | Primary Org Owner or an Org Owner requests it | [Discovery APIs guide](https://slack.com/help/articles/360002079527) |
| Legal Holds token | Revoked if the installer drops below Org Owner | [Using the Legal Holds API](https://docs.slack.dev/admins/legal-holds-api/) |

## Check yourself

- Why does a SIEM app installed by an Org Admin get `user_not_authorized`?
- When can an Org Admin complete the install of a management app?
- Which token does an org-installed admin app use to call `admin.users.session.reset`?
- Why can't an Admin-generated SCIM token update an Owner's profile?
- Who can request Discovery API enablement?

## Sources

- [Using the Audit Logs API](https://docs.slack.dev/admins/audit-logs-api/)
- [Audit Logs API methods & actions](https://docs.slack.dev/reference/audit-logs-api/methods-actions-reference/)
- [Using the Slack SCIM API](https://docs.slack.dev/admins/scim-api/)
- [SCIM API reference](https://docs.slack.dev/reference/scim-api/)
- [admin.apps:write scope](https://docs.slack.dev/reference/scopes/admin.apps.write)
- [admin.teams.list method](https://docs.slack.dev/reference/methods/admin.teams.list)
- [admin.apps.approve method](https://docs.slack.dev/reference/methods/admin.apps.approve)
- [Tokens](https://docs.slack.dev/authentication/tokens/)
- [A guide to Slack's Discovery APIs](https://slack.com/help/articles/360002079527)
- [Permissions by role in Slack](https://slack.com/help/articles/201314026)
- [Using the Legal Holds API](https://docs.slack.dev/admins/legal-holds-api/)

## About the full unit

The "Core concepts", "Exam traps" and "Worked scenario" sections of this unit, its 6 linked practice questions, and unlimited timed mock exams are included with the Slack Developer pack (USD $19): https://www.certifyforce.com/practice-exams