Secure Access Service Edge:Integrate SASE approval workflows with Lark

Prerequisites

Before you begin, make sure that the following requirements are met:

• Lark enterprise account — You have an enterprise Lark account with administrator privileges.

• Lark Developer Platform access — You can create enterprise self-built apps on the Lark Developer Platform.

• Lark Approval permissions — You have permission to manage approval definitions in the Lark Approval Management Console. The self-built app must be granted the following permission scopes:

  • approval:approval — View, create, update, and delete approval application information.

  • contact:user.employee_id:readonly — Obtain the user ID.

• SASE console access — You have activated SASE and have permissions to manage approval workflows in the SASE console.

• API call quota awareness — Lark enforces a monthly quota for subscription-event processing. As an enterprise administrator, log on to the Lark Admin Console and choose User Center > Entitlement Data to view the API Call Count.

Step 1: Create a Lark app and configure approval permissions

In this step, you create a Lark enterprise self-built app, grant it the approval permissions that SASE requires, and record the app credentials that you will use in Step 3.

1. Log on to the Lark Developer Platform.

2. In the Enterprise Self-built Apps section, click Create Enterprise Self-built App.

3. In the Create App panel, configure the app name, description, and icon, and then click Save. You are redirected to the app details page.

4. In the left-side navigation pane, choose Development Configuration > Permission Management.

5. On the Permission Management page, add the following approval permissions:

   • approval:approval — View, create, update, and delete approval application information.

   • contact:user.employee_id:readonly — Obtain the user ID.

6. To enable the permissions:

   1. In the left-side permission category list, select Approval.

   2. Select the check box above the permission list to select all approval permissions.

   3. Select the permission scopes that match your business requirements.

7. Record the app credentials that you will enter as the Client ID and Client Secret in Step 3:

   1. On the Lark Developer Platform, click the name of the enterprise self-built app.

   2. In the left-side navigation pane, choose Credentials and Basic Information.

   3. Copy the App ID and App Secret.

Step 2: Create a Lark approval workflow

In this step, you create a custom approval form in the Lark Approval Management Console. The form's fields will be mapped to SASE system fields in Step 3.

1. Log on to the Lark Admin Console.

2. In the left-side navigation pane, choose Workbench > App Management, find Approval in the app list, and click Configure in the Actions column to open the Approval Management Console.

3. Click Create Approval Form. In the dialog box, select Create Custom Approval.

4. Complete the approval form using the wizard:

   1. Configure basic information. Enter the form name, group, initiators, and form administrator.

   2. Design the form. Click Form Design in the wizard, click a form control on the left side, and configure the title and hint text for each display field.

   3. Design the process. Click Process Design in the wizard, click the approver process box, and configure the approval type, approver, and approval method.

5. Click Publish in the upper-right corner to release the approval definition.

Step 3: Create a SASE approval workflow

In this step, you create a SASE approval workflow, provide the Lark app credentials, and map SASE workflow templates to the Lark approval definition that you published in Step 2.

1. Log on to the SASE console.

2. In the left-side navigation pane, choose Settings Center > Approval Flow Management, and then click Create Workflow.

3. In the Create Approval Workflow panel, configure the workflow settings.

   The following table describes the parameters.

   Parameter	Description	Example
   Workflow Name	The name of the approval workflow. Supports Chinese characters, letters, digits, hyphens (-), underscores (_), and periods (.). Maximum length: 128 characters.
   Approval Process Type	The type of approval workflow. Select Lark Approval Workflow.	Lark Approval Workflow
   Client ID	The App ID of the Lark app that you recorded in Step 1.	cli_aac********99bed
   Client Secret	The App Secret of the Lark app that you recorded in Step 1.	Kqlp****8xmQ
   aes_key	The encryption credential for Lark events and callbacks. Obtain this value in Step 4.	zdgx****yoqj
   token	The verification token for Lark event subscriptions. Obtain this value in Step 4.	hl8p****zlmu
   Request URL	The public URL that Lark uses to send event subscriptions. The system generates this URL automatically. You copy it to the Lark Developer Platform in Step 4.	https://default-pre-auth-server.cloudsecsase.com/*/callback-id

   Note

   If you have not yet obtained the aes_key and token, complete Step 4 first to retrieve them from the Events and Callbacks page, and then return to this step.

4. In the Approval Process Configuration section, map SASE workflow templates to Lark approval definitions.

   The following table describes the parameters.

   Parameter	Description	Example
   Workflow Template	The built-in SASE workflow template. Templates that are already selected in other configurations are disabled.
   Lark Flow ID	The UUID of the Lark approval definition. Format: XXXXXXXX-XXXX-XXXX-XXXX-XXXXXXXXXXXX. To retrieve this value, see Find the Lark flow ID.	55653C99-****-****-95C0-5A448E04CE03
   System Fields	Built-in system fields in the workflow template. These fields are read-only.
   Template Fields	Fields configured in the associated Lark approval form. Select the corresponding Lark field from the drop-down list.

   Note

   • The Lark Flow ID field becomes editable only after you enter a valid Client ID and Client Secret. After you enter a valid UUID, the system automatically retrieves the form fields from the Lark approval definition for field mapping.

   • A SASE approval workflow can be associated with multiple approval forms under the same Lark app. Click Add to configure additional workflows. You can add up to 8 configurations.

5. Click OK.

Step 4: Configure Lark event subscriptions

In this step, you retrieve the encryption credentials from the Lark app's Events and Callbacks page, configure the SASE-generated Request URL on that page, and subscribe to the approval event that drives the callback. For background information about event subscriptions, see Lark event subscription documentation.

1. Open the Events and Callbacks page of your Lark app:

   1. On the Lark Developer Platform, click the name of the enterprise self-built app that you created in Step 1.

   2. In the left-side navigation pane, choose Events and Callbacks.

2. In the Encryption Strategy section, click Reset to generate the Encrypt Key and Verification Token. Record these values. You will enter them as the aes_key and token in Step 3.

3. Configure the Request URL and click Save.

   To locate the Request URL that SASE generated for your workflow, in the SASE console left-side navigation pane, choose Approval Center > Process Management, click Edit in the Actions column of the target approval workflow, and view the Request URL in the Edit Approval Workflow panel. The path contains /v1/approval/feishu/callback/.

   Copy the Request URL to the Lark Developer Platform at Enterprise Self-built App > Development Configuration > Events and Callbacks > Event Configuration > Send events to > Developer Server > Request URL.

4. In the Added Events section at the bottom of the page, add the Approval Instance Status Change event.

5. Call the Feishu API and specify the approval definition code (approval_code) to enable the subscription. After the subscription is enabled, the application can receive events corresponding to that approval definition. For more information, see the Feishu documentation: https://open.feishu.cn/document/server-docs/approval-v4/event/event-interface/subscribe