How to add Slack to TOTVS Protheus
Short answer
Create a Slack app with slash commands and interactive messages, run it as a small service that calls Protheus REST endpoints and ExecAuto routines, and push ERP events into channels through incoming messages. Keep the AppServer private by letting the service sit in a DMZ or poll outbound.
Slack is less common than Teams in Protheus shops, but it is the default in software-heavy manufacturers, startups with a plant, and multinational groups where the Brazilian operation is one subsidiary on a shared Slack workspace. Group IT wants alerts from the local ERP to appear where global teams already look.
The value is in turning the ERP from a system people go and check into one that speaks up when something needs a person: a blocked invoice, a late supplier, a purchase request awaiting a signature.
Protheus gives you plenty of hooks for this, but there is no standard Slack connector, so the work is a thin, well-governed layer rather than a platform project.
What teams use it for
Slash command for order and stock lookups
A command such as /protheus pedido 123456 returns status, billing and expected ship date, using a read-only endpoint scoped to the Slack user's mapped Protheus account.
Blocked invoice and tax exception alerts
Entry invoices held for fiscal validation or missing a purchase order link post to the fiscal channel with the supplier, value and reason code.
Interactive purchase request approvals
Block Kit messages with Approve and Reject buttons route to the decision endpoint, and the message updates when the next approver is needed.
Production exception digest
A morning message summarises late production orders and material shortages by line, built from queries over production order and stock tables.
Supplier delay thread
When a purchase order passes its due date, a thread opens in the buyer's channel with the supplier and a button to send a reminder through email or WhatsApp.
TOTVS Protheus integration surface
- Protheus REST services on the AppServer (standard APIs plus custom TL++ endpoints) for read queries and for posting decisions.
- ExecAuto routines for creating or updating purchase requests and orders with normal business rules applied.
- User exits on document save or approval to enqueue events into a custom integration table instead of calling out directly.
- Direct SQL views over the Protheus database for read-only digests, with the deleted-record flag and company/branch filters (the filial fields) respected.
- Scheduled TL++ jobs or an external scheduler for time-based digests and overdue checks.
How it works
- 1
Create the Slack app and scopes
Request only the scopes you need: commands, chat write for the channels used, and interactivity. Install it to the workspace and note signing secret and bot token.
- 2
Run the service where it can reach the AppServer
Host it in a DMZ or the corporate network. Slack needs a public HTTPS request URL for commands and buttons, so front it with a reverse proxy.
- 3
Map Slack users to Protheus users
Resolve Slack user id to corporate email, then to a Protheus user code. Reject commands from unmapped users rather than falling back to a shared account.
- 4
Implement query and decision endpoints
One narrow endpoint per command. Include company and branch in the request so multi-filial data does not blur.
- 5
Send events through an outbox
A custom table collects events from user exits; a worker posts to Slack with rate-limit handling and marks rows done.
- 6
Verify signatures and log everything
Check the Slack signature on each request, and log user, command and Protheus result for audit.
Example flows
Order lookup by slash command
Trigger: A salesperson types a slash command with an order number.
- Service verifies the Slack signature and maps the user.
- It calls the status endpoint for that order and company.
- The user is checked against sales scope on the Protheus side.
- An ephemeral message returns stage, invoice number and expected date.
Result: Quick answers without opening a Protheus session, visible only to the asker.
Blocked entry invoice alert
Trigger: An incoming invoice fails validation against its purchase order.
- User exit writes an outbox event with supplier, document and reason.
- Worker posts to the fiscal channel with a link to the record.
- A fiscal analyst claims the thread with a button.
- Resolution note posted in the thread is stored with the document key.
Result: Exceptions get an owner and a timestamp instead of sitting in a list.
Keeping data on-prem
Slack is a cloud service, so the architecture decision is what you let cross the boundary. Keep Protheus and its database internal, run the Slack service in your DMZ, and have it call the AppServer over an internal rule. Post summaries and identifiers to Slack, not full document images or price lists, and give the details behind an authenticated link. If you want natural-language commands such as asking in plain Portuguese for late orders, interpret the text with an open-weight model hosted on your own hardware and translate it into the same narrow endpoints, so the question and the data never reach an external model. Slack workspace retention settings then become part of your data governance review.
Security checklist
- Validate the Slack request signature and timestamp on every inbound call to block replays.
- Use per-user mapping so Protheus permissions apply; avoid one all-powerful integration user for lookups.
- Limit write actions to a short allowlist (approve, acknowledge) and require confirmation for anything that changes money.
- Keep bot and signing secrets in a vault, rotate them, and restrict the bot to specific channels.
Ways to get it done
Incoming webhooks plus scheduled queries
Effort: Days.
Alerts and digests with no interaction; lowest effort and lowest risk.
In-house Slack app with slash commands and buttons
Effort: Two to five weeks with mapping and tests.
Teams with a developer comfortable in Node, Python or .NET and TL++ on the Protheus side.
Partner build with natural-language commands, for example Netray
Effort: Pilot on a handful of commands, then expand by usage.
When people want to ask free questions and you want the model private and read-only by default.
Pitfalls
- !Ignoring multi-company and multi-branch context, so a lookup returns the wrong filial's order.
- !Sending alerts from a user exit synchronously and slowing document saves; use the outbox.
- !Hitting Slack rate limits during month-end bursts without queueing or batching.
- !Letting a shared integration user answer for everyone, which bypasses Protheus permissions.
Frequently asked questions
Is there an official Slack connector for TOTVS Protheus?
Not one we can point to as standard. Integrations are typically built on Protheus REST services and the Slack Web API, either in-house or by a partner. Confirm with your TOTVS representative whether any newer messaging offering covers your release.
Can people approve purchase requests from Slack?
Yes, with interactive messages calling a decision endpoint that runs the normal approval routine. Authority is checked in Protheus, so the button never grants more than the user already has.
How do I keep Protheus off the internet?
Put the Slack service in a DMZ or internal network, expose only its public request URL through a reverse proxy, and have it call the AppServer over an internal rule. Slack never talks to Protheus directly.
Can I ask questions in plain language?
Yes. An LLM can map a question to a fixed set of read-only queries. Running the model on-prem keeps the text and results inside your network, and the queries respect the asker's Protheus access.
Slack or Teams for Protheus?
Use whichever your company already lives in. The Protheus side is almost identical: REST endpoints, an outbox of events and a user mapping. Only the bot framework and card format differ.
Want Slack working on your TOTVS Protheus?
A free 30 minute assessment: we map the integration path for your version and setup, and where it should run.
Get a free assessment