The Object IDs populated by Slack Securlet has different formats and it consists of different parts. this article clarifies some of them.
The Object IDs in Slack consists of a prefix letter which signifies the type of the object followed by an alphanumerical value representing the identified.
Here are a few examples:
USER ID :
For a standard user account, the ID starts with either letter 'U' or 'W', like U012AB345CD
For a Bot User account, the user ID starts with letter 'B' like B012AB345CD
CHANNEL ID:
Starts with either letters 'C' 'G' or 'D' , ( typically 'C' for public channels , 'G' for private channels and 'D' for direct channels),
example would be C012QRSTUW9
TEAM ID:
Starts with letter 'T', like T012AB345CD
WORKFLOW ID:
Starts with 'Wf', like Wf01ABC2D3EF
APP ID:
Starts with letter 'A', like A01ABCDEF2G
FILE ID (and CANVAS ID):
Starts with letter 'F', like F01AABBC9DD
INSTNACE ID:
Starts with letter 'E', like E012AB34CD5
Slack Securlet reports all of the above object as they are, except in two cases:
FILE ID (and CANVAS ID):
File ID would be reported directly as Slack like F01AABBC9DD , or
In this format: <DocID>_<Instance_ID>
example: F01AABBC9DD_E012AB34CD5
MESSAGE ID:
reported in this format : <team_id> _ <channel_id> _ <user id> _ <block timestamp>
example: T012AB345CD_C012QRSTUW9_U012AB345CD_1727122245