PRC Slack REST API

Events API, interactions, admin settings, and the profile Connect Slack route.

Auth summary

Settings

GET redacts stored token and signing-secret overrides as ********. POST with that sentinel keeps the stored secret. GET also returns the read-only factory_webhook_url, origin_api_configured, and environment values. POST rejects invalid payloads with HTTP 400 and { "error": "Invalid payload." }.

Connect user

Looks up the profile user's WordPress email with Slack users.lookupByEmail and writes prc_slack_user_id. It does not return an existing meta value first, so Reconnect Slack can replace a stale ID. Omit user_id to connect the current user. Admins editing someone else must send that user's ID.

A miss returns HTTP 404 and names the email. If the bot token lacks users:read.email, the route returns HTTP 503 and asks you to reinstall or re-auth the Slack app. The WordPress profile Connect Slack button calls this route and hides when prc-slack cannot send.

Content-Type: application/json

{
  "user_id": 12
}

{
  "slack_user_id": "U01ABCD2EFG",
  "email": "ada@example.com"
}

Slack webhooks

Content-Type: application/jsonX-Slack-Signature: v0=…X-Slack-Request-Timestamp: 1710000000

{
  "type": "url_verification",
  "challenge": "example-challenge"
}

{
  "challenge": "example-challenge"
}

/interactions verifies the Slack HMAC, replay window, and team ID without reading the PRC Nexus chat toggle. It routes block_actions with action ID prc_factory_merge to the factory handler. Other actions receive the same { "ok": true } response and no factory work.

Origin webhooks

The permission callback verifies these headers:

WordPress hashes webhook-id.webhook-timestamp.rawBody with SHA-256. It verifies the lowercase hexadecimal digest string against the Ed25519 public keys from https://api.cursor.com/v1/origin/keys.

Valid requests return { "ok": true } with HTTP 200. A disabled factory returns the same response and queues no work. Duplicate, unsupported, and ignored events also return HTTP 200. Accepted events queue prc_slack_factory_delivery.

Origin signature errors

Slack signature errors

url_verification skips the signature check. Chat must still be enabled.

Related

• User guide
• Architecture