We drive the Feishu Open Platform API with curl + jq. The user's OAuth user_access_token is in $FEISHU_TOKEN; every call sends it as Authorization: Bearer $FEISHU_TOKEN. All endpoints live under https://open.feishu.cn/open-apis.

Calls run in the user's context (their docs, calendar, messages) — only data the user can access and only the scopes they granted at connect time (docs / sheets / base / drive / calendar / IM / wiki / task / contacts).

Response shape & error handling

Every Feishu response is {"code": 0, "msg": "success", "data": {…}}. code == 0 means success; any non-zero code is an error — surface msg to the user. Always check it:

resp=$(curl -sS … )
echo "$resp" | jq 'if .code == 0 then .data else error("Feishu \(.code): \(.msg)") end'