Issue with Slack Event Subscriptions Verification via Triggered Automation (HTTP 403 / Query Parameter Authentication)

[tkodama]

Hi Qlik Community,

I am attempting to integrate Qlik Cloud Automation with Slack Event Subscriptions to handle @mention queries using Qlik Answers.

However, I am stuck at the Slack Event Subscriptions url_verification step and unable to achieve Verified status.

Setup Overview:

1. Trigger: Triggered Automation (Start block set to Webhook/Triggered).

2. Verification Logic:

   • Condition block checks if Start > body > challenge is not empty.

   • YES branch: Routes directly to an Output block returning Start > body > challenge, immediately followed by a Stop block.

3. Authentication:

   • Slack Event Subscriptions does not allow sending custom HTTP headers (such as -H "X-Execution-Token: <TOKEN>").

   • Therefore, I am appending the token as a query parameter in Slack's Request URL: https://<tenant>[.qlikcloud.com/api/v1/automations/](https://.qlikcloud.com/api/v1/automations/)<automation-id>/actions/execute?X-Execution-Token=<TOKEN>

What Works:

• Sending a POST request via curl with the token in the HTTP Header works perfectly and returns the challenge string: curl -X POST "<URL>" -H "X-Execution-Token: <TOKEN>" -H "Content-Type: application/json" -d "{\"type\": \"url_verification\", \"challenge\": \"test_123\"}"

The Problem:

• When testing with query parameter authentication (which Slack relies on), the request fails with an HTTP 403 Forbidden error: {"errors":[{"code":"HTTP-403","title":"No permission.","detail":"You don't have sufficient permissions to access this resource."}]}

• We confirmed this 403 Forbidden response using Google Apps Script / UrlFetchApp when sending the token via query parameter (?X-Execution-Token=<TOKEN>).

Questions:

1. Does Qlik Cloud Automation support executing Triggered Automations when the X-Execution-Token is passed via URL query parameters (?X-Execution-Token=...) instead of HTTP Headers?

2. Is there a specific setting or URL format required to allow Slack Event Subscriptions to authenticate successfully without custom HTTP headers?

Any advice or workarounds would be greatly appreciated. Thank you!

[Dave_Channon]

Hi @tkodama 

Query param authentication was removed this year to reduce the risk of log exposure of credentials, so unfortunately is no longer available - see https://community.qlik.com/t5/Support-Updates/Qlik-Automate-Execution-tokens-will-become-header-para...for more information.

For your use case, are you trying to '@' answers from slack and have it respond in the provided user's context?