<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->
<!-- NERF is a trademark of defconxt. -->
# Security ChatOps Integration — API Reference

## Slack Web API (Bot)

```python
from slack_sdk import WebClient

client = WebClient(token="xoxb-your-bot-token")

# Post message with blocks
client.chat_postMessage(channel="#soc-alerts", blocks=[...], text="Alert fallback")

# Update message
client.chat_update(channel="C0XXXXXX", ts="1234567890.123456", blocks=[...])

# Add reaction
client.reactions_add(channel="C0XXXXXX", name="eyes", timestamp="1234567890.123456")
```

## Slack Events API (Bolt)

```python
from slack_bolt import App

app = App(token="xoxb-token", signing_secret="secret")

@app.action("ack_alert")
def handle_ack(ack, body, client):
    ack()
    user = body["user"]["username"]
    client.chat_postMessage(channel=body["channel"]["id"],
        text=f"Alert acknowledged by {user}")

@app.command("/investigate")
def handle_investigate(ack, command, respond):
    ack()
    alert_id = command["text"]
    respond(f"Starting investigation on {alert_id}...")
```

## PagerDuty Events API v2

```python
import requests

requests.post("https://events.pagerduty.com/v2/enqueue", json={
    "routing_key": "R0XXXXXXXXXXXX",
    "event_action": "trigger",
    "payload": {
        "summary": "Critical security incident requires immediate attention",
        "severity": "critical",
        "source": "soar-chatops",
        "component": "soc-automation",
    },
})
```

## Microsoft Teams Webhook

```python
requests.post("https://outlook.office.com/webhook/...", json={
    "@type": "MessageCard",
    "summary": "Security Alert",
    "sections": [{"activityTitle": "Critical: Lateral movement detected"}],
})
```

## Exit Codes

| Code | Meaning |
|------|---------|
| 0 | Message sent / command processed |
| 1 | Delivery warning (rate limited, partial) |
| 2 | Send failed or command error |
