diff --git a/api-reference/on-call.openapi.en.json b/api-reference/on-call.openapi.en.json
index 3d00d7ed..3f68fcbf 100644
--- a/api-reference/on-call.openapi.en.json
+++ b/api-reference/on-call.openapi.en.json
@@ -245,7 +245,7 @@
           "On-call/Integrations"
         ],
         "x-mint": {
-          "content": "## Restrictions\n\n| Aspect | Value |\n| ------ | ----- |\n| Rate limits | **1,000 requests/minute**; **50 requests/second** per account |\n| Permissions | **Integrations Read** (`on-call`) |\n\n## Usage\n\n- `orderby` defaults to `created_at`; `plugin_type` is sorted by the underlying plugin.\n- `plugin_type`, `status` and `category` accept comma-separated values; `ref_ids` values must start with `c_`, `a_` or `w_`; a `c_` filter is syntactically accepted but does not return channel-owned integrations.\n- With `is_my_team` set, results are limited to your teams and `team_ids` narrows that set further.\n- These APIs manage public (account-level) integrations only, not channel-owned dedicated integrations.\n- Items include `settings`, `integration_key`, `plugin_id`, `account_id`, and the legacy `data_source_id` alias; credential values are not masked.",
+          "content": "## Restrictions\n\n| Aspect | Value |\n| ------ | ----- |\n| Rate limits | **1,000 requests/minute**; **50 requests/second** per account |\n| Permissions | **Integrations Read** (`on-call`) |\n\n## Usage\n\n- `orderby` defaults to `created_at`; `plugin_type` is sorted by the underlying plugin.\n- `plugin_type`, `status` and `category` accept comma-separated values; `ref_ids` values must start with `c_`, `a_` or `w_`; a `c_` filter is syntactically accepted but does not return channel-owned integrations.\n- With `is_my_team` set, results are limited to your teams and `team_ids` narrows that set further.\n- These APIs manage public (account-level) integrations only, not channel-owned dedicated integrations.\n- Items include `settings`, `integration_key`, `plugin_id`, `account_id`, and the legacy `data_source_id` alias. Saved secret values in `settings` are returned as `******`; `integration_key` is returned as is.",
           "href": "/en/api-reference/on-call/integrations/integration-api-read-list",
           "metadata": {
             "sidebarTitle": "List integrations"
@@ -350,7 +350,7 @@
           "On-call/Integrations"
         ],
         "x-mint": {
-          "content": "## Restrictions\n\n| Aspect | Value |\n| ------ | ----- |\n| Rate limits | **1,000 requests/minute**; **50 requests/second** per account |\n| Permissions | **Integrations Read** (`on-call`) |\n\n## Usage\n\n- These APIs manage public (account-level) integrations only, not channel-owned dedicated integrations.\n- Settings and the integration key are returned without masking, matching the legacy datasource detail response.",
+          "content": "## Restrictions\n\n| Aspect | Value |\n| ------ | ----- |\n| Rate limits | **1,000 requests/minute**; **50 requests/second** per account |\n| Permissions | **Integrations Read** (`on-call`) |\n\n## Usage\n\n- These APIs manage public (account-level) integrations only, not channel-owned dedicated integrations.\n- Saved secret values in `settings` are returned as `******`, and unset ones stay empty. The integration key is returned as is.",
           "href": "/en/api-reference/on-call/integrations/integration-api-read-info",
           "metadata": {
             "sidebarTitle": "Get integration detail"
@@ -528,7 +528,7 @@
           "On-call/Integrations"
         ],
         "x-mint": {
-          "content": "## Restrictions\n\n| Aspect | Value |\n| ------ | ----- |\n| Rate limits | **300 requests/minute**; **20 requests/second** per account |\n| Permissions | **Integrations Manage** (`on-call`) |\n\n## Usage\n\n- Only the fields you send are changed; omitted fields keep their current value.\n- Submitting `settings` replaces the configuration; known sensitive fields omitted or sent as `******` retain their value. Send `headers: {}` to clear headers; use the integration type’s explicit empty value to clear a body.\n- Submit `settings` together with `is_test: true` to receive a plugin test result; settings in the response are not masked.\n- These APIs manage public (account-level) integrations only, not channel-owned dedicated integrations.\n- Write access also requires object permission: the account owner, an administrator, the creator, or a member of the assigned team; with no team, members with Integrations Manage may operate. Read-only integrations cannot be changed.\n- Every call is recorded in the account audit log.",
+          "content": "## Restrictions\n\n| Aspect | Value |\n| ------ | ----- |\n| Rate limits | **300 requests/minute**; **20 requests/second** per account |\n| Permissions | **Integrations Manage** (`on-call`) |\n\n## Usage\n\n- Only the fields you send are changed; omitted fields keep their current value.\n- Submitting `settings` replaces the configuration; known sensitive fields omitted or sent as `******` retain their value. Keeping a stored secret while changing where it is sent (such as `endpoint`, `url`, a database host or port, or an IM API base URL) is rejected, so send the secrets again with the new destination; `******` on a field with no stored value is rejected too. Send `headers: {}` to clear headers; use the integration type’s explicit empty value to clear a body.\n- Submit `settings` together with `is_test: true` to receive a plugin test result; secrets in the returned settings are masked the same way.\n- These APIs manage public (account-level) integrations only, not channel-owned dedicated integrations.\n- Write access also requires object permission: the account owner, an administrator, the creator, or a member of the assigned team; with no team, members with Integrations Manage may operate. Read-only integrations cannot be changed.\n- Every call is recorded in the account audit log.",
           "href": "/en/api-reference/on-call/integrations/integration-api-write-update",
           "metadata": {
             "sidebarTitle": "Update integration"
@@ -34913,7 +34913,7 @@
           "settings": {
             "type": "object",
             "additionalProperties": true,
-            "description": "Stored type-specific configuration, including credential values without masking; matches the legacy `/datasource/*` response behavior."
+            "description": "Stored type-specific configuration. Each saved secret (passwords, app secrets, tokens, encryption keys, webhook endpoints, HTTP pull URL and body, headers, custom bodies) is returned as `******`; unset values stay empty."
           },
           "data_source_id": {
             "type": "integer",
@@ -35098,7 +35098,7 @@
           "settings": {
             "type": "object",
             "additionalProperties": true,
-            "description": "Stored type-specific configuration, including credential values without masking; matches the legacy `/datasource/*` response behavior."
+            "description": "Stored type-specific configuration. Each saved secret (passwords, app secrets, tokens, encryption keys, webhook endpoints, HTTP pull URL and body, headers, custom bodies) is returned as `******`; unset values stay empty."
           },
           "test": {
             "type": "object",
@@ -35251,7 +35251,7 @@
           },
           "settings": {
             "type": "object",
-            "description": "Replacement type-specific configuration. Known sensitive fields omitted or sent as `******` keep their stored value; an explicit empty headers object clears headers.",
+            "description": "Replacement type-specific configuration. Known sensitive fields omitted or sent as `******` keep their stored value; an explicit empty headers object clears headers. A stored secret cannot be kept while its destination (such as `endpoint`, `url`, or a database host or port) changes.",
             "additionalProperties": true
           },
           "is_test": {
diff --git a/api-reference/on-call.openapi.zh.json b/api-reference/on-call.openapi.zh.json
index cc5e23c5..7a73371c 100644
--- a/api-reference/on-call.openapi.zh.json
+++ b/api-reference/on-call.openapi.zh.json
@@ -245,7 +245,7 @@
           "On-call/集成中心"
         ],
         "x-mint": {
-          "content": "## 限制说明\n\n| 项目 | 说明 |\n| ---- | ---- |\n| 速率限制 | 每个账户 **1,000 次/分钟**；**50 次/秒** |\n| 权限要求 | **集成中心查看**（`on-call`） |\n\n## 使用说明\n\n- `orderby` 默认 `created_at`；`plugin_type` 按底层插件排序。\n- `plugin_type`、`status`、`category` 支持逗号分隔多值；`ref_ids` 每个值必须以 `c_`、`a_` 或 `w_` 开头；`c_` 过滤值通过格式校验，但不会返回协作空间专属集成。\n- 传入 `is_my_team` 时仅返回你所在团队的集成，`team_ids` 会在该范围内进一步收窄。\n- 这些接口仅管理公共（账户级）集成，不管理协作空间专属集成。\n- 列表项包含 `settings`、`integration_key`、`plugin_id`、`account_id` 及旧 ID 别名 `data_source_id`，凭据按原值返回，不打码。",
+          "content": "## 限制说明\n\n| 项目 | 说明 |\n| ---- | ---- |\n| 速率限制 | 每个账户 **1,000 次/分钟**；**50 次/秒** |\n| 权限要求 | **集成中心查看**（`on-call`） |\n\n## 使用说明\n\n- `orderby` 默认 `created_at`；`plugin_type` 按底层插件排序。\n- `plugin_type`、`status`、`category` 支持逗号分隔多值；`ref_ids` 每个值必须以 `c_`、`a_` 或 `w_` 开头；`c_` 过滤值通过格式校验，但不会返回协作空间专属集成。\n- 传入 `is_my_team` 时仅返回你所在团队的集成，`team_ids` 会在该范围内进一步收窄。\n- 这些接口仅管理公共（账户级）集成，不管理协作空间专属集成。\n- 列表项包含 `settings`、`integration_key`、`plugin_id`、`account_id` 及旧 ID 别名 `data_source_id`。`settings` 中已保存的密钥类值返回 `******`，`integration_key` 按原值返回。",
           "href": "/zh/api-reference/on-call/integrations/integration-api-read-list",
           "metadata": {
             "sidebarTitle": "查询集成列表"
@@ -350,7 +350,7 @@
           "On-call/集成中心"
         ],
         "x-mint": {
-          "content": "## 限制说明\n\n| 项目 | 说明 |\n| ---- | ---- |\n| 速率限制 | 每个账户 **1,000 次/分钟**；**50 次/秒** |\n| 权限要求 | **集成中心查看**（`on-call`） |\n\n## 使用说明\n\n- 这些接口仅管理公共（账户级）集成，不管理协作空间专属集成。\n- settings 与集成 Key 按原值返回，不打码，与旧 datasource 详情接口行为一致。",
+          "content": "## 限制说明\n\n| 项目 | 说明 |\n| ---- | ---- |\n| 速率限制 | 每个账户 **1,000 次/分钟**；**50 次/秒** |\n| 权限要求 | **集成中心查看**（`on-call`） |\n\n## 使用说明\n\n- 这些接口仅管理公共（账户级）集成，不管理协作空间专属集成。\n- `settings` 中已保存的密钥类值返回 `******`，未设置的保持为空；集成 Key 按原值返回。",
           "href": "/zh/api-reference/on-call/integrations/integration-api-read-info",
           "metadata": {
             "sidebarTitle": "查询集成详情"
@@ -528,7 +528,7 @@
           "On-call/集成中心"
         ],
         "x-mint": {
-          "content": "## 限制说明\n\n| 项目 | 说明 |\n| ---- | ---- |\n| 速率限制 | 每个账户 **300 次/分钟**；**20 次/秒** |\n| 权限要求 | **集成中心管理**（`on-call`） |\n\n## 使用说明\n\n- 仅发送的字段会被修改，未发送的字段保持原值。\n- 提交 `settings` 会替换配置；已识别的敏感字段不传或传 `******` 时保留原值。清空 Headers 请传 `headers: {}`；清空 Body 请使用该集成类型的显式空值。\n- 同时提交 `settings` 与 `is_test: true` 可获得插件测试结果，返回的 settings 不打码。\n- 这些接口仅管理公共（账户级）集成，不管理协作空间专属集成。\n- 写操作还需对象权限：主体账户、管理员、创建者或所属团队成员可操作；未设置团队时，拥有集成中心管理权限的成员可操作，只读集成不可修改。\n- 每次调用都会记录到账户审计日志。",
+          "content": "## 限制说明\n\n| 项目 | 说明 |\n| ---- | ---- |\n| 速率限制 | 每个账户 **300 次/分钟**；**20 次/秒** |\n| 权限要求 | **集成中心管理**（`on-call`） |\n\n## 使用说明\n\n- 仅发送的字段会被修改，未发送的字段保持原值。\n- 提交 `settings` 会替换配置；已识别的敏感字段不传或传 `******` 时保留原值。保留已存密钥的同时修改它的发送目标（如 `endpoint`、`url`、数据库主机或端口、IM 接口地址）会被拒绝，需要随新目标重新填写密钥；没有已存值的字段传 `******` 也会被拒绝。清空 Headers 请传 `headers: {}`；清空 Body 请使用该集成类型的显式空值。\n- 同时提交 `settings` 与 `is_test: true` 可获得插件测试结果，返回的 settings 中密钥同样返回 `******`。\n- 这些接口仅管理公共（账户级）集成，不管理协作空间专属集成。\n- 写操作还需对象权限：主体账户、管理员、创建者或所属团队成员可操作；未设置团队时，拥有集成中心管理权限的成员可操作，只读集成不可修改。\n- 每次调用都会记录到账户审计日志。",
           "href": "/zh/api-reference/on-call/integrations/integration-api-write-update",
           "metadata": {
             "sidebarTitle": "更新集成"
@@ -34913,7 +34913,7 @@
           "settings": {
             "type": "object",
             "additionalProperties": true,
-            "description": "按存储值返回的类型专属配置，凭据不打码，与旧 `/datasource/*` 返回行为一致。"
+            "description": "存储的类型专属配置。已保存的密钥类值（密码、App Secret、Token、加密密钥、Webhook 地址、HTTP 拉取的 URL 与 Body、Headers、自定义 Body）返回 `******`，未设置的保持为空。"
           },
           "data_source_id": {
             "type": "integer",
@@ -35098,7 +35098,7 @@
           "settings": {
             "type": "object",
             "additionalProperties": true,
-            "description": "按存储值返回的类型专属配置，凭据不打码，与旧 `/datasource/*` 返回行为一致。"
+            "description": "存储的类型专属配置。已保存的密钥类值（密码、App Secret、Token、加密密钥、Webhook 地址、HTTP 拉取的 URL 与 Body、Headers、自定义 Body）返回 `******`，未设置的保持为空。"
           },
           "test": {
             "type": "object",
@@ -35251,7 +35251,7 @@
           },
           "settings": {
             "type": "object",
-            "description": "替换类型专属配置；已识别的敏感字段不传或传 `******` 时保留原值，显式传空 headers 对象可清空 Headers。",
+            "description": "替换类型专属配置；已识别的敏感字段不传或传 `******` 时保留原值，显式传空 headers 对象可清空 Headers。保留已存密钥时不能同时修改它的发送目标（如 `endpoint`、`url`、数据库主机或端口）。",
             "additionalProperties": true
           },
           "is_test": {
diff --git a/api-reference/openapi.en.json b/api-reference/openapi.en.json
index 95a3c2e1..f01cc75b 100644
--- a/api-reference/openapi.en.json
+++ b/api-reference/openapi.en.json
@@ -32935,7 +32935,7 @@
           "settings": {
             "type": "object",
             "additionalProperties": true,
-            "description": "Stored type-specific configuration, including credential values without masking; matches the legacy `/datasource/*` response behavior."
+            "description": "Stored type-specific configuration. Each saved secret (passwords, app secrets, tokens, encryption keys, webhook endpoints, HTTP pull URL and body, headers, custom bodies) is returned as `******`; unset values stay empty."
           },
           "data_source_id": {
             "type": "integer",
@@ -33120,7 +33120,7 @@
           "settings": {
             "type": "object",
             "additionalProperties": true,
-            "description": "Stored type-specific configuration, including credential values without masking; matches the legacy `/datasource/*` response behavior."
+            "description": "Stored type-specific configuration. Each saved secret (passwords, app secrets, tokens, encryption keys, webhook endpoints, HTTP pull URL and body, headers, custom bodies) is returned as `******`; unset values stay empty."
           },
           "test": {
             "type": "object",
@@ -33273,7 +33273,7 @@
           },
           "settings": {
             "type": "object",
-            "description": "Replacement type-specific configuration. Known sensitive fields omitted or sent as `******` keep their stored value; an explicit empty headers object clears headers.",
+            "description": "Replacement type-specific configuration. Known sensitive fields omitted or sent as `******` keep their stored value; an explicit empty headers object clears headers. A stored secret cannot be kept while its destination (such as `endpoint`, `url`, or a database host or port) changes.",
             "additionalProperties": true
           },
           "is_test": {
@@ -67481,7 +67481,7 @@
           "On-call/Integrations"
         ],
         "x-mint": {
-          "content": "## Restrictions\n\n| Aspect | Value |\n| ------ | ----- |\n| Rate limits | **1,000 requests/minute**; **50 requests/second** per account |\n| Permissions | **Integrations Read** (`on-call`) |\n\n## Usage\n\n- `orderby` defaults to `created_at`; `plugin_type` is sorted by the underlying plugin.\n- `plugin_type`, `status` and `category` accept comma-separated values; `ref_ids` values must start with `c_`, `a_` or `w_`; a `c_` filter is syntactically accepted but does not return channel-owned integrations.\n- With `is_my_team` set, results are limited to your teams and `team_ids` narrows that set further.\n- These APIs manage public (account-level) integrations only, not channel-owned dedicated integrations.\n- Items include `settings`, `integration_key`, `plugin_id`, `account_id`, and the legacy `data_source_id` alias; credential values are not masked.",
+          "content": "## Restrictions\n\n| Aspect | Value |\n| ------ | ----- |\n| Rate limits | **1,000 requests/minute**; **50 requests/second** per account |\n| Permissions | **Integrations Read** (`on-call`) |\n\n## Usage\n\n- `orderby` defaults to `created_at`; `plugin_type` is sorted by the underlying plugin.\n- `plugin_type`, `status` and `category` accept comma-separated values; `ref_ids` values must start with `c_`, `a_` or `w_`; a `c_` filter is syntactically accepted but does not return channel-owned integrations.\n- With `is_my_team` set, results are limited to your teams and `team_ids` narrows that set further.\n- These APIs manage public (account-level) integrations only, not channel-owned dedicated integrations.\n- Items include `settings`, `integration_key`, `plugin_id`, `account_id`, and the legacy `data_source_id` alias. Saved secret values in `settings` are returned as `******`; `integration_key` is returned as is.",
           "href": "/en/api-reference/on-call/integrations/integration-api-read-list",
           "metadata": {
             "sidebarTitle": "List integrations"
@@ -67586,7 +67586,7 @@
           "On-call/Integrations"
         ],
         "x-mint": {
-          "content": "## Restrictions\n\n| Aspect | Value |\n| ------ | ----- |\n| Rate limits | **1,000 requests/minute**; **50 requests/second** per account |\n| Permissions | **Integrations Read** (`on-call`) |\n\n## Usage\n\n- These APIs manage public (account-level) integrations only, not channel-owned dedicated integrations.\n- Settings and the integration key are returned without masking, matching the legacy datasource detail response.",
+          "content": "## Restrictions\n\n| Aspect | Value |\n| ------ | ----- |\n| Rate limits | **1,000 requests/minute**; **50 requests/second** per account |\n| Permissions | **Integrations Read** (`on-call`) |\n\n## Usage\n\n- These APIs manage public (account-level) integrations only, not channel-owned dedicated integrations.\n- Saved secret values in `settings` are returned as `******`, and unset ones stay empty. The integration key is returned as is.",
           "href": "/en/api-reference/on-call/integrations/integration-api-read-info",
           "metadata": {
             "sidebarTitle": "Get integration detail"
@@ -67764,7 +67764,7 @@
           "On-call/Integrations"
         ],
         "x-mint": {
-          "content": "## Restrictions\n\n| Aspect | Value |\n| ------ | ----- |\n| Rate limits | **300 requests/minute**; **20 requests/second** per account |\n| Permissions | **Integrations Manage** (`on-call`) |\n\n## Usage\n\n- Only the fields you send are changed; omitted fields keep their current value.\n- Submitting `settings` replaces the configuration; known sensitive fields omitted or sent as `******` retain their value. Send `headers: {}` to clear headers; use the integration type’s explicit empty value to clear a body.\n- Submit `settings` together with `is_test: true` to receive a plugin test result; settings in the response are not masked.\n- These APIs manage public (account-level) integrations only, not channel-owned dedicated integrations.\n- Write access also requires object permission: the account owner, an administrator, the creator, or a member of the assigned team; with no team, members with Integrations Manage may operate. Read-only integrations cannot be changed.\n- Every call is recorded in the account audit log.",
+          "content": "## Restrictions\n\n| Aspect | Value |\n| ------ | ----- |\n| Rate limits | **300 requests/minute**; **20 requests/second** per account |\n| Permissions | **Integrations Manage** (`on-call`) |\n\n## Usage\n\n- Only the fields you send are changed; omitted fields keep their current value.\n- Submitting `settings` replaces the configuration; known sensitive fields omitted or sent as `******` retain their value. Keeping a stored secret while changing where it is sent (such as `endpoint`, `url`, a database host or port, or an IM API base URL) is rejected, so send the secrets again with the new destination; `******` on a field with no stored value is rejected too. Send `headers: {}` to clear headers; use the integration type’s explicit empty value to clear a body.\n- Submit `settings` together with `is_test: true` to receive a plugin test result; secrets in the returned settings are masked the same way.\n- These APIs manage public (account-level) integrations only, not channel-owned dedicated integrations.\n- Write access also requires object permission: the account owner, an administrator, the creator, or a member of the assigned team; with no team, members with Integrations Manage may operate. Read-only integrations cannot be changed.\n- Every call is recorded in the account audit log.",
           "href": "/en/api-reference/on-call/integrations/integration-api-write-update",
           "metadata": {
             "sidebarTitle": "Update integration"
diff --git a/api-reference/openapi.zh.json b/api-reference/openapi.zh.json
index 99adf484..91b7dd9b 100644
--- a/api-reference/openapi.zh.json
+++ b/api-reference/openapi.zh.json
@@ -32935,7 +32935,7 @@
           "settings": {
             "type": "object",
             "additionalProperties": true,
-            "description": "按存储值返回的类型专属配置，凭据不打码，与旧 `/datasource/*` 返回行为一致。"
+            "description": "存储的类型专属配置。已保存的密钥类值（密码、App Secret、Token、加密密钥、Webhook 地址、HTTP 拉取的 URL 与 Body、Headers、自定义 Body）返回 `******`，未设置的保持为空。"
           },
           "data_source_id": {
             "type": "integer",
@@ -33120,7 +33120,7 @@
           "settings": {
             "type": "object",
             "additionalProperties": true,
-            "description": "按存储值返回的类型专属配置，凭据不打码，与旧 `/datasource/*` 返回行为一致。"
+            "description": "存储的类型专属配置。已保存的密钥类值（密码、App Secret、Token、加密密钥、Webhook 地址、HTTP 拉取的 URL 与 Body、Headers、自定义 Body）返回 `******`，未设置的保持为空。"
           },
           "test": {
             "type": "object",
@@ -33273,7 +33273,7 @@
           },
           "settings": {
             "type": "object",
-            "description": "替换类型专属配置；已识别的敏感字段不传或传 `******` 时保留原值，显式传空 headers 对象可清空 Headers。",
+            "description": "替换类型专属配置；已识别的敏感字段不传或传 `******` 时保留原值，显式传空 headers 对象可清空 Headers。保留已存密钥时不能同时修改它的发送目标（如 `endpoint`、`url`、数据库主机或端口）。",
             "additionalProperties": true
           },
           "is_test": {
@@ -67481,7 +67481,7 @@
           "On-call/集成中心"
         ],
         "x-mint": {
-          "content": "## 限制说明\n\n| 项目 | 说明 |\n| ---- | ---- |\n| 速率限制 | 每个账户 **1,000 次/分钟**；**50 次/秒** |\n| 权限要求 | **集成中心查看**（`on-call`） |\n\n## 使用说明\n\n- `orderby` 默认 `created_at`；`plugin_type` 按底层插件排序。\n- `plugin_type`、`status`、`category` 支持逗号分隔多值；`ref_ids` 每个值必须以 `c_`、`a_` 或 `w_` 开头；`c_` 过滤值通过格式校验，但不会返回协作空间专属集成。\n- 传入 `is_my_team` 时仅返回你所在团队的集成，`team_ids` 会在该范围内进一步收窄。\n- 这些接口仅管理公共（账户级）集成，不管理协作空间专属集成。\n- 列表项包含 `settings`、`integration_key`、`plugin_id`、`account_id` 及旧 ID 别名 `data_source_id`，凭据按原值返回，不打码。",
+          "content": "## 限制说明\n\n| 项目 | 说明 |\n| ---- | ---- |\n| 速率限制 | 每个账户 **1,000 次/分钟**；**50 次/秒** |\n| 权限要求 | **集成中心查看**（`on-call`） |\n\n## 使用说明\n\n- `orderby` 默认 `created_at`；`plugin_type` 按底层插件排序。\n- `plugin_type`、`status`、`category` 支持逗号分隔多值；`ref_ids` 每个值必须以 `c_`、`a_` 或 `w_` 开头；`c_` 过滤值通过格式校验，但不会返回协作空间专属集成。\n- 传入 `is_my_team` 时仅返回你所在团队的集成，`team_ids` 会在该范围内进一步收窄。\n- 这些接口仅管理公共（账户级）集成，不管理协作空间专属集成。\n- 列表项包含 `settings`、`integration_key`、`plugin_id`、`account_id` 及旧 ID 别名 `data_source_id`。`settings` 中已保存的密钥类值返回 `******`，`integration_key` 按原值返回。",
           "href": "/zh/api-reference/on-call/integrations/integration-api-read-list",
           "metadata": {
             "sidebarTitle": "查询集成列表"
@@ -67586,7 +67586,7 @@
           "On-call/集成中心"
         ],
         "x-mint": {
-          "content": "## 限制说明\n\n| 项目 | 说明 |\n| ---- | ---- |\n| 速率限制 | 每个账户 **1,000 次/分钟**；**50 次/秒** |\n| 权限要求 | **集成中心查看**（`on-call`） |\n\n## 使用说明\n\n- 这些接口仅管理公共（账户级）集成，不管理协作空间专属集成。\n- settings 与集成 Key 按原值返回，不打码，与旧 datasource 详情接口行为一致。",
+          "content": "## 限制说明\n\n| 项目 | 说明 |\n| ---- | ---- |\n| 速率限制 | 每个账户 **1,000 次/分钟**；**50 次/秒** |\n| 权限要求 | **集成中心查看**（`on-call`） |\n\n## 使用说明\n\n- 这些接口仅管理公共（账户级）集成，不管理协作空间专属集成。\n- `settings` 中已保存的密钥类值返回 `******`，未设置的保持为空；集成 Key 按原值返回。",
           "href": "/zh/api-reference/on-call/integrations/integration-api-read-info",
           "metadata": {
             "sidebarTitle": "查询集成详情"
@@ -67764,7 +67764,7 @@
           "On-call/集成中心"
         ],
         "x-mint": {
-          "content": "## 限制说明\n\n| 项目 | 说明 |\n| ---- | ---- |\n| 速率限制 | 每个账户 **300 次/分钟**；**20 次/秒** |\n| 权限要求 | **集成中心管理**（`on-call`） |\n\n## 使用说明\n\n- 仅发送的字段会被修改，未发送的字段保持原值。\n- 提交 `settings` 会替换配置；已识别的敏感字段不传或传 `******` 时保留原值。清空 Headers 请传 `headers: {}`；清空 Body 请使用该集成类型的显式空值。\n- 同时提交 `settings` 与 `is_test: true` 可获得插件测试结果，返回的 settings 不打码。\n- 这些接口仅管理公共（账户级）集成，不管理协作空间专属集成。\n- 写操作还需对象权限：主体账户、管理员、创建者或所属团队成员可操作；未设置团队时，拥有集成中心管理权限的成员可操作，只读集成不可修改。\n- 每次调用都会记录到账户审计日志。",
+          "content": "## 限制说明\n\n| 项目 | 说明 |\n| ---- | ---- |\n| 速率限制 | 每个账户 **300 次/分钟**；**20 次/秒** |\n| 权限要求 | **集成中心管理**（`on-call`） |\n\n## 使用说明\n\n- 仅发送的字段会被修改，未发送的字段保持原值。\n- 提交 `settings` 会替换配置；已识别的敏感字段不传或传 `******` 时保留原值。保留已存密钥的同时修改它的发送目标（如 `endpoint`、`url`、数据库主机或端口、IM 接口地址）会被拒绝，需要随新目标重新填写密钥；没有已存值的字段传 `******` 也会被拒绝。清空 Headers 请传 `headers: {}`；清空 Body 请使用该集成类型的显式空值。\n- 同时提交 `settings` 与 `is_test: true` 可获得插件测试结果，返回的 settings 中密钥同样返回 `******`。\n- 这些接口仅管理公共（账户级）集成，不管理协作空间专属集成。\n- 写操作还需对象权限：主体账户、管理员、创建者或所属团队成员可操作；未设置团队时，拥有集成中心管理权限的成员可操作，只读集成不可修改。\n- 每次调用都会记录到账户审计日志。",
           "href": "/zh/api-reference/on-call/integrations/integration-api-write-update",
           "metadata": {
             "sidebarTitle": "更新集成"
diff --git a/en/on-call/integration/instant-messaging/dingtalk.mdx b/en/on-call/integration/instant-messaging/dingtalk.mdx
index 5470efbd..c6f22aa6 100644
--- a/en/on-call/integration/instant-messaging/dingtalk.mdx
+++ b/en/on-call/integration/instant-messaging/dingtalk.mdx
@@ -42,7 +42,7 @@ After you confirm the scan, Flashduty automatically:
 - Creates the Dingtalk app, named Flashduty by default
 - Obtains the `AgentId`, `Client ID`, and `Client Secret`
 - Enables the bot and sends the creator a welcome message
-- Generates the `Encryption aes_key` and `Signature token` used for event subscription
+- Generates the `Encryption aes_key` and `Signature token` used for event subscription; they are shown only once, in the dialog that opens when creation finishes, so copy them there
 
 <Note>
 Dingtalk doesn't allow the bot avatar to be set automatically. Change it manually in [step 3](#step-bot) below.
@@ -64,7 +64,7 @@ Dingtalk doesn't allow the bot avatar to be set automatically. Change it manuall
 
 4. Return to the Flashduty Dingtalk integration page, fill in `CorpId`, `AgentId`, `Client ID`, and `Client Secret`, and click **Save**.
 
-Flashduty generates the `Encryption aes_key` and `Signature token` for event subscription. You don't need to generate them in Dingtalk.
+Flashduty generates the `Encryption aes_key` and `Signature token` for event subscription. You don't need to generate them in Dingtalk. They are shown only once, in the form before you save, so copy them before saving.
 
 After either option, follow the 6 steps in the next section, "Finish setup in Dingtalk". The step numbers on the integration detail page match that section.
 
@@ -82,7 +82,9 @@ The integration detail page shows which basic permissions are missing and links
 
 ### 2. Configure event subscription
 
-Go to Development Configuration → **Event Subscription**, set the push method to `HTTP Push`, then enter the **Request URL**, `Encryption aes_key`, and `Signature token` shown in step 2 of the integration detail page (you can reveal and copy them there at any time). Click **Save**.
+Go to Development Configuration → **Event Subscription**, set the push method to `HTTP Push`, then enter the **Request URL** shown in step 2 of the integration detail page, and the `Encryption aes_key` and `Signature token` you copied at creation. Click **Save**.
+
+For security, the `Encryption aes_key` and `Signature token` are not shown again after they are saved. If you did not keep them, click **Generate again** on the integration edit page; after you save, the old values stop working, so enter the new ones here and in the group bot **Message Callback Token**.
 
 <Note>
 Dingtalk verifies the request URL as soon as you save, so save the Dingtalk integration in Flashduty first.
@@ -186,7 +188,7 @@ Navigate to Open Capabilities → **Scene Groups** from the Dingtalk Open Platfo
    | Message Preview Image | [Flashduty official icon](https://flashduty-public.oss-cn-beijing.aliyuncs.com/icons/flashduty-20251216.png) |
    | Detailed Description | Flashduty message push bot. |
    | Message Callback URL | Use the message URL provided on the Flashduty integration configuration page, and replace `api.flashcat.cloud` with `dingtalk-message.flashcat.cloud` |
-   | Message Callback Token | Use the `Signature token` shown in step 2 of the integration detail page |
+   | Message Callback Token | The same `Signature token` you entered in DingTalk in step 2 |
    | Source Website | `https://www.flashduty.com` |
 
    After configuration, click **Create**, then click **Approve**. After "Submission successful" appears in the top right corner, Dingtalk has automatically approved the group bot.
diff --git a/en/openapi/api-catalog.mdx b/en/openapi/api-catalog.mdx
index 7a014e59..05864e6c 100644
--- a/en/openapi/api-catalog.mdx
+++ b/en/openapi/api-catalog.mdx
@@ -129,7 +129,7 @@ All endpoint URLs use `https://api.flashcat.cloud` as the base, authenticated th
 
 ### Integrations
 
-The `/integration/*` management APIs cover public (account-level) integrations, including supported IM and webhook types. Channel-owned dedicated integrations are not part of this public API surface. `/integration/list` and `/integration/info` return stored settings and decrypted integration keys without masking.
+The `/integration/*` management APIs cover public (account-level) integrations, including supported IM and webhook types. Channel-owned dedicated integrations are not part of this public API surface. `/integration/list` and `/integration/info` return stored settings with each saved secret as `******`, and the integration key as is.
 
 | Method | Endpoint | Description |
 | :--- | :--- | :--- |
diff --git a/zh/on-call/integration/instant-messaging/dingtalk.mdx b/zh/on-call/integration/instant-messaging/dingtalk.mdx
index 38bdb51b..5fd38ccf 100644
--- a/zh/on-call/integration/instant-messaging/dingtalk.mdx
+++ b/zh/on-call/integration/instant-messaging/dingtalk.mdx
@@ -43,7 +43,7 @@ keywords: ["钉钉", "即时消息", "告警通知", "IM集成", "钉钉机器
 - 创建钉钉应用，默认名称为 Flashduty
 - 获取 `AgentId`、`Client ID` 和 `Client Secret`
 - 开启机器人，并向创建者发送一条欢迎消息
-- 生成事件订阅所需的 `加密 aes_key` 和 `签名 token`
+- 生成事件订阅所需的 `加密 aes_key` 和 `签名 token`，只在创建完成的弹窗里显示一次，请先复制
 
 <Note>
 钉钉不支持自动设置机器人头像，请在下文[步骤 3](#step-bot)中手动更换。
@@ -65,7 +65,7 @@ keywords: ["钉钉", "即时消息", "告警通知", "IM集成", "钉钉机器
 
 4. 回到 Flashduty 钉钉集成配置页，在表单中填入 `CorpId`、`AgentId`、`Client ID` 和 `Client Secret`，点击 **保存**。
 
-事件订阅用的 `加密 aes_key` 和 `签名 token` 由 Flashduty 生成，无需在钉钉中生成。
+事件订阅用的 `加密 aes_key` 和 `签名 token` 由 Flashduty 生成，无需在钉钉中生成。它们只在保存前的表单里显示一次，请在保存前复制。
 
 两种方式建好后，都按下一节「在钉钉完成配置」的 6 步操作；集成详情页的步骤编号与本节一致。
 
@@ -83,7 +83,9 @@ keywords: ["钉钉", "即时消息", "告警通知", "IM集成", "钉钉机器
 
 ### 2. 配置事件订阅
 
-进入 开发配置 → **事件订阅** 页面，设置推送方式为 `HTTP推送`，然后填入集成详情页第 2 步显示的 **请求网址**、`加密 aes_key` 和 `签名 token`（可随时在详情页展开并复制），点击 **保存**。
+进入 开发配置 → **事件订阅** 页面，设置推送方式为 `HTTP推送`，然后填入集成详情页第 2 步显示的 **请求网址**，以及创建时复制的 `加密 aes_key` 和 `签名 token`，点击 **保存**。
+
+出于安全考虑，`加密 aes_key` 和 `签名 token` 保存后不再显示。没有记下的话，在集成编辑页点 **重新生成**，保存后旧值失效，要把新值填到这里和群机器人的 **消息回调 token**。
 
 <Note>
 钉钉保存时会立即校验请求网址，因此需要先在 Flashduty 保存好钉钉集成。
@@ -187,7 +189,7 @@ keywords: ["钉钉", "即时消息", "告警通知", "IM集成", "钉钉机器
    | 消息预览图     | [Flashduty 官方 icon](https://flashduty-public.oss-cn-beijing.aliyuncs.com/icons/flashduty-20251216.png) |
    | 详细描述       | Flashduty 消息推送机器人。                                                        |
    | 消息回调地址   | Flashduty 集成配置页提供的消息地址，并将域名 `api.flashcat.cloud` 替换为 `dingtalk-message.flashcat.cloud` |
-   | 消息回调 token | 集成详情页第 2 步显示的 `签名 token`                          |
+   | 消息回调 token | 与第 2 步填入钉钉的 `签名 token` 相同                          |
    | 信息来源网站   | `https://www.flashduty.com`                                                       |
 
    完成配置后，点击 **创建**，然后点击 **审批**。右上角弹出 “提交成功” 后，钉钉已自动完成群机器人的审批。
diff --git a/zh/openapi/api-catalog.mdx b/zh/openapi/api-catalog.mdx
index 9ab867e9..d1f9ea29 100644
--- a/zh/openapi/api-catalog.mdx
+++ b/zh/openapi/api-catalog.mdx
@@ -129,7 +129,7 @@ Flashduty Open API 提供 **365** 个接口，覆盖 On-call、Monitors、RUM、
 
 ### 集成中心
 
-`/integration/*` 管理接口用于公共（账户级）集成，包含支持的 IM 与 Webhook 类型，不包含协作空间专属集成。`/integration/list` 与 `/integration/info` 返回存储配置和解密后的集成 Key，不打码。
+`/integration/*` 管理接口用于公共（账户级）集成，包含支持的 IM 与 Webhook 类型，不包含协作空间专属集成。`/integration/list` 与 `/integration/info` 返回存储配置，其中已保存的密钥类值返回 `******`，集成 Key 按原值返回。
 
 | 方法 | 接口 | 描述 |
 | :--- | :--- | :--- |