Org roles and tokens for management APIs
Which Slack role must install or enable each management API and which token it yields: Org Admin or Owner for admin.* scopes, Org Owner only for the SCIM app and Audit Logs, Primary Org Owner or Org Owner for Discovery, plus org-level installs, xoxp user tokens and the same-or-fewer-permissions rule.
Identify the required user role to generate a token to use APIs to automate a Slack workspace or org administration.
~8 min read · 6 practice questions ·
What the exam expects
- Identify the role that must install, or request, each management API in an Enterprise org: Admin API (
admin.*scopes), SCIM, Audit Logs and Discovery. - Identify the token each one uses (an
xoxpuser token from an org-level install) and why bot, app-level and configuration tokens do not work. - Explain why the install must target the Enterprise org, not a workspace, and read the errors a wrong role or wrong target produces.
- Apply the SCIM rule that a token acts only on accounts with the same or fewer permissions, and the Business+ SCIM roles.
Key terms: Primary Org Owner (the single top owner of an Enterprise org); Org Owner and Org Admin (org-level roles above Workspace Owners and Admins); org-level install (choosing the Enterprise org, not a workspace, on the OAuth install screen); user token (xoxp, issued for the installing user and carrying their access); token-generating account (the installer whose role the token inherits).
Key facts
admin.* scopes- Detail
- Installed by an Org Admin or Owner on the entire org
- Detail
- User token only
- Detail
xoxp-, issued for the installing user
- Detail
- Only Org Owners install; Org Owners and Admins can use it
- Detail
- Same or fewer permissions than the generating account
- Detail
xoxpof an Enterprise org owner; admin tokens not supported
user_not_authorized- Detail
- Audit Logs installer is not an Org Owner
- Detail
- Primary Org Owner or an Org Owner requests it
- Detail
- Revoked if the installer drops below Org Owner
Sources for this section (6)
- admin.apps:write scopedocs.slack.dev (opens in a new tab)
- Tokensdocs.slack.dev (opens in a new tab)
- Using the SCIM APIdocs.slack.dev (opens in a new tab)
- Methods & actionsdocs.slack.dev (opens in a new tab)
- Discovery APIs guideslack.com (opens in a new tab)
- Using the Legal Holds APIdocs.slack.dev (opens in a new tab)
- Why does a SIEM app installed by an Org Admin get `user_not_authorized`?
- When can an Org Admin complete the install of a management app?
- Which token does an org-installed admin app use to call `admin.users.session.reset`?
- Why can't an Admin-generated SCIM token update an Owner's profile?
- Who can request Discovery API enablement?
The questions are free to read. Answers with their sources and self-grading are included with the pack.
Keep reading with the Slack Developer pack
- Core concepts
- Exam traps
- Worked scenario
The pack includes:
- All 38 lessons of the Slack Developer guide, with reading progress
- Interactive decision walks and step-by-step sequence steppers
- Inline practice questions and one-click topic practice (6 questions for this lesson)
- An official source cited for every claim
- An AI tutor that answers from the guide
- Unlimited timed practice exams