WeCom

By integrating a WeCom third-party app, you can receive and respond to alerts within WeCom

Plan requirement: IM integration requires an On-call Pro or higher subscription. Learn more

AI SRE Required Permissions and Capabilities

WeCom does not provide per-item OAuth scope names like Slack or Feishu/Lark. The following list includes all permissions and capabilities that must be enabled or configured in WeCom Admin Console when the WeCom IM integration uses AI SRE, including basic notifications, War Room, AI SRE conversations, and AI-generated post-mortem reports. Names below use WeCom console or official API names.

WeCom official name	Purpose
企业自建应用	Custom app required for AI SRE War Room creation, member invitation, and the initial AI SRE analysis in War Rooms
应用可见范围	App visibility must cover all members who may receive notifications, link accounts, or be invited to War Rooms
基础接口权限	Basic API permissions allow the custom app to call app message and app chat APIs
通讯录基本信息只读	Reads basic member information and resolves WeCom userid by phone number or email
接收消息	Enables the custom app to receive callbacks, card events, and message events
API 接收	Configures the callback URL, Token, and EncodingAESKey for callback verification/decryption
智能机器人	Smart bot supports regular AI SRE @bot conversations, streaming replies, and media decryption

This documentation supports Third-Party App Integration or Custom App Integration methods.

Third-Party App Integration and Custom App Integration only need to configure one method as needed.

1. Third-Party App Integration

As a WeCom service provider, Flashduty provides a long-term free version of the Flashduty app. This app requires WeCom API call authorization to use (passwordless login + message sending). This authorization currently supports up to 60 days free; beyond this usage period, Flashduty needs to purchase WeCom licenses for you before you can continue using it.

1. Visit WeCom Admin Console, go to App Management → Apps page, click Add Third-Party App.

   

2. Enter Flashduty in the search bar, after finding the app, click Add.

   

3. Modify app Visibility, recommend selecting all employees or specific department nodes to avoid modifying when new enterprise members join. Then click Agree to the above authorization and add to complete installation.

   

4. Visit WeCom Admin Console, go to My Enterprise page, get Corp ID.

   

5. Return to Flashduty On-call integration configuration page, fill in the Corp ID obtained in the previous step, click Save to complete integration.

2. Custom App Integration

1. Visit WeCom Admin Console, go to App Management → Apps page, click Create App.

   

2. Configure App Logo, App Name, and App Visibility.

   

3. Return to Flashduty On-call integration configuration page, select whether your WeCom is Non-private deployment version based on your actual situation.

   If your WeCom is a private deployment version, you need to fill in Endpoint in the configuration page. This address needs to be accessible by Flashduty services—you may consider setting up whitelist authorization for it.

4. Visit WeCom Admin Console, go to My Enterprise page, get Corp ID, and fill it in the Flashduty On-call integration configuration page.

5. Return to WeCom Admin Console, go to App Management page, click the app you created to enter details page. Get AgentId from the page and fill it in the Flashduty On-call integration configuration page.

6. On the app details page, get Secret and fill it in the Flashduty On-call integration configuration page.

7. On the app details page, go to Web Authorization & JS-SDK page, click Set Trusted Domain, and configure as required.

The trusted domain needs to point to Flashduty On-call’s backend address {api_host} (achievable via CNAME or proxy forwarding). For trusted domain requirements, see WeCom official documentation Enterprise Internal Development Domain Configuration Guide.

Return to Flashduty On-call integration configuration page, fill in this domain and complete verification.

8. On the app details page, go to Receive Messages page, and Set API Receive. Click Random Generate for Token and EncodingAESKey respectively, then copy and save the generated values.

   

   Return to Flashduty On-call integration configuration page, fill in the saved Token and EncodingAESKey, click Save to complete integration.

9. Copy the Callback URL from Flashduty On-call integration details page, return to WeCom’s Receive Messages page. In API Receive settings, fill in this Callback URL and the Token and EncodingAESKey saved in the previous step, then click Save.

   

10. Configure Frontend Trusted Domain

The trusted domain needs to point to Flashduty On-call’s frontend address console.flashcat.cloud (achievable via CNAME or proxy forwarding). For trusted domain requirements, see WeCom official documentation Enterprise Internal Development Domain Configuration Guide.

After frontend trusted domain verification passes, configure the generated Homepage URL to the WeCom app’s Workspace App Homepage

11. Configure Trusted IP Address: 47.93.12.134

Configure the AI SRE smart bot

If you need AI SRE conversations in WeCom, configure a WeCom smart bot separately and fill its credentials in the Flashduty On-call WeCom integration.

1. Create or open the smart bot used for AI SRE in the WeCom Admin Console.
2. Configure the bot callback URL. Use the smart bot callback URL shown on the Flashduty On-call integration details page.
3. Copy the smart bot Token and EncodingAESKey, then fill them in the smart bot fields of the Flashduty On-call integration configuration.

The WeCom custom app and the smart bot are two different capability sets. War Room creation, member invitation, and the initial AI SRE analysis in a War Room rely on the custom app. Normal AI SRE @bot conversations, streaming replies, and media decryption rely on the smart bot Token and EncodingAESKey.

3. Configure War Room

War Room functionality is only supported in Custom App Integration mode.

After completing previous steps, in the Flashduty On-call integration configuration page’s Enhanced Features section, check Enable War Room to activate this feature—no additional configuration needed.

If War Room creation, member invitation, or message delivery does not work as expected, first check the custom app, visibility, basic API permissions, contact permissions, and callback configuration listed in AI SRE Required Permissions and Capabilities.

When you dismiss a War Room in Flashduty On-call, Flashduty does not automatically delete the group chat already created in WeCom. If you need to clean up the WeCom group chat, handle it in WeCom manually.

Only one IM integration can have War Room enabled at a time. If you’ve already enabled War Room in another IM integration (such as Dingtalk, Feishu/Lark, or Slack), you need to disable it there first before enabling it in the current WeCom integration.

4. Linked Users

In the Linked Users tab of the integration detail page, you can view the linking status between team members and WeCom accounts, and quickly complete batch linking.

View Linking Status

The linked users list shows all team members and their linking status. You can filter by:

Filter	Description
All	View all team members
Linked	View only members who have linked their WeCom accounts
Unlinked	View only members who have not yet linked their WeCom accounts

Search by name or email is supported.

One-Click Linking

When unlinked members exist, click the One-Click Link button. The system will attempt to obtain WeCom account IDs via phone numbers or emails and automatically link them, equivalent to members logging into Flashduty using the same information on WeCom.

The system can only push WeCom message notifications after members complete linking. If linking fails, verify that the member’s phone number or email matches their WeCom account.

5. FAQ

After clicking integration save button, system shows 'authorize app first' error?

• Please check if you’ve completed the app installation steps. For example, can you see the Flashduty On-call app in WeCom Workspace
• Please check if you’ve correctly configured Corp ID

How to complete account linking or message delivery shows 'App not linked'?

1. Login to WeCom client (desktop or mobile), go to Workspace, find and open the Flashduty app
2. First entry requires login. Select your member account, after successful login via password or SSO, Flashduty account and WeCom account will be linked
3. Subsequent app access will be automatically passwordless

How to send incident notifications?

1. Before sending notifications, account linking must be completed as described in the previous question
2. Go to the specified channel, navigate to Escalation Rules → Personal Channel, select WeCom as notification method
3. Flashduty On-call supports customizing WeCom notification content. Go to Template Management page to set custom templates

Custom area can display up to 8 lines; excess will be truncated by WeCom.

How to handle alerts within WeCom?

• Click card message to go directly to alert details page
• Click Start Processing to directly set alert to Processing status
• Click Close Directly to directly set alert to Closed status
• Click Snooze 2 hours to snooze the alert for 2 hours. For longer snooze times, click ... in the card’s top-right corner for more snooze options

Why does the card message have a 'Refresh Status' button?

Due to WeCom limitations, after one card interaction, it can only be updated once within 72 hours. Each button operation counts as one interaction.

When alert status changes, Flashduty On-call requests to update card content. When alert status changes frequently, cards may not update in real-time due to exceeding update limits. You can click the Refresh button to manually get one card status update opportunity.

How to set Mac desktop to open with system default browser?

Mac desktop defaults to opening links with WeCom’s built-in browser. Try using shortcut ctrl + command + shift + d to enable debug mode, then select Debug → Browser, WebView Related → Open Webpage with System Browser to change link opening method. Use the same shortcut to disable debug mode; settings will be preserved.

Incident notification failed with 'WeCom license not enabled' prompt?

Please contact Flashduty customer service or your dedicated technical support to purchase and enable the license.

Why isn't War Room working as expected?

See the FAQ section in War Room documentation.

Why does opening the app in WeCom Workspace show 'redirect_uri needs to use app trusted domain'?

Please confirm whether the domain in the redirect_uri parameter of the App Homepage URL has completed WeCom’s required domain ownership verification. See WeCom official documentation Enterprise Internal Development Domain Configuration Guide.