Skip to main content
The integration of Azure DevOps with Corgea empowers users to seamlessly scan projects and initiate pull requests for code fixes directly from the Corgea platform.
1

Generate an Azure DevOps Personal Access Token

Access your Azure DevOps account and generate a personal access token (PAT) with both read and write permissions.
Create Personal Access Token
Token Permissions
2

Integrate the Token with Corgea

Proceed to the Integrations page on Corgea. Click the ”+” button within the Azure DevOps section and ensure the token is securely saved.
Add Token to Corgea
3

Identify Azure DevOps Projects in Corgea

After configuration, navigate to the Projects page. Your Azure DevOps project will be displayed with a Windows icon. Click the ”+” in the action column to initiate the first scan, or select the project name and click “New Scan” to commence a new scan.
Search Projects
4

Submit a Pull Request to Azure DevOps

From any issue page associated with Azure DevOps projects in Corgea, you can submit a pull request to address an issue.
Issue Pull Request

​
Optional: Webhook Configuration

To enable scans when pull requests are created or updated, configure two webhooks (one for each event). Ensure you possess the requisite permissions to set up webhooks for your project.
1
Select “Project settings” located at the bottom left of the Azure DevOps interface.
Project Settings
2
Click on “Service Hooks”. Multiple clicks may be necessary if it does not load immediately.
Service Hooks
3
Click the ”+” button and choose “Web Hooks”.
Web Hooks
4
Select “Pull request created” as the trigger event, configure any optional settings, and click “Next”.
Trigger Event
5
In the Settings section, input the URL as https://www.corgea.app/azure_webhook/ or https://your_instance.corgea.app/azure_webhook/ for private deployments.
Webhook URL
6
Open a new browser tab, navigate to the Corgea integrations page, and locate your Azure integration. Copy the X-CORGEA-UUID value.
X-CORGEA-UUID
7
Return to the Azure DevOps Webhook configuration page and populate the headers section with:
  • X-CORGEA-UUID: (UUID value you copied)
  • X-WEB-TOKEN: (legacy/optional; include only if your external infrastructure requires it)
Headers Configuration
8
Click “Finish” to save the configuration. Disregard the “Test” button as it may attempt to trigger scans for files you do not have access to.
9
Repeat the same steps to add a second webhook with “Pull request updated” as the trigger event. Use the same URL and headers as the first webhook.
Pull request updated trigger event
10
Validate the setup by creating or updating a pull request. A successful configuration will display a successful event in the webhook history and trigger a new scan on the Corgea Scans page at https://www.corgea.app/scans/.
Webhook History
Corgea Scans

​
Enable Azure DevOps pull request comment responses

Corgea can receive and respond to comments on Azure DevOps pull requests.

​
Prerequisites

  • Corgea Agent is enabled for your organization.
  • Azure DevOps is connected to Corgea.
  • The integration PAT has Code: Read & write permission.
  • You can create service hook subscriptions in the Azure DevOps project.

​
Configure the service hook

  1. In Azure DevOps, open your project.
  2. Go to Project settings -> Service hooks.
  3. Select Create subscription or +.
  4. Choose Web Hooks, then select Next.
  5. Select Pull request commented on as the trigger.
  6. Optionally restrict the hook to a repository or target branch.
  7. Enter the webhook URL:
    • Corgea Cloud: https://www.corgea.app/azure_webhook/
    • Private deployment: https://<your-corgea-domain>/azure_webhook/
  8. Add this HTTP header: X-CORGEA-UUID: <your Azure DevOps integration UUID> The UUID is available on Corgea’s Integrations page.
  9. Set Resource details to send to All.
  10. Test the subscription, then select Finish.
Service hooks are project-specific. Repeat these steps for every Azure DevOps project that should support comment responses.

​
Verify the integration

  1. Open a pull request containing a Corgea finding.
  2. Reply directly to a Corgea comment, or address Corgea in the comment.
  3. Confirm that:
    • The delivery succeeds under Project settings -> Service hooks.
    • Corgea posts its response in the same comment thread.

​
Troubleshooting

  • Confirm the service hook is enabled and uses Pull request commented on.
  • Confirm X-CORGEA-UUID matches the correct Corgea integration.
  • Ensure Resource details to send is set to All.
  • Verify that the Azure DevOps PAT has not expired and has Code: Read & write access.
  • Confirm Corgea Agent is enabled for the organization.
X-WEB-TOKEN is not consumed by the Corgea application for this flow. Only keep that header if your external infrastructure requires it.