Skip to main content

admin.auth.policy.assignEntities method

Welcome to the new home of Slack developer docs!

We're still building and not all features are available quite yet. Enjoy this peek into the future!

Not ready for the future? Return to the past at api.slack.com.

Usage info​

This Admin API method assigns entities (currently, users) to an authentication policy—for example, signing in with email and password.

For help understanding URL-encoded vs JSON format in your request (particularly entity_ids), see POST Bodies below. This admin scope is obtained through version two of the OAuth V2 flow, but there are a few additional requirements. The app requesting this scope must be installed by an admin or Owner of an Enterprise Grid organization. Also, the app must be installed on the entire org, not on an individual workspace. See below for more details.

If the app is installed by an Org Admin or Owner, ensure the Channel Management settings provide the appropriate permissions. The Org Admin or Owner installing the app must have the Channel Management role, and must also be granted access to Public channels and Private channels within this role. If these criteria aren't met, the Org Admin or Owner will receive a not_allowed error when attempting to install an app.

Admin API endpoints reach across an entire Enterprise Grid organization, not individual workspaces.

For a token to be imbued with Admin scopes, it must be obtained from installing an app on the entire Grid org, not just a workspace within the organization.

To configure and install an app supporting Admin API endpoints on your Enterprise Grid organization:

  1. Create a new Slack app. Your app will need to be able to handle a standard OAuth 2 flow.
  2. In the app's settings, select OAuth & Permissions from the left navigation. Scroll down to the section titled Scopes and add the admin.* scope you want. Click the Save Changes button.
  3. In the app's settings, select Manage Distribution from the left navigation. Under the section titled Share Your App with Other Workspaces, make sure all four sections have the green check. Then click the green Activate Public Distribution button.
  4. Under the Share Your App with Your Workspace section, copy the Sharable URL and paste it into a browser to initiate the OAuth handshake that will install the app on your organization. You must be logged in as an admin or Owner of your Enterprise Grid organization to install the app.
  5. Check the dropdown in the upper right of the installation screen to make sure you are installing the app on the organization, not an individual workspace within the organization. See the image below for a visual.
  6. Once your app completes the OAuth flow, you will be granted an OAuth token that can be used for calling Admin API methods for your organization.

When installing an app to use an Admin API endpoint, be sure to install it on your Grid organization, not a workspace within the organization.

POST Bodies​

As outlined in Using the Slack Web API, you may present your arguments as either standard POST parameters or use JSON instead. This may be confusing in terms of the array argument type, so let's look at an example for each.

Here's an example of calling the method with a URL-encoded query string:

curl --request 'POST' --header 'Authorization: Bearer xoxp-...' 'https://slack.com/api/admin.auth.policy.assignEntities?entity_ids=U0130R122E8%2C%20U0133AHT0M8&entity_type=USER&policy_name=email_password&pretty=1'

Here's an example of calling the method with a JSON body:

curl --request 'POST' --header 'Authorization: Bearer xoxp-...' --header 'Content-Type: application/json; charset=utf-8'  'https://slack.com/api/admin.auth.policy.assignEntities' -d '{
    "entity_ids": [
        "U0130R122E8",
        "U0133AHT0M8"
    ],
    "entity_type": "USER",
    "policy_name": "email_password"
}'

Both will yield the same result, so it's potato po-tah-to as far as we're concerned.

Response​