Webhook subscriptions accept a `format` field on creation: `json` (the default — canonical Kodori event shape with HMAC signature headers) or `slack` (Block Kit, optimized for Slack Incoming Webhooks).
**To wire Slack:**
1. In Slack, create an Incoming Webhook for the channel that should receive Kodori notifications. Slack will give you a URL like `https://hooks.slack.com/services/T.../B.../...`. 2. In Kodori, go to /webhooks → Create webhook. 3. Paste the Slack URL into the URL field. 4. Pick **Slack Block Kit** as the payload format. 5. Pick the events you want to broadcast — typically `anomaly.detected`, `anomaly.auto-paused`, `document.dlp-flagged`, `legal-hold.applied` for compliance channels, or `document.created` / `document.tombstoned` for everything-firehose channels. 6. Save. Future events of the matching types will appear in the Slack channel.
**What the Slack message looks like**
Kodori renders each event with:
- A header block: "Kodori" - A bold one-line headline (e.g. *"Legal hold applied: Smith v. Acme — 24-cv-1234"* or *"Anomaly detected (high): high-volume-regulated-read"*) - A field block with actor / reason / matter when relevant - A context line with the raw event type, stream id, version, and ISO timestamp for operators who need to cross-reference /audit
**Signature verification doesn't apply**
Slack's Incoming Webhook endpoints don't read Authorization or signature headers — they trust the secret URL. Kodori still posts the standard `X-Kodori-Signature` headers (harmless extra metadata) but you don't need to verify them on the Slack side. **Treat the Slack webhook URL itself as the secret.** Anyone with it can post to your channel; rotate by creating a new Slack webhook URL and updating your Kodori subscription.
**Filtering**
Pair with the event-type filter on the subscription to scope what reaches Slack. For an "incidents only" channel, subscribe to `anomaly.detected`, `anomaly.auto-paused`, `document.dlp-flagged`, `tenant.payment-failed`. For a fuller compliance feed, add `legal-hold.applied`, `legal-hold.released`, `document.sensitivity-changed`, `retention.class-archived`.
**For other chat platforms**
Microsoft Teams, Discord, and other chat platforms accept different webhook payload shapes. We add adapter formats on customer demand — file a request and we'll prioritize.