[codex] Document AI SRE IM permissions

docs.json

@@ -18,6 +18,24 @@
       "canonical": "https://docs.flashcat.cloud"
     }
   },
+  "redirects": [
+    {
+      "source": "/zh/on-call/integration/alert-integration/alert-sources/standard alert",
+      "destination": "/zh/on-call/integration/alert-integration/alert-sources/standard-alert"
+    },
+    {
+      "source": "/zh/on-call/integration/alert-integration/alert-sources/standard%20alert",
+      "destination": "/zh/on-call/integration/alert-integration/alert-sources/standard-alert"
+    },
+    {
+      "source": "/en/on-call/integration/alert-integration/alert-sources/standard alert",
+      "destination": "/en/on-call/integration/alert-integration/alert-sources/standard-alert"
+    },
+    {
+      "source": "/en/on-call/integration/alert-integration/alert-sources/standard%20alert",
+      "destination": "/en/on-call/integration/alert-integration/alert-sources/standard-alert"
+    }
+  ],
   "navigation": {
     "languages": [
       {
@@ -206,7 +224,7 @@
                     "group": "告警集成",
                     "expanded": false,
                     "pages": [
-                      "zh/on-call/integration/alert-integration/alert-sources/standard alert",
+                      "zh/on-call/integration/alert-integration/alert-sources/standard-alert",
                       "zh/on-call/integration/alert-integration/alert-sources/http-pull",
                       "zh/on-call/integration/alert-integration/alert-sources/prometheus",
                       "zh/on-call/integration/alert-integration/alert-sources/grafana",
@@ -1247,7 +1265,7 @@
                     "group": "Alert Integration",
                     "expanded": false,
                     "pages": [
-                      "en/on-call/integration/alert-integration/alert-sources/standard alert",
+                      "en/on-call/integration/alert-integration/alert-sources/standard-alert",
                       "en/on-call/integration/alert-integration/alert-sources/http-pull",
                       "en/on-call/integration/alert-integration/alert-sources/prometheus",
                       "en/on-call/integration/alert-integration/alert-sources/grafana",

en/on-call/advanced/reference-variables.mdx

@@ -9,7 +9,7 @@ By referencing variables from alert labels and attributes, you can modify and cu
 
 <CardGroup cols={2}>
 <Card title="Event API Reporting" icon="code">
-When reporting custom alert events via the alert [Event API](/en/on-call/integration/alert-integration/alert-sources/standard alert), you can use the `title_rule` field to customize the alert title.
+When reporting custom alert events via the alert [Event API](/en/on-call/integration/alert-integration/alert-sources/standard-alert), you can use the `title_rule` field to customize the alert title.
 </Card>
 <Card title="Alert Pipeline" icon="filter" href="/en/on-call/integration/alert-integration/alert-pipelines">
 Reference variables in alert pipelines to modify alert severity, title, description, and other information.

en/on-call/advanced/war-room.mdx

@@ -177,5 +177,16 @@ Based on **War Room** functionality and existing **Intelligent Grouping** and **
 </CardGroup>
 
 <Info>
-To build a more comprehensive context of the incident's full lifecycle, AI-generated post-mortem reads war room chat history. Ensure your IM integration has been granted the necessary permissions — see [Feishu/Lark](/en/on-call/integration/instant-messaging/lark) or [Slack](/en/on-call/integration/instant-messaging/slack) integration guides for details.
+To build a more comprehensive context of the incident's full lifecycle, AI SRE and AI-generated post-mortem need to read War Room chat history or receive IM bot messages. Make sure your IM integration has the required permissions for the corresponding platform.
 </Info>
+
+### IM platform prerequisites
+
+Each IM platform has different capability requirements for War Room and AI SRE. Before enabling the feature, complete the required permissions, bot capabilities, and callback configuration in the corresponding integration guide.
+
+| Platform | Key prerequisites |
+| :--- | :--- |
+| [Feishu/Lark](/en/on-call/integration/instant-messaging/lark) | Grant message, chat, group history, resource, and CardKit permissions, and subscribe to message events and card callbacks |
+| [Dingtalk](/en/on-call/integration/instant-messaging/dingtalk) | Grant group management, bot messaging, group information, and phone-number lookup permissions, and configure the app bot, group bot, and group template |
+| [WeCom](/en/on-call/integration/instant-messaging/wecom) | Use a custom app for War Room, and make sure app visibility, basic API permissions, contact authorization, and smart bot credentials are configured |
+| [Slack](/en/on-call/integration/instant-messaging/slack) | Complete Slack authorization or re-authorization so the app has message sending, event receiving, channel history, private-channel management, user info, reaction, and file-read permissions |

en/on-call/incident/what-is-incident.mdx

@@ -135,7 +135,7 @@ Flashduty On-call supports dedicated and shared integration modes:
 
 ### Trigger via API
 
-Flashduty On-call provides a custom event standard, allowing you to report alerts via standard protocol, suitable for any non-integrated monitoring system. For details, read [Custom Alert Events](/en/on-call/integration/alert-integration/alert-sources/standard alert).
+Flashduty On-call provides a custom event standard, allowing you to report alerts via standard protocol, suitable for any non-integrated monitoring system. For details, read [Custom Alert Events](/en/on-call/integration/alert-integration/alert-sources/standard-alert).
 
 <Warning>
 To ensure system stability, Flashduty On-call enforces rate limits per integration (**100 requests/second**, **1000 requests/minute**). Exceeding these limits returns a `429` status code — please wait and retry. See [Integrate Data - Rate Limits](/en/on-call/channel/integrate-data#rate-limits) for details.

en/on-call/integration/alert-integration/alert-sources/http-pull.mdx

@@ -4,7 +4,7 @@ description: "Flashduty periodically polls an external HTTP endpoint and ingests
 keywords: ["Alert Integration", "HTTP Pull", "Polling", "Cursor Pagination", "Data Ingestion"]
 ---
 
-By configuring an HTTP endpoint, Flashduty issues a request on the schedule you define and parses the response into events conforming to the [Standard Alert Event](/en/on-call/integration/alert-integration/alert-sources/standard%20alert) protocol, which are then written into the alert channel. Your system does not need to support push delivery — it only needs to expose a readable alert query endpoint.
+By configuring an HTTP endpoint, Flashduty issues a request on the schedule you define and parses the response into events conforming to the [Standard Alert Event](/en/on-call/integration/alert-integration/alert-sources/standard-alert) protocol, which are then written into the alert channel. Your system does not need to support push delivery — it only needs to expose a readable alert query endpoint.
 
 :::tips
 HTTP Pull is the right choice when your source **cannot send webhooks**, **is query-only by nature**, or when you **do not want to modify the upstream system**. If your system already supports webhook delivery, prefer the corresponding push-based integration (Prometheus, Zabbix, etc.) — it has lower latency and a smaller resource footprint.
@@ -74,7 +74,7 @@ External systems use different field names and values for alert severity. **Seve
 
 ### Response Format
 
-The response must conform to Flashduty's [Standard Alert Event](/en/on-call/integration/alert-integration/alert-sources/standard%20alert) protocol (`response_mode = standard`). Key fields include `event_status`, `title_rule`, `alert_key`, `description`, `labels`, etc. Refer to the Standard Alert Event documentation for the semantics and length limits of each field.
+The response must conform to Flashduty's [Standard Alert Event](/en/on-call/integration/alert-integration/alert-sources/standard-alert) protocol (`response_mode = standard`). Key fields include `event_status`, `title_rule`, `alert_key`, `description`, `labels`, etc. Refer to the Standard Alert Event documentation for the semantics and length limits of each field.
 
 When pagination is enabled, the response must additionally expose a field for the next-page cursor, located at the path you set in **Cursor Path**. A typical shape:
 

en/on-call/integration/instant-messaging/dingtalk.mdx

@@ -9,6 +9,25 @@ description: "By integrating a Dingtalk custom app, you can receive and respond
 This documentation uses the new version of Dingtalk Open Platform as an example.
 </Note>
 
+<span id="aisre-permissions"></span>
+<span id="war-room-scope"></span>
+
+## AI SRE Required Permissions
+
+The following list includes all permissions required when the Dingtalk IM integration uses AI SRE, including basic notifications, War Room, AI SRE conversations, and AI-generated post-mortem reports. In Dingtalk Open Platform, go to Development Configuration → **Permission Management** and request each official permission name below.
+
+| Official permission name | Purpose |
+| :--- | :--- |
+| `qyapi_chat_manage` | Create or manage group chats, scene groups, and group members |
+| `qyapi_robot_sendmsg` | Send messages to group chats or individuals, send or update AI SRE card messages, and send the initial AI SRE analysis in War Rooms |
+| `qyapi_chat_read` | Query group chat and scene group information |
+| `qyapi_chat_base_read` | Query basic group chat information, QR codes, and related metadata |
+| `qyapi_get_member_by_mobile` | Get Dingtalk users by phone number for automatic linking and War Room member invitation |
+
+<Note>
+Dingtalk does not currently provide a stable API for Flashduty to read all granted app permissions. Manually confirm that all permissions above are granted in Dingtalk Open Platform.
+</Note>
+
 ## 1. Create Dingtalk App and Add Dingtalk Integration
 
 ### 1. Create Custom App
@@ -89,10 +108,7 @@ Configure **App Homepage URL** and **PC Homepage URL** using the `App Homepage U
 
 ### 9. Request App Permissions
 
-Go to Development Configuration → **Permission Management** page, request the following permissions for the group app created in previous steps:
-
-- `qyapi_chat_manage`: Get group chat information
-- `qyapi_robot_sendmsg`: Send messages to group chats or individuals
+Go to the Development Configuration → **Permission Management** page and request all permissions listed in [AI SRE Required Permissions](#aisre-permissions) for the app created in previous steps.
 
 ![2025-09-18-15-20-36](https://docs-cdn.flashcat.cloud/images/png/4417440194002a011e2feca5fa5c9469.png)
 
@@ -102,15 +118,13 @@ Go to Development Configuration → **Permission Management** page, request the
 If you don't need War Room functionality, skip this step and proceed directly to [**App Publishing and Usage**](#publish).
 </Tip>
 
-<span id="war-room-scope"></span>
-
 ### 1. Request App Permissions
 
-Go to Development Configuration → **Permission Management** page, request the following permissions for the group app created in previous steps:
+If you did not grant all permissions during the basic configuration steps, go to Development Configuration → **Permission Management** and add every permission listed in [AI SRE Required Permissions](#aisre-permissions).
 
-- `qyapi_chat_read`: Get group chat information
-- `qyapi_chat_base_read`: Get group chat information
-- `qyapi_get_member_by_mobile`: Allow the current app to get Dingtalk users by phone number for inviting users to join group chats
+<Note>
+Also confirm that the app bot, group bot, group template, `Template ID`, and `Bot ID` are all configured in Dingtalk Open Platform.
+</Note>
 
 ![2025-09-18-15-21-28](https://docs-cdn.flashcat.cloud/images/png/39142395390ce09726e3a95991549116.png)
 
@@ -251,7 +265,7 @@ Go to Dingtalk → Workspace → Search app name → **Open App**, complete one
 </Accordion>
 
 <Accordion title="Why isn't War Room working as expected?">
-- Please check again if the app has been granted the [required permissions](#war-room-scope) for War Room functionality
+- Check again that the app has been granted the [AI SRE required permissions](#aisre-permissions) listed at the beginning of this page
 - See the **FAQ** section in [War Room documentation](/en/on-call/advanced/war-room)
 </Accordion>
 

en/on-call/integration/instant-messaging/lark.mdx

@@ -5,6 +5,28 @@ description: "By integrating a Feishu/Lark custom app, you can receive and respo
 
 <Tip>**Plan requirement**: IM integration requires an On-call Pro or higher subscription. [Learn more](https://flashcat.cloud/flashduty/price/)</Tip>
 
+<span id="aisre-permissions"></span>
+<span id="war-room-scope"></span>
+
+## AI SRE Required Permissions
+
+The following list includes all permissions required when the Feishu/Lark IM integration uses AI SRE, including basic notifications, War Room, AI SRE conversations, and AI-generated post-mortem reports. In the Feishu/Lark Open Platform **Permission Management** page, request each official permission name below.
+
+| Official permission name | Purpose |
+| :--- | :--- |
+| `im:chat` | Create and manage War Room chats, get chat information, and add chat members |
+| `im:message` | Read and send direct and group messages |
+| `im:message:send_as_bot` | Send AI SRE replies and War Room messages as the bot |
+| `im:message:update` | Update messages sent by the app for AI SRE streaming replies |
+| `im:message.group_msg` | Read group chat history; required for AI SRE context and AI-generated post-mortem reports |
+| `im:message.reactions:read` | Query message reactions for AI SRE processing status confirmation |
+| `im:message.reactions:write_only` | Add or delete message reactions for AI SRE processing status confirmation |
+| `im:resource` | Upload and download images, files, and other message resources |
+| `cardkit:card:write` | Create and update CardKit cards for AI SRE streaming replies |
+| `contact:user.id:readonly` | Get user IDs by phone number or email for automatic linking and member invitation |
+| `contact:contact.base:readonly` | Get basic contact information for reading user and department metadata |
+| `contact:user.base:readonly` | Get basic user information for displaying sender names |
+
 <div className="hide">
 {/*
 ## Video Introduction
@@ -84,12 +106,7 @@ See Feishu/Lark development documentation [Configure Redirect URL](https://open.
 
 ### 3. Request App Permissions
 
-Go to **Permission Management** page, request the following permissions for the group app created in previous steps:
-
-- `im:chat`: Get and update group information
-- `im:message`: Get and send direct/group messages
-- `contact:user.id:readonly`: Get user ID by phone number or email
-- `im:message.group_msg`: Read group chat history (required for AI-generated post-mortem to access war room conversations) <span id="war-room-scope"></span>
+Go to the **Permission Management** page and request all permissions listed in [AI SRE Required Permissions](#aisre-permissions) for the app created in previous steps.
 
 ![2025-09-18-10-55-14](https://docs-cdn.flashcat.cloud/images/png/d919be62107f6b9d0c662f440d620e61.png)
 
@@ -119,7 +136,7 @@ Feishu/Lark → Workspace → Search app name → **Open App**
 
 ## 5. Configure War Room
 
-> Ensure the app has been granted the [additional permissions](#war-room-scope) required for War Room functionality.
+> Ensure the app has been granted the [AI SRE required permissions](#aisre-permissions) listed at the beginning of this page.
 
 After completing the previous steps, in the Flashduty On-call integration configuration page's **Enhanced Features** section, check **Enable War Room** to activate this feature—no additional configuration needed.
 
@@ -193,7 +210,7 @@ After exceeding API call limits, Feishu/Lark app cannot deliver messages properl
 </Accordion>
 
 <Accordion title="Why isn't War Room working as expected?">
-- Please check again if the app has been granted the [required permissions](#war-room-scope) for War Room functionality
+- Check again that the app has been granted the [AI SRE required permissions](#aisre-permissions) listed at the beginning of this page
 - See the **FAQ** section in [War Room documentation](/en/on-call/advanced/war-room)
 </Accordion>
 </AccordionGroup>