We drive the WeCom server-side API (https://qyapi.weixin.qq.com) with curl + jq as a self-built app (自建应用).

Setup: see WeCom authentication for how to create the self-built app, collect CorpID / Secret / AgentId, and grant it the contacts / docs / calendar / meeting permissions. The skill reads WECOM_CORP_ID, WECOM_CORP_SECRET and WECOM_AGENT_ID from the environment; on AceDataCloud they are injected automatically by the 企业微信 connector.

WeCom uses a two-step token flow (identical in shape to the WeChat MP API):

Exchange CorpID + Secret for an access_token (TTL 7200s).
Pass that access_token as a query string parameter on every other call.

Never log or echo $WECOM_CORP_SECRET — treat it like a password.

Responses are JSON returned with HTTP 200; errcode == 0 means success. On any non-zero errcode, show the original errmsg to the user verbatim (see the error table in the setup doc).

wecom