Azure DevOps Webhook Setup Guide

Before enabling webhook events, confirm your connected account has the necessary permissions.

• OAuth 2.0 (Microsoft Entra ID): Ensure the vso.hooks_write scope is included in your app registration’s granted permissions.
• Personal Access Token: Generate the PAT with Service Hooks (Read & write) permission (under Organization scopes in the PAT creation dialog).

In the StackOne dashboard, open the Azure DevOps connector profile and enable the webhook events you want delivered downstream. See the Available Webhook Events section below for the full list.

Set the Project name (webhook scoping) config field to your project’s name — the {project} segment of your project URL, https://dev.azure.com/{organization}/{project} (e.g. my-project). StackOne resolves that name to the internal project ID automatically, so you never need to look up a GUID. The field is optional, but whether you must set it depends on which events you enable:

• Organization-level or project-level — work item, git, pull request, and build events. Leave Project name blank to receive them from every project in the organization, or set it to scope them to a single project.
• Project-level only (Project name required) — pipeline events (run / stage / job state changed). Azure DevOps rejects these if created at the organization level, so their subscriptions fail unless Project name is set.

When webhook events are enabled (or the event selection changes), StackOne creates the corresponding Service Hook subscriptions on your behalf. You can inspect them in Azure DevOps under Organization Settings > Service hooks (or Project Settings > Service hooks for project-scoped subscriptions).

Trigger a matching change in Azure DevOps (for example, create a work item) and confirm the event reaches your downstream consumer.

• Azure DevOps posts each event as a JSON payload; StackOne responds with 200 OK automatically.
• Delivery history and retries are visible in Azure DevOps under Service hooks > History for each subscription.

Changing your event selection creates subscriptions for newly enabled events and deletes the ones for disabled events. Disconnecting the account deletes all StackOne-managed subscriptions, stopping deliveries.

Events on work items (bugs, tasks, user stories, etc.) across all work item types.

• Work Item Created (workitem.created) — Fired when a new work item is created
• Work Item Updated (workitem.updated) — Fired when a work item’s fields are changed
• Work Item Deleted (workitem.deleted) — Fired when a work item is permanently deleted
• Work Item Restored (workitem.restored) — Fired when a deleted work item is restored
• Work Item Commented (workitem.commented) — Fired when a comment is added to a work item

Events on Git repositories, pushes, and pull requests.

• Git Push (git.push) — Fired when commits are pushed to a repository
• Pull Request Created (git.pullrequest.created) — Fired when a new pull request is opened
• Pull Request Updated (git.pullrequest.updated) — Fired when a pull request is updated
• Pull Request Merged (git.pullrequest.merged) — Fired when a pull request is completed (merged)
• Pull Request Comment (ms.vss-code.git-pullrequest-comment-event) — Fired when a comment is added to a pull request

Events on classic and YAML pipeline builds.

• Build Complete (build.complete) — Fired when a build finishes (any result: succeeded, failed, partially succeeded, canceled)

Events on Azure Pipelines runs, stages, and jobs. These events use publisher pipelines.

• Pipeline Run State Changed (ms.vss-pipelines.run-state-changed-event) — Fired when a pipeline run changes state
• Pipeline Stage State Changed (ms.vss-pipelines.stage-state-changed-event) — Fired when a stage within a run changes state
• Pipeline Job State Changed (ms.vss-pipelines.job-state-changed-event) — Fired when a job within a stage changes state

Azure DevOps delivers each event as an HTTP POST with a JSON body. The common envelope contains id (a GUID used as the event ID), eventType (e.g. workitem.created), publisherId, createdDate, and resource (the event-specific data).

Azure DevOps Service Hooks do not include HMAC signature headers. Deliveries are authenticated solely by the fact that the callback URL is known only to StackOne and Azure DevOps.