Azure DevOps Integration

Connect Codeveira to your Azure DevOps organization — cloud or on-premises Azure DevOps Server — to automatically open a code review on every push, using a Personal Access Token (PAT) and a Service Hook web hook on the Code pushed event.

Prerequisites

An Azure DevOps organization (cloud at dev.azure.com, or on-premises Azure DevOps Server)
A Personal Access Token (PAT) with Code: Read permission
Codeveira admin access to add repositories

How Codeveira integrates with Azure DevOps

Codeveira connects to Azure DevOps through a Personal Access Token (PAT) for read-only API access and an Azure DevOps Service Hook for real-time push event delivery — triggering automatic code review creation on every commit. Both Azure DevOps Services (cloud) and Azure DevOps Server (on-premises) are supported.

Read-only API access via PAT

Codeveira authenticates using a PAT scoped to Code: Read. This is a deliberate minimum — Codeveira never writes to your repositories, creates pull requests, or modifies work items. The PAT is used to:

Fetch commit metadata: author, committer, message, parents, pushed date
Download the diff for each commit (GET /{org}/{project}/_apis/git/repositories/{repo}/diffs/commits)
List commits on a branch or in a push event
Read file content for syntax-highlighted diff display

For Azure DevOps Server (on-premises), set the Instance URL field to your server's base URL (e.g. https://ado.example.com). Codeveira constructs the API endpoints automatically from the instance URL and the organization/project/repository path.

Automatic review creation via Service Hooks

Azure DevOps delivers push events via Service Hooks (rather than the traditional "webhook" UI). A Service Hook configured on the Code pushed event sends an HTTP POST to /webhooks/azure every time a push lands in the repository. Codeveira then:

Parses the Service Hook payload to identify the new commits
Groups consecutive commits by the same author into a single code review
Fetches the full diff for each commit via the REST API
Creates the review and notifies assigned reviewers
Triggers the AI reviewer bot (if configured) to post inline comments on the diff

Azure DevOps Service Hooks do not sign payloads with an HMAC secret the way GitHub does. To protect the endpoint, keep the Codeveira webhook URL private and consider restricting inbound connections by IP (Azure DevOps publishes its IP ranges). Alternatively, use a shared secret in the Service Hook URL as a query parameter and validate it in a reverse proxy.

Create a Personal Access Token (PAT)

In Azure DevOps, click your user icon in the top-right corner
Select Personal access tokens
Click New Token
Set the Name to Codeveira
Choose your Organization and an Expiration date
Under Scopes, expand the Code section and check Code: Read
Click Create and copy the token — it is shown only once

Do not grant more than Code: Read. Codeveira only reads commits and diffs — it never writes to your repositories.

Find your path

The Azure DevOps cloud URL follows this structure:

https://dev.azure.com/{organization}/{project}/_git/{repository}

The Path field in Codeveira must be the three parts joined with slashes:

organization/project/repository
# Example:
myorg/MyProject/MyRepo

For Azure DevOps Server (on-premises), the path format is identical. Set the Instance URL field to your server's base URL (e.g. https://ado.example.com) and Codeveira will construct the correct API endpoints automatically.

Add the repository in Codeveira

Go to Repositories → New Repository
Click the Azure DevOps platform button
Fill in the fields:

Name — display name for this repository in Codeveira
Instance URL — leave blank for Azure DevOps cloud; enter your server URL for on-premises (e.g. https://ado.example.com)
Path — organization/project/repository, e.g. myorg/MyProject/MyRepo
Token — the PAT created in Step 1

For Azure DevOps cloud, leave the Instance URL blank — Codeveira defaults to https://dev.azure.com.

Configure the Service Hook webhook

Azure DevOps uses Service Hooks to send push events to external services.

In Azure DevOps, go to your Project Settings
Click Service hooks in the left sidebar
Click the + button to create a new subscription
Select Web Hooks as the service and click Next
Under Trigger on this type of event, select Code pushed
Under Filters, select your repository, then click Next
Set the URL to: https://codeveira.yourdomain.com/webhooks/azure
Leave HTTP headers and Basic authentication credentials blank
Click Finish

Azure DevOps does not support HMAC-SHA256 webhook signing for Web Hooks. Secure the endpoint with network-level controls (IP allowlist) or by placing Codeveira behind a gateway that enforces source IP filtering for Azure DevOps IP ranges.

Troubleshooting

"TF401019: repository not found"

Check that the path is exactly org/project/repo with correct casing. All three segments are case-sensitive. Copy them directly from the Azure DevOps URL bar to avoid typos.

"401 Unauthorized" when testing the connection

The PAT may have expired or have an insufficient scope. Create a new PAT with Code: Read permission and update the Token field on the repository's settings page in Codeveira.

Diffs are empty after a code review is created

Codeveira fetches blob content for each changed file via the Azure DevOps REST API. Ensure the PAT has access to the repository's file contents — the Code: Read scope covers this. If the repository is in a different organization than the PAT, create a new PAT scoped to the correct organization.

Service Hook delivering 404 or timing out

Codeveira must be publicly reachable from Azure DevOps Services. If your Codeveira instance is on an internal network, configure a reverse proxy or firewall rule that allows inbound HTTPS from Azure DevOps IP ranges. For on-premises Azure DevOps Server, both the Server and Codeveira must be on a network where they can reach each other.

Reviews created for every push regardless of branch filter

Service Hooks in Azure DevOps do not support branch filtering in their payload — they send all push events. Use the Branch filter field in Codeveira → repository settings to restrict which branches trigger reviews (e.g. main or release/*). Codeveira applies the filter after receiving the event and silently discards pushes to non-matching branches.

PAT expired — how to update without losing review history

In Codeveira, go to Repositories → [your repo] → Edit and paste the new PAT into the Token field. Click Save. Codeveira will use the new token for all future API calls. No reviews or comments are lost — the token is only used for fetching data, not storing it.

← All docs Next: Gerrit Integration →