{
  "schema": "varexis-public-evidence-record/0.3",
  "generated_at_utc": "2026-10-16T12:55:40.483Z",
  "record_id": "VXI-EXT-PROCUREMENT-SLACK-TOKEN-ROTATION-01-v1",
  "record_kind": "external_reference",
  "title": "Slack rotation: Expiring access and refresh continuity",
  "system": "Slack apps",
  "evidence_family": "vendor_evidence_review",
  "index_status": "PUBLIC_SAFE_SOURCE_REVIEW",
  "evidence_state": "PRIMARY_DOCUMENTATION_REVIEW_ONLY",
  "canonical_question": "Does enabling Slack token rotation provide uninterrupted access without further state handling?",
  "near_questions": [
    "Does a rotated Slack access token expire?",
    "Must the replacement refresh token be saved?",
    "Can the original refresh token be reused indefinitely?",
    "What happens if credentials expire before refresh?",
    "Can repeated early refreshes revoke older tokens?",
    "Is token exchange the same as reinstalling the app?",
    "Can revoking the original token disrupt installation?",
    "Which installation does the token represent?",
    "Do concurrent workers share refresh state safely?",
    "Were expiry and recovery paths tested?",
    "Does enabling rotation prove continued service access?",
    "Can I preserve the reviewed credential-lifecycle boundary?"
  ],
  "supported_claims": [
    {
      "claim": "Rotation introduces expiring access tokens and replacement refresh tokens. The new refresh token must be retained after exchange; repeatedly using the original token breaks subsequent refreshes. Slack also limits simultaneously active refreshed tokens. Rotation requires a tested credential-lifecycle implementation, not merely an enabled setting.",
      "reliance": "DOCUMENTED_CAPABILITY_ONLY"
    }
  ],
  "not_demonstrated_claims": [
    "Verified buyer configuration or effective access rights",
    "Independent execution, completeness or security testing",
    "Vendor certification, legal compliance or guaranteed suitability"
  ],
  "public_summary": "Rotation introduces expiring access tokens and replacement refresh tokens. The new refresh token must be retained after exchange; repeatedly using the original token breaks subsequent refreshes. Slack also limits simultaneously active refreshed tokens. Rotation requires a tested credential-lifecycle implementation, not merely an enabled setting.",
  "related_record_ids": [],
  "source_review": {
    "source_type": "official_external_documentation",
    "source_title": "Slack token rotation",
    "source_url": "https://docs.slack.dev/authentication/using-token-rotation/",
    "checked_on": "2026-10-16",
    "candidate_record_id": "VXI-EXT-PROCUREMENT-SLACK-TOKEN-ROTATION-01-v1",
    "candidate_record_sha256": "d24bbf35c9c22d6a23bb1a2189f1a7835b9d0d9c608d0dd1b41f6c16d8caf84e",
    "method": "Primary documentation reviewed for the published bounded statement.",
    "deployment_tested_by_varexis": false,
    "revalidation": "The delivered snapshot preserves the review date shown. Recheck current primary documentation and deployment context before relying on present applicability; payment does not trigger fresh research."
  },
  "answer_policy": {
    "classification": "DOCUMENTED_WITH_DEPLOYMENT_BOUNDARY",
    "bounded_answer": "Rotation introduces expiring access tokens and replacement refresh tokens. The new refresh token must be retained after exchange; repeatedly using the original token breaks subsequent refreshes. Slack also limits simultaneously active refreshed tokens. Rotation requires a tested credential-lifecycle implementation, not merely an enabled setting.",
    "required_buyer_context": "App installation, token type, refresh storage, concurrent consumers and recovery behaviour. Effective configuration and dated operational evidence have not been inspected.",
    "missing_evidence": "A broader claim needs evidence matching the intended use. Payment does not upgrade the evidence state."
  },
  "private_boundary": "Raw logs, thresholds, private paths, source code, protected mechanisms and reconstruction-level details are excluded from public and paid delivery.",
  "decision_profile": {
    "schema": "varexis-vendor-evidence-review/1",
    "review_status": "documentation_review_only",
    "checked_on": "2026-10-16",
    "claim_to_check": "Token rotation can be enabled without changing refresh-state handling.",
    "documented_statement": {
      "status": "documented",
      "statement": "Rotation introduces expiring access tokens and replacement refresh tokens. The new refresh token must be retained after exchange; repeatedly using the original token breaks subsequent refreshes. Slack also limits simultaneously active refreshed tokens. Rotation requires a tested credential-lifecycle implementation, not merely an enabled setting.",
      "source_ids": [
        "slack-rotation"
      ]
    },
    "buyer_evidence_required": [
      "Supported token type and rotation configuration.",
      "Secure atomic storage of replacement credentials.",
      "Refresh, expiry and recovery test evidence."
    ],
    "review_condition": {
      "status": "varexis_review_policy",
      "statement": "Require working replacement-token handling before treating rotation as operationally complete."
    },
    "unknowns": "The buyer configuration, contract, effective entitlement and operational evidence have not been inspected. Missing evidence does not establish absence or failure of the feature.",
    "evidence_sources": [
      {
        "source_id": "slack-rotation",
        "url": "https://docs.slack.dev/authentication/using-token-rotation/",
        "final_url": "https://docs.slack.dev/authentication/using-token-rotation/",
        "title": "Slack token rotation",
        "checked_on": "2026-10-16",
        "sha256": "afc53a605d97e55abe3a94e09440314f314c5cea616637c098ec78cfbb82901b",
        "bytes": 69486
      }
    ],
    "observed_deployment": false,
    "commercial_reliance_boundary": "Procurement evidence support only; no supplier clearance, legal conclusion, configuration audit or verification of the buyer's claim is supplied.",
    "paid_value": {
      "decision_context": "Retain the evidence required to assess an integration's credential continuity.",
      "free": "Complete review, practical questions, sources and limitations; may be saved locally.",
      "single_request": "Existing server-saved version-bound route snapshot for later authenticated retrieval.",
      "evidence_receipt": "The same snapshot plus the existing unsigned delivery receipt.",
      "excluded": [
        "Fresh vendor research",
        "Continuous monitoring or change alerts",
        "Testing the buyer configuration",
        "Private evidence or vendor certification"
      ],
      "integrity": "Hashes identify content versions; they do not prove truth or provide a signature."
    },
    "revalidation": {
      "trigger": "A saved purchase does not recheck the source or buyer configuration.",
      "specific_watch": "App installation, token type, refresh storage, concurrent consumers and recovery behaviour."
    }
  },
  "paid_access_note": "The full published answer and boundaries are free. Paid access saves the selected route and source versions, with an unsigned receipt when purchased. Preview coverage before paying. Fresh research, bespoke assessment and protected evidence are excluded.",
  "service_route": {
    "request_guide": "/varexis-index/request.html",
    "request_workflow": "/varexis-index/request-workflow.json",
    "service_id": "single_request",
    "service_routes_url": "/varexis-index/service-routes.json",
    "payment_required": true,
    "availability_endpoint": "/api/index/capabilities",
    "operational_status": "AUTOMATIC_SERVICE_CAPABILITIES_GATED",
    "checkout_url": "/index-access"
  },
  "authority_boundary": "VAREXIS-INDEX informs evidence reliance. It does not provide advice, certification, deployment authority, security assurance, production approval, or guarantee.",
  "human_page": "/varexis-index/catalog.html#slack-token-rotation-refresh-continuity",
  "machine_readable_record": "/varexis-index/records/slack-token-rotation-refresh-continuity.json"
}