LINE WORKS connector

日本語: LINE WORKS コネクター

Property	Value
Plugin id	line-works (bundled, off by default), CLI kurahi lineworks
Default access	Read-only: information and members of the configured channels (bot.read)
Opt-in access	Send a text message to a configured channel or user (bot.message), every send approved
Sign-in	Service account: a JWT (RS256) signed with the app’s private key, exchanged for a token
Secrets	connector.line-works.privateKey, connector.line-works.clientSecret, cached token
Status	Available

Reading messages is not possible

LINE WORKS API 2.0 has no endpoint that lists or reads message history. A bot receives messages only as events posted to its callback URL (HTTPS, signed with the bot secret). This connector does not host a callback endpoint, so it reads no messages. What it can read is channel information (title, type) and channel members.

Tools

Tool	Needs	What it does
lineworks_channel_get	bot.read	Title and type of one configured channel
lineworks_channel_members	bot.read	Member user ids (at most 100 per call, cursor paging)
lineworks_message_send (write.send)	bot.message + approval	One text message (at most 2,000 characters) to a configured channel or user

Only the channels in channels and the users in users can be addressed; others are refused before any request. Every send asks a person (target, length, start of the text) and is refused unless approved before the timeout; a grant without bot.message is refused before anyone is asked. Standing (autopilot) approvals are not supported for this connector: the standing-send path is built around mail recipients, so every LINE WORKS message needs a person.

Set up

1. In the LINE WORKS Developer Console, create an app. Issue a Service Account and download its Private Key. Add the OAuth scopes bot.read (and bot.message for sending). Note the Client ID and Client Secret.
2. Register a bot, add it to the channels it should use, and note the Bot ID and channel ids.
3. Configure:

kurahi plugins enable line-works
kurahi secrets set connector.line-works.privateKey --stdin < private_key.key
kurahi secrets set connector.line-works.clientSecret
kurahi config set plugins.entries.line-works.config '{
  "clientId": "<client id>", "serviceAccount": "<id>.serviceaccount@<domain>",
  "botId": "<bot id>", "channels": ["<channel id>"], "users": []
}' --json
kurahi lineworks status
kurahi lineworks login      # mints one token with the stored key: proves key, secret and scopes
kurahi lineworks probe

Key	Default	Meaning
clientId	none	App Client ID
serviceAccount	none	Service account id
botId	none	The bot
channels, users	none	The only targets the bot may read or message
write.send	false	lineworks_message_send
ratePerSecond	1	Client-side request limit (Free plan: 60 per minute)
approvalTimeoutSeconds	120	How long a send waits for a person

Data handling

• Untrusted content. Channel titles and member ids reach the model only inside the untrusted-content boundary.
• Audit. One row per call (connector.line-works.<operation>): channel or user ids, counts, duration, error code. Never message text; ids that are e-mail addresses are dropped from the audit row.
• Tokens. The JWT is valid for at most 60 minutes and is used once; the access token (1 or 24 hours, as set in the Developer Console) is cached in the secret store and minted again shortly before it expires. No refresh token is kept.
• Limits. 60 requests per minute per API on the Free plan, 240 on Standard and Advanced, at most 5 in parallel; the connector stays at 1 per second by default.
• Endpoints. Only auth.worksmobile.com and www.worksapis.com.

Status and revocation

The gateway probes the first configured channel (or GET /bots). kurahi lineworks logout deletes the cached token; to cut access, regenerate or delete the private key or client secret in the Developer Console.

References

Official LINE WORKS documentation: JWT claims, token endpoint, lifetimes and service-account scope limits (auth-jwt); send endpoints (user, channel); text limit (bot-send-text); channel endpoints (get, members); no history API (bot-api, callback); rate limits (rate-limits).

Setup note: the channel endpoints use the bot.read scope; if your domain requires more for them, add bot as well (the documentation lists bot, bot.message and bot.read).