Workflows can continuously send record fields to arbitrary external HTTP endpoints
Source references: 4The workflow protocol permits dynamic field references in URLs, headers, and request bodies. Its example builds a POST body containing lead name, mobile number, company, owner, and record ID for an external CRM. This is an example rather than an automatically installed backdoor, but an enabled workflow of this form transmits data whenever triggered.
Customer data, personal information, or internal records may leave Lark for a third-party system. A mistaken or untrusted endpoint could cause ongoing disclosure.
This is not an automatically installed backdoor; it is a configurable behavior in a user-created Workflow. HTTPClientAction supports arbitrary methods, dynamic URLs, headers, and request bodies assembled from prior record fields. The example sends a lead name, phone number, company, owner, and record ID to an external CRM. Once such a workflow is created and enabled, matching triggers can transmit data. Users should require an explicit host, field list, trigger conditions, and credential handling, and restrict allowed destinations.
### HTTPClientAction```json{ "method": "POST", "url": [{ "value_type": "text", "value": "https://api.example.com/webhook" }], "queries": [ { "key": "source", "value": [{ "value_type": "text", "value": "workflow" }] } ], "headers": [ { "key": "Content-Type", "value": [{ "value_type": "text", "value": "application/json" }] } ], "body_type": "raw", "raw_body": [ { "value_type": "text", "value": "{\"record_id\":\"" }, { "value_type": "ref", "value": "$.step_1.recordId" }, { "value_type": "text", "value": "\"}" } ], "response_type": "json", "response_value": "{\"success\":true,\"message\":\"data fetched successfully\"}"}```| 字段 | 必填 | 说明 ||------|-----|------|| `method` | 否 | 请求方法：`GET` / `POST` / `PUT` / `PATCH` / `DELETE`，默认 `POST` || `url` | 是 | ValueInfo[]，请求 URL，支持 `text` / `ref` 拼接 || `queries` | 否 | KeyValue[]，查询参数 || `headers` | 否 | KeyValue[]，请求头 || `body_type` | 否 | 请求体类型：`none` / `raw` / `form-data` / `form-urlencoded`，默认 `raw` || `raw_body` | 否 | ValueInfo[]，原始请求体，仅 `body_type=raw` 时使用 || `form_body` | 否 | KeyValue[]，表单数据，仅 `body_type=form-data` 或 `body_type=form-urlencoded` 时使用 || `response_type` | 否 | 响应类型：`none` / `text` / `json`，默认 `json` || `response_value` | 否 | string，JSON 字符串形式的响应结果示例；仅当 `response_type=json` 时必填 |Show 3 other places
"next": "step_add_sync_log", "data": { "method": "POST", "url": [ { "value_type": "text", "value": "https://api.example-crm.com/v1/leads/sync" } ], "headers": [ { "key": "Content-Type", "value": [{ "value_type": "text", "value": "application/json" }] }, { "key": "X-System", "value": [{ "value_type": "text", "value": "lark_base_workflow" }] } ], "body_type": "raw", "raw_body": [ { "value_type": "text", "value": "{\"lead_name\":\"" }, { "value_type": "ref", "value": "$.step_button_trigger.fldLeadName" }, { "value_type": "text", "value": "\",\"mobile\":\"" }, { "value_type": "ref", "value": "$.step_button_trigger.fldMobile" }, { "value_type": "text", "value": "\",\"company\":\"" }, { "value_type": "ref", "value": "$.step_button_trigger.fldCompany" }, { "value_type": "text", "value": "\",\"owner\":\"" }, { "value_type": "ref", "value": "$.step_button_trigger.fldOwner" }, { "value_type": "text", "value": "\",\"source_record_id\":\"" }, { "value_type": "ref", "value": "$.step_button_trigger.recordId" }, { "value_type": "text", "value": "\"}" } ],|------|-----|------|| `method` | 否 | 请求方法：`GET` / `POST` / `PUT` / `PATCH` / `DELETE`，默认 `POST` || `url` | 是 | ValueInfo[]，请求 URL，支持 `text` / `ref` 拼接 || `queries` | 否 | KeyValue[]，查询参数 || `headers` | 否 | KeyValue[]，请求头 || `body_type` | 否 | 请求体类型：`none` / `raw` / `form-data` / `form-urlencoded`，默认 `raw` || `raw_body` | 否 | ValueInfo[]，原始请求体，仅 `body_type=raw` 时使用 || `form_body` | 否 | KeyValue[]，表单数据，仅 `body_type=form-data` 或 `body_type=form-urlencoded` 时使用 | "data": { "method": "POST", "url": [ { "value_type": "text", "value": "https://api.example-crm.com/v1/leads/sync" } ], "headers": [ { "key": "Content-Type", "value": [{ "value_type": "text", "value": "application/json" }] }, { "key": "X-System", "value": [{ "value_type": "text", "value": "lark_base_workflow" }] } ], "body_type": "raw", "raw_body": [ { "value_type": "text", "value": "{\"lead_name\":\"" }, { "value_type": "ref", "value": "$.step_button_trigger.fldLeadName" }, { "value_type": "text", "value": "\",\"mobile\":\"" }, { "value_type": "ref", "value": "$.step_button_trigger.fldMobile" }, { "value_type": "text", "value": "\",\"company\":\"" }, { "value_type": "ref", "value": "$.step_button_trigger.fldCompany" }, { "value_type": "text", "value": "\",\"owner\":\"" }, { "value_type": "ref", "value": "$.step_button_trigger.fldOwner" }, { "value_type": "text", "value": "\",\"source_record_id\":\"" }, { "value_type": "ref", "value": "$.step_button_trigger.recordId" }, { "value_type": "text", "value": "\"}" } ],