Permissions

Each endpoint and event needs a permission (a scope), given to the app by whoever manages it (a workspace admin, or the member who made it when the workspace allows that) under Manage → Installed apps → the app → Permissions. Removing a permission takes effect at once. Subscribing to an event in Event subscriptions adds the permission it needs.

An app made by a member follows that member: if they leave the workspace or delete their account the app is deactivated, and if they leave a private channel the app leaves it too. An admin can reactivate it: deactivating an app revokes its token and webhook URLs, so reactivating always issues new ones.

Scope	Opens
incoming-webhook	Incoming webhook URLs
chat:write	POST /messages
reactions:write	POST and DELETE /reactions
channels:read	GET /channels: public channels, each with is_member
groups:read	adds to GET /channels the private channels the app already belongs to
channels:join	POST /channels/{id}/join (public channels only)
channels:history	GET /channels/{id}/messages, and the message.channel and message.im events
users:read	GET /users (ids and names, never emails)
app_mentions:read	the app_mention event
commands	slash commands the app registered, and answering them

An app can read or write inside a channel only while it belongs to it. It joins public channels itself (channels:join); a private channel needs a person to add it.

A missing permission answers 403 with error: "missing_scope" and needed naming it.