Azure DevOps Repos
Shared Workflow Routing
- Use the shared workflow spec for deterministic multi-plugin routing:
workflows/multi-plugin-workflows.md.
- Apply the trigger phrases, handoff contracts, auth prerequisites, validation checkpoints, and stop conditions before escalating to the next plugin.
Overview
Azure Repos provides unlimited free private Git repositories with enterprise-grade pull request workflows, branch policies, and code search. Every repository supports branch policies that enforce code quality gates — minimum reviewers, build validation, comment resolution, work item linking, and merge strategy control.
Git authentication supports multiple passwordless options: Git Credential Manager (GCM) with Entra OAuth broker, SSH keys, Workload Identity Federation (WIF) for CI/CD, and managed identity for Azure-hosted compute. PATs remain supported but are discouraged for interactive use.
REST API — Repositories
| Method |
Endpoint |
Required Permissions |
Key Parameters |
| GET |
/_apis/git/repositories?api-version=7.1 |
Code (Read) |
$top, continuationToken |
| GET |
/_apis/git/repositories/{repoId}?api-version=7.1 |
Code (Read) |
repoId (GUID or name) |
| POST |
/_apis/git/repositories?api-version=7.1 |
Code (Read & Write) |
Body: name, project |
| PATCH |
/_apis/git/repositories/{repoId}?api-version=7.1 |
Code (Read & Write) |
Body: name, defaultBranch |
| DELETE |
/_apis/git/repositories/{repoId}?api-version=7.1 |
Project Admin |
— |
| GET |
/_apis/git/repositories/{repoId}/refs?api-version=7.1 |
Code (Read) |
filter=heads/ |
| POST |
/_apis/git/repositories/{repoId}/refs?api-version=7.1 |
Code (Read & Write) |
Body: [{ name, oldObjectId, newObjectId }] |
| GET |
/_apis/git/repositories/{repoId}/commits?api-version=7.1 |
Code (Read) |
searchCriteria.*, $top |
| GET |
/_apis/git/repositories/{repoId}/items?api-version=7.1 |
Code (Read) |
path, includeContent |
| POST |
/_apis/git/repositories/{repoId}/pushes?api-version=7.1 |
Code (Read & Write) |
Body: refUpdates, commits |
| POST |
/_apis/search/codesearchresults?api-version=7.1-preview |
Code (Read) |
Body: searchText, filters |
REST API — Pull Requests
| Method |
Endpoint |
Key Parameters |
| GET |
/_apis/git/repositories/{repoId}/pullrequests?api-version=7.1 |
searchCriteria.status, $top |
| POST |
/_apis/git/repositories/{repoId}/pullrequests?api-version=7.1 |
Body: sourceRefName, targetRefName, title, reviewers |
| GET |
/_apis/git/repositories/{repoId}/pullrequests/{prId}?api-version=7.1 |
— |
| PATCH |
/_apis/git/repositories/{repoId}/pullrequests/{prId}?api-version=7.1 |
Body: status, autoCompleteSetBy, completionOptions |
| GET |
/_apis/git/repositories/{repoId}/pullrequests/{prId}/threads?api-version=7.1 |
$top |
| POST |
/_apis/git/repositories/{repoId}/pullrequests/{prId}/threads?api-version=7.1 |
Body: comments, status |
Create PR Body
{
"sourceRefName": "refs/heads/feature/auth",
"targetRefName": "refs/heads/main",
"title": "Add OAuth 2.0 PKCE authentication",
"description": "Implements the PKCE flow for SPA clients.\n\nCloses #1234",
"reviewers": [{ "id": "<reviewer-user-id>" }],
"isDraft": false,
"completionOptions": {
"mergeStrategy": "squash",
"deleteSourceBranch": true,
"transitionWorkItems": true
}
}
REST API — Branch Policies
| Method |
Endpoint |
Key Parameters |
| GET |
/_apis/policy/configurations?api-version=7.1 |
scope.repositoryId, scope.refName |
| POST |
/_apis/policy/configurations?api-version=7.1 |
Body: isEnabled, isBlocking, type, settings |
| PUT |
/_apis/policy/configurations/{configId}?api-version=7.1 |
Full replacement body |
| DELETE |
/_apis/policy/configurations/{configId}?api-version=7.1 |
— |
Policy Type GUIDs
| Policy |
GUID |
| Minimum reviewers |
fa4e907d-c16b-4a4c-9dfa-4916e5d171ab |
| Build validation |
0609b952-1397-4640-95ec-e00a01b2c241 |
| Comment resolution |
c6a1889d-b943-4856-b76f-9e46bb6b0df2 |
| Work item linking |
40e92b44-2fe1-4dd6-b3d8-74a9c21d0c6e |
| Merge strategy |
fa4e907d-c16b-4a4c-9dfa-4906e5d171cb |
| Required reviewers |
fd2167ab-b0be-447a-8ec8-39368250530e |
| Status check |
cbdc66da-9728-4af8-aada-9a5a32e4a226 |
Git Authentication — Quick Reference
| Method |
Best For |
Setup |
| GCM + Entra OAuth |
Developer workstations |
Install GCM, set credential.azreposCredentialType=oauth |
| SSH keys |
Linux/macOS developers |
Generate ed25519 key, add to Azure DevOps SSH keys |
| Workload Identity Federation |
CI/CD pipelines |
Configure federated credential, use az login --federated-token |
| Managed Identity |
Azure-hosted compute |
Assign identity to VM/container, az account get-access-token |
| PAT |
Legacy/service accounts |
Generate PAT with Code scope, use as password |
Best Practices
- Use GCM with Entra OAuth for interactive Git access — eliminates PAT management overhead.
- Configure branch policies on
main and release/*: minimum 2 reviewers, build validation, comment resolution.
- Use
refs/heads/ prefix consistently in API calls (not bare branch names).
- Enable auto-complete on PRs to merge immediately when all checks pass.
- Use squash merge for feature branches, merge commit for release branches.
- Link work items to PRs via
#1234 syntax in PR description for traceability.
- Use code search API for cross-repo dependency discovery.
- Rotate PATs on a 90-day schedule; prefer WIF for automation.
Progressive Disclosure — Reference Files
1---2name: azure-devops-repos3description: Deep expertise in Azure Repos — Git repository management, pull request workflows, branch policies, code search, and passwordless Git authentication via GCM, SSH, Entra OAuth, and Workload Identity Federation.4---56# Azure DevOps Repos78## Shared Workflow Routing9- Use the shared workflow spec for deterministic multi-plugin routing: [`workflows/multi-plugin-workflows.md`](../../../workflows/multi-plugin-workflows.md#incident-triage-azure-monitor--azure-functions--azure-devops).10- Apply the trigger phrases, handoff contracts, auth prerequisites, validation checkpoints, and stop conditions before escalating to the next plugin.1112## Overview1314Azure Repos provides unlimited free private Git repositories with enterprise-grade pull request workflows, branch policies, and code search. Every repository supports branch policies that enforce code quality gates — minimum reviewers, build validation, comment resolution, work item linking, and merge strategy control.1516Git authentication supports multiple passwordless options: Git Credential Manager (GCM) with Entra OAuth broker, SSH keys, Workload Identity Federation (WIF) for CI/CD, and managed identity for Azure-hosted compute. PATs remain supported but are discouraged for interactive use.1718## REST API — Repositories1920| Method | Endpoint | Required Permissions | Key Parameters |21|--------|----------|---------------------|----------------|22| GET | `/_apis/git/repositories?api-version=7.1` | Code (Read) | `$top`, `continuationToken` |23| GET | `/_apis/git/repositories/{repoId}?api-version=7.1` | Code (Read) | `repoId` (GUID or name) |24| POST | `/_apis/git/repositories?api-version=7.1` | Code (Read & Write) | Body: `name`, `project` |25| PATCH | `/_apis/git/repositories/{repoId}?api-version=7.1` | Code (Read & Write) | Body: `name`, `defaultBranch` |26| DELETE | `/_apis/git/repositories/{repoId}?api-version=7.1` | Project Admin | — |27| GET | `/_apis/git/repositories/{repoId}/refs?api-version=7.1` | Code (Read) | `filter=heads/` |28| POST | `/_apis/git/repositories/{repoId}/refs?api-version=7.1` | Code (Read & Write) | Body: `[{ name, oldObjectId, newObjectId }]` |29| GET | `/_apis/git/repositories/{repoId}/commits?api-version=7.1` | Code (Read) | `searchCriteria.*`, `$top` |30| GET | `/_apis/git/repositories/{repoId}/items?api-version=7.1` | Code (Read) | `path`, `includeContent` |31| POST | `/_apis/git/repositories/{repoId}/pushes?api-version=7.1` | Code (Read & Write) | Body: `refUpdates`, `commits` |32| POST | `/_apis/search/codesearchresults?api-version=7.1-preview` | Code (Read) | Body: `searchText`, `filters` |3334## REST API — Pull Requests3536| Method | Endpoint | Key Parameters |37|--------|----------|----------------|38| GET | `/_apis/git/repositories/{repoId}/pullrequests?api-version=7.1` | `searchCriteria.status`, `$top` |39| POST | `/_apis/git/repositories/{repoId}/pullrequests?api-version=7.1` | Body: `sourceRefName`, `targetRefName`, `title`, `reviewers` |40| GET | `/_apis/git/repositories/{repoId}/pullrequests/{prId}?api-version=7.1` | — |41| PATCH | `/_apis/git/repositories/{repoId}/pullrequests/{prId}?api-version=7.1` | Body: `status`, `autoCompleteSetBy`, `completionOptions` |42| GET | `/_apis/git/repositories/{repoId}/pullrequests/{prId}/threads?api-version=7.1` | `$top` |43| POST | `/_apis/git/repositories/{repoId}/pullrequests/{prId}/threads?api-version=7.1` | Body: `comments`, `status` |4445### Create PR Body46```json47{48 "sourceRefName": "refs/heads/feature/auth",49 "targetRefName": "refs/heads/main",50 "title": "Add OAuth 2.0 PKCE authentication",51 "description": "Implements the PKCE flow for SPA clients.\n\nCloses #1234",52 "reviewers": [{ "id": "<reviewer-user-id>" }],53 "isDraft": false,54 "completionOptions": {55 "mergeStrategy": "squash",56 "deleteSourceBranch": true,57 "transitionWorkItems": true58 }59}60```6162## REST API — Branch Policies6364| Method | Endpoint | Key Parameters |65|--------|----------|----------------|66| GET | `/_apis/policy/configurations?api-version=7.1` | `scope.repositoryId`, `scope.refName` |67| POST | `/_apis/policy/configurations?api-version=7.1` | Body: `isEnabled`, `isBlocking`, `type`, `settings` |68| PUT | `/_apis/policy/configurations/{configId}?api-version=7.1` | Full replacement body |69| DELETE | `/_apis/policy/configurations/{configId}?api-version=7.1` | — |7071### Policy Type GUIDs7273| Policy | GUID |74|--------|------|75| Minimum reviewers | `fa4e907d-c16b-4a4c-9dfa-4916e5d171ab` |76| Build validation | `0609b952-1397-4640-95ec-e00a01b2c241` |77| Comment resolution | `c6a1889d-b943-4856-b76f-9e46bb6b0df2` |78| Work item linking | `40e92b44-2fe1-4dd6-b3d8-74a9c21d0c6e` |79| Merge strategy | `fa4e907d-c16b-4a4c-9dfa-4906e5d171cb` |80| Required reviewers | `fd2167ab-b0be-447a-8ec8-39368250530e` |81| Status check | `cbdc66da-9728-4af8-aada-9a5a32e4a226` |8283## Git Authentication — Quick Reference8485| Method | Best For | Setup |86|--------|----------|-------|87| **GCM + Entra OAuth** | Developer workstations | Install GCM, set `credential.azreposCredentialType=oauth` |88| **SSH keys** | Linux/macOS developers | Generate ed25519 key, add to Azure DevOps SSH keys |89| **Workload Identity Federation** | CI/CD pipelines | Configure federated credential, use `az login --federated-token` |90| **Managed Identity** | Azure-hosted compute | Assign identity to VM/container, `az account get-access-token` |91| **PAT** | Legacy/service accounts | Generate PAT with Code scope, use as password |9293## Best Practices9495- Use GCM with Entra OAuth for interactive Git access — eliminates PAT management overhead.96- Configure branch policies on `main` and `release/*`: minimum 2 reviewers, build validation, comment resolution.97- Use `refs/heads/` prefix consistently in API calls (not bare branch names).98- Enable auto-complete on PRs to merge immediately when all checks pass.99- Use squash merge for feature branches, merge commit for release branches.100- Link work items to PRs via `#1234` syntax in PR description for traceability.101- Use code search API for cross-repo dependency discovery.102- Rotate PATs on a 90-day schedule; prefer WIF for automation.103104## Progressive Disclosure — Reference Files105106| Topic | File |107|---|---|108| Git repositories, pull requests, cherry-pick, code search | [`references/repos-prs.md`](./references/repos-prs.md) |109| Git authentication — GCM, SSH, WIF, managed identity, PAT rotation | [`references/git-authentication.md`](./references/git-authentication.md) |110| Branch policies — all types, scopes, configuration patterns | [`references/branch-policies.md`](./references/branch-policies.md) |