LinkedIn
Decision-gated
LinkedIn engineering guide

Specify an app-to-LinkedIn message command safely

A command-lifecycle guide covering connected-account ownership, conversation identity, approval, idempotency, provider acknowledgement, and reply handoff.

Educational research only. LinkedIn account access remains decision-gated. No DewEngine LinkedIn connector is approved or implemented.
01
Availability

There is no DewEngine LinkedIn send endpoint today

message.send appears in the target capability catalog, but the LinkedIn provider is decision-gated, uses an unresolved non-official session path, and has no implementation or conformance evidence. An application should hide or disable the action through capability discovery. This guide defines the customer-facing contract that would still need provider and legal approval before any external request.

  • Do not ship sample code that suggests a released route
  • Return a stable policy-gated state to product clients
02
Command input

Use internal account and conversation references

The host application should submit an opaque connected-account ID, an account-scoped conversation or recipient reference, final content, customer record reference, purpose, and idempotency key. It must not send provider credentials or guess global profile IDs. The service validates workspace ownership, account health, relationship context, and method support before creating any durable command.

  • Reject foreign account, recipient, and conversation combinations
  • Keep customer references opaque and length-bounded
03
Approval

Bind user intent to the final payload

Show the acting professional account, recipient, conversation context, and rendered message before authorization. Store the approving user, timestamp, policy version, and content hash. Editing text, switching sender, changing recipient, or adding media invalidates approval. A background automation may prepare a proposal but cannot broaden the approved purpose or silently replace the human sender.

  • Expire approval after material context changes
  • Let users cancel queued commands and see the result
04
Dispatch lifecycle

Persist before the provider boundary

A worker reserves account budget and records a pre-dispatch attempt before touching the provider. Outcomes distinguish acknowledged, definite pre-dispatch failure, provider rejection, throttling, and indeterminate after possible dispatch. An idempotency key deduplicates client retries, but it cannot make an unknown provider action safe to repeat. Reconciliation needs an approved read contract and exact evidence.

  • Never infer recipient delivery from acknowledgement
  • Prevent concurrent workers from using the same command
05
Reply loop

Complete the product with inbound ownership

A successful messaging feature routes authorized inbound observations to the correct tenant record, deduplicates them, and pauses stale follow-ups. The application needs a signed event with safe identifiers and truthful observation time, not the sender's whole inbox. Human ownership, response status, and internal notes remain customer workflow state rather than provider facts.

  • Make webhook consumers replay-safe
  • Keep private messages out of logs and generic analytics
06
Readiness

Fault-test every boundary before exposing the button

Release requires approved access, provider authorization, consented real-account tests, tenant substitution, stale approval, duplicate requests, concurrent dispatch, timeout, throttling, restriction, reconnect, reply race, suppression, retention, deletion, audit, budgets, and kill-switch proof. A working internal state machine does not make the provider method sellable. Public SDKs must remain absent until the manifest changes.

  • Prove one command produces at most one provider attempt
  • Prove account stop wins over all queued sends
Questions

Before you build.

What should an app receive after submitting a future message command?+

A durable command reference and truthful state, not an immediate claim of delivery. The app can observe acknowledgement, rejection, throttling, or indeterminate outcome and react according to documented retry rules.

Can the app store a LinkedIn session to simplify sending?+

It should not. If the provider gate ever clears, sensitive authorization belongs in a hardened connector boundary with managed encryption, narrow decryption access, rotation, redaction, and deletion.

Build with us

Does this match the workflow your users need?

DewEngine is in development. Real use cases decide what ships first.

Share your use case