DingTalk Trigger

DingTalk trigger plugin for Dify. It subscribes to DingTalk Open Platform events over the HTTP callback protocol and fires Dify workflows when events occur.

Source repository: https://github.com/sjr666666/dify-dingtalk-trigger

Events

Event	DingTalk event type	Description
Approval Instance Changed		An OA approval instance is created, completed, or terminated
Approval Task Changed		A task inside an approval flow is created, completed, or redirected
User Joined Organization		One or more users join the organization
User Left Organization		One or more users leave the organization
User Profile Updated		One or more user profiles are updated

Prerequisites

A DingTalk organization with developer console access.
A self-built org app in the DingTalk developer console.
Your Dify instance must be reachable from DingTalk servers over HTTPS (a public URL or a tunnel). DingTalk requires a public callback address.

Setup

Create a self-built app in the DingTalk developer console and note the .
Configure event subscription: in the app, open Events & Callbacks → Subscription mode, select HTTP push, and set:
- — any random string (you can generate one yourself);
- — 43 characters (DingTalk can generate one for you).
Copy these two values, you will need them in Dify.
Create a subscription in Dify: install the plugin, then add a trigger subscription. Fill in:
- — from step 1;
- — from step 2;
- — from step 2.
Dify generates a webhook endpoint URL for the subscription.
Point DingTalk at the Dify endpoint: set the message callback URL in the DingTalk event subscription page to the endpoint URL from step 3, then enable the events you want (approval events / organization events).
DingTalk sends a handshake; the plugin answers it automatically. Once the console shows the callback as verified, events will start flowing.

Security

Every callback request is verified with the DingTalk scheme (SHA-1 over the sorted /// tuple) before any processing.
The encrypted payload is decrypted with AES-256-CBC using your , and the receiver id embedded in the plaintext is checked against your .
Invalid signatures or malformed payloads are rejected without dispatching any workflow.

Limitations

Only the HTTP push subscription mode is supported. DingTalk's Stream mode (websocket) and robot chat messages are not part of this plugin.
The approval form payload is forwarded as-is; its structure depends on your approval template.

Privacy

See PRIVACY.md.

Events

Setup

Create a self-built app in the DingTalk developer console and note the .

Configure event subscription: in the app, open Events & Callbacks → Subscription mode, select HTTP push, and set:

— any random string (you can generate one yourself);
— 43 characters (DingTalk can generate one for you).

Copy these two values, you will need them in Dify.

Create a subscription in Dify: install the plugin, then add a trigger subscription. Fill in:

— from step 1;
— from step 2;
— from step 2.

Dify generates a webhook endpoint URL for the subscription.

Point DingTalk at the Dify endpoint: set the message callback URL in the DingTalk event subscription page to the endpoint URL from step 3, then enable the events you want (approval events / organization events).

DingTalk sends a handshake; the plugin answers it automatically. Once the console shows the callback as verified, events will start flowing.

Security

Every callback request is verified with the DingTalk scheme (SHA-1 over the sorted /// tuple) before any processing.

The encrypted payload is decrypted with AES-256-CBC using your , and the receiver id embedded in the plaintext is checked against your .

Invalid signatures or malformed payloads are rejected without dispatching any workflow.