npm / @slack/web-api
@slack/web-api
What changed in @slack/web-api 7 to 8, from its official release notes, upgrade guides and advisories. Sources checked 2026-11-13.
59 breaking1 security7 deprecations52 new APIs and options3 behavior and defaults2 fixes and other
See which of these apply to your code, ranked, in your agent:
npx @unstale/cli init@slack/web-api 876 changes
Breaking changes 27
Removes Member.is_connector_bot from UsersListResponse because users.list does not return it; the flag is surfaced on bots.info.
Removes arg from UsersListResponse because it is an error-response echo field, not part of a successful users.list body.
The adapter option is removed; provide a custom fetch function instead.
The AdapterConfig type is removed; provide a custom fetch function instead.
The agent option is removed; configure proxies using Node.js proxy support or a custom fetch function.
This option is removed, and the original error is now always attached to WebAPIRequestError.
Errors are now Error subclasses, enabling instanceof checks, TypeScript narrowing, and descriptive error names.
Error names now identify their respective error classes, so filters based on error.name may need updating.
This exported factory function was removed; construct the corresponding error class instead.
The deprecated files.upload method is removed; use filesUploadV2 instead.
The default HTTP transport now uses the standard Fetch API, with globalThis.fetch as its default implementation.
This factory function was removed; use new WebAPIHTTPError(...) instead.
Node.js 20 or later is required; support for Node.js 18 is dropped.
This factory function was removed; use new WebAPIPlatformError(...) instead.
This factory function was removed; use new WebAPIRateLimitedError(...) instead.
The RequestConfig type is removed; use a fetch wrapper instead.
RequestConfig, an alias for Axios' InternalAxiosRequestConfig, was removed entirely.
This factory function was removed; use new WebAPIRequestError(...) instead.
The requestInterceptor option is removed; wrap fetch to intercept or modify requests.
The RequestInterceptor type is removed; wrap fetch to intercept or modify requests.
The deprecated rtm.start method is removed; use rtm.connect instead.
The tls option is removed; configure TLS through a custom fetch function instead.
The TLSOptions export is removed; configure TLS through a custom fetch function instead.
headers is now Record<string, string> instead of IncomingHttpHeaders, with values always plain strings.
The deprecated workflows.stepCompleted method is removed; no replacement is provided.
The deprecated workflows.stepFailed method is removed; no replacement is provided.
The deprecated workflows.updateStep method is removed; no replacement is provided.
Security 1
API response bodies in debug logs are now redacted recursively into nested objects, preventing tokens from leaking when debug logging is enabled.
Deprecations 3
Deprecates alt_text in files.getUploadURLExternal arguments.
Deprecates alt_text; when passed to files.uploadV2, it is still sent as alt_txt.
The interface is deprecated; use instanceof checks with specific error classes instead.
New APIs and options 43
Adds support for apps.user.connection.bulkUpdate.
Adds support for apps.user.connection.requestAuth.
Adds the canvases.getContent method.
Adds the code_channels app manifest feature to manifest types.
Adds the code_channels:manage bot scope to manifest types.
Adds alt_txt to files.getUploadURLExternal arguments.
Adds alt_txt to files.uploadV2 arguments so image alt text is saved.
Adds the optional include_slackbot_availability argument to team.info.
Adds team.slackbot_availability to the team.info response.
Adds the user_connection event to the app manifest types.
Adds the user_connection_status_requested event to the app manifest types.
Adds the auth_hosts field to the user_connections app manifest feature.
Adds the is_enabled field to the user_connections app manifest feature.
Adds a method for archiving Slack Code conversations.
Adds a method for creating Slack Code conversations.
Adds a method for getting a canvas in Slack Code conversations.
Adds a method for listing views in Slack Code conversations.
Adds a method for removing a view from Slack Code conversations.
Adds a method for setting canvas content in Slack Code conversations.
Adds a method for setting commands in Slack Code conversations.
Adds a method for setting Slack Code conversation properties.
Adds a method for setting a view in Slack Code conversations.
Adds support for the admin.users.getExpiration method.
Adds the agent_session response property to message-bearing responses.
Adds the agents.sessions.rename method.
Adds the agents.sessions.setStatus method.
Adds the blocks.validate method.
Adds connector and workflow flags to BotsInfoResponse.
Adds session_status to the chat.stopStream arguments.
Adds grouping, sort, and filter fields to ListView response types.
App manifest types now include the agent_view feature.
App manifest types now include this recent agent event.
App manifest types now include this recent agent event.
App manifest types now include this recent agent event.
App manifest types now include the assistant_view feature.
App manifest types now support optional OAuth scopes for bots.
WebClientOptions accepts a fetch function for custom HTTP transport behavior; without one, the SDK uses globalThis.fetch.
A new exported type is available for custom fetch implementations.
A new exported type is available for custom fetch implementations.
A new exported type is available for custom fetch implementations.
A new exported type is available for custom fetch implementations.
App manifest types now include event metadata_subscriptions.
App manifest types now support optional OAuth scopes for users.
Behavior and default changes 1
Request errors populate the standard Error.cause property with the underlying network error; original remains for backward compatibility.
Fixes and other changes 1
Reverts internal packages requiring ESM loading to support backward compatibility.
@slack/web-api 748 changes
Breaking changes 32
TypeScript arguments must provide exactly one of request_id and app_id, and exactly one of enterprise_id and team_id; the latter pair requires one value.
TypeScript arguments for component_type, min_log_level, sort_direction, and source now accept only documented values.
TypeScript arguments no longer allow both request_id and app_id, or both enterprise_id and team_id; one of enterprise_id or team_id is required.
TypeScript entity_type and policy_name arguments are restricted to USER and email_password, respectively.
The argument must be the exact array ['im', 'mpim', 'call'], rather than an arbitrary string array.
TypeScript arguments require nonempty channel_ids, team_ids, and user_ids; org_wide and team_id must follow mutually exclusive constraints.
function_ids must be nonempty, and visibility is restricted to the documented enumeration.
entity_ids and user_ids must be nonempty; sort_dir accepts only asc or desc.
team_discoverability and discoverability accept only documented values, and channel_ids must be nonempty.
channel_ids and user_ids must each contain at least one ID.
team_id and include_deactivated_user_workspaces now have interdependent TypeScript constraints: provide team_id without a true flag, or set the flag true and omit team_id.
TypeScript arguments must provide both team_id and user_id, or neither.
collaborator_ids and workflow_ids must each contain at least one ID.
sort_dir, sort, and source now accept only their listed values rather than arbitrary strings.
Arguments are now required; pass an empty object when there are no arguments to provide.
The manifest argument is now modeled as a detailed object instead of a string.
Arguments are now required; pass an empty object when there are no arguments to provide.
type accepts only link; link is required for bookmarks.add and remains optional for bookmarks.edit.
Message-posting APIs require text, attachments, or blocks; text can be omitted with attachments or blocks. Additional constraints apply to as_user, username, icon_emoji, icon_url, reply_broadcast, and thread_ts.
TypeScript arguments must specify exactly one of channel_id and invite_id.
TypeScript arguments must specify exactly one of emails and user_ids.
TypeScript arguments must specify exactly one of channel and users.
File arguments now require content or file; thread_ts requires a channel argument; files arrays must be nonempty; remote file APIs require exactly one of file and external_id.
The minimum supported and tested Node.js version is now 18.
channel and timestamp are required, and file and file_comment are no longer supported arguments.
Arguments must provide channel and timestamp together, or a file ID, or a file_comment ID.
Arguments must provide channel and timestamp together, or a file ID, or a file_comment ID.
Arguments require channel and timestamp together, or a file ID, or a file_comment ID.
Arguments require channel and timestamp together, or a file ID, or a file_comment ID.
change_type now accepts only added, removed, enabled, disabled, or updated rather than arbitrary strings.
Arguments now accept either external_id or view_id, but not both.
TypeScript method arguments no longer accept arbitrary or undocumented properties, and many methods enforce stricter argument combinations.
Deprecations 4
These methods are deprecated; use equivalent conversations.* APIs where available.
These methods are deprecated; use equivalent conversations.* APIs where available.
These methods are deprecated; use equivalent conversations.* APIs where available.
These methods are deprecated; use equivalent conversations.* APIs where available.
New APIs and options 9
Added assistant_thread_started as a recent agent event.
Added bot_optional as an optional OAuth scope.
Adds a public read-only ts getter, allowing developers to fall back to chat.update when a stream expires server-side.
Adds highlight_type to files.completeUploadExternal and filesUploadV2 for optimistic rendering.
Adds the icon_emoji, icon_url, and username authorship arguments, allowing customization of the status message’s icon and displayed username.
Adds the icon_emoji, icon_url, and username authorship arguments, allowing customization of the stream message’s icon and displayed username.
Adds support for the apps.user.connection.update API method.
Supports overriding the token when using fileUploadV2.
All views APIs accept either trigger_id or interactivity_pointer.
Behavior and default changes 2
The thread_ts parameter is now optional when calling assistant.threads.setSuggestedPrompts.
Invocations no longer emit a warning about lack of fallback text.
Fixes and other changes 1
Characters outside the Latin-1 range are URI-encoded in the user-agent header, preventing errors when process.title contains non-ASCII characters.