> ## Documentation Index
> Fetch the complete documentation index at: https://docs.omni.co/llms.txt
> Use this file to discover all available pages before exploring further.

# Connect an Azure DevOps repository to Omni

> Connect an Azure DevOps repository to an Omni model

export const keyInstructions_1 = "Paste the contents of the omni_deploy_key.pub file from the previous step"

export const keyInstructions_0 = "Copy the public key from the Omni Git settings page and paste it into this field"

export const type_1 = "SSH"

export const type_0 = "SSH"

export const introCopy_1 = "configure SSH with your own private key"

export const provider_1 = "Azure DevOps"

export const permission1_1 = "Add service hooks to projects"

export const permission2_1 = "Add SSH public keys to your user profile"

export const introCopy_0 = "configure SSH with an Omni deploy key"

export const provider_0 = "Azure DevOps"

export const permission1_0 = "Add service hooks to projects"

export const permission2_0 = "Add SSH public keys to your user profile"

Omni supports SSH authentication to connect to Azure DevOps repositories. This requires configuring both a deploy key and a webhook in Azure DevOps. For the deploy key, you can either:

* Use the deploy key Omni generates by default
* Generate your own keypair and supply Omni with the private key

<View title="Select authentication method">
  ## Select an authentication method

  <Note>
    **To view instructions**, select the authentication method you want to use from the **dropdown menu** on the right side of the page, above the table of contents.

    <Frame caption="Select your authentication method from the dropdown to view setup instructions">
      <img src="https://mintcdn.com/omni-e7402367/z4NfWcJoMfO93ijI/integrations/images/git-select-auth-method.png?fit=max&auto=format&n=z4NfWcJoMfO93ijI&q=85&s=e95edc19fad7856990cb7b855fa72e2c" alt="Authentication method selection menu on right side of this page" width="278" height="170" data-path="integrations/images/git-select-auth-method.png" />
    </Frame>
  </Note>
</View>

<View title="SSH + Omni deploy key">
  ## Requirements

  To {introCopy_0}, you'll need:

  * [**Connection Admin permissions**](/administration/users/permissions) for the Omni model you want to connect to git
  * **An existing {provider_0} repository**
  * **Permissions in {provider_0} that allow you to:**
    * {permission1_0}
    * {permission2_0}

  Refer to [Azure DevOps documentation](https://learn.microsoft.com/en-us/azure/devops/organizations/security/permissions?view=azure-devops) for information about user permissions.

  ## Configure SSH authentication with an Omni deploy key

  In this guide, you'll set up SSH authentication that uses the deploy key Omni generates for you.

  <Steps titleSize="h3">
    <Step title="Retrieve the repository's SSH URL">
      1. In your browser, navigate to the Azure DevOps repository you want to connect to Omni.
      2. Click the **Clone** button near the top right corner of the page.
      3. Click the **{type_0}** option to display the repository's {type_0} URL.

      Keep this page open—you'll need it in the next step.
    </Step>

    <Step title="Connect the repository to Omni">
      1. In Omni, click **Develop** in the [sidebar](/administration/settings/sidebar).
      2. Click the model you want to connect to git.
      3. In the model IDE, click **Model > Git settings**.
      4. You'll be prompted to enter connection details for the repository:
         * **Authentication Method** - Select **SSH (Deploy Key)** from the dropdown.
         * **SSH URL** - Copy and paste the repository's SSH URL from Step 1.
         * **Base Branch** - Enter the name of the default branch for the repository. Omni will default to `main` unless a different name is specified.
         * **Git follower** - Select this option if the repository should be treated as a [follower](/integrations/git/follower-mode).
      5. Click **Configure Git**.

      The page will update to display additional git settings, including information for deploy keys and webhooks.
    </Step>

    <Step title="Add an SSH public key">
      <Note>
        If the repository is already linked to another Omni model, skip this step. Omni will use the existing deploy key.
      </Note>

      1. Browse to the Azure DevOps web portal (ex: `https://dev.azure.com/<your-org-name>/`).
      2. Click the **User settings** icon next to your avatar in the top right corner of the page.
      3. Click **SSH public keys**.
      4. On the page that displays, click **+ New Key**.
      5. In the **Add New SSH Key** panel that displays, fill in the following:
         * **Name** - Enter a descriptive name, such as *Omni Snowflake Model*
         * **Public Key Data** - {keyInstructions_0}
      6. Click **Add**.
    </Step>

    <Step title="Add repository webhooks">
      <Note>
        If the repository is already linked to another Omni model, skip this step. Omni will use the existing webhook configuration.
      </Note>

      You'll create **three** webhook subscriptions for the Azure DevOps repository:

      1. Pull request created
      2. Pull request updated with **Change** filter = **Source branch updated**
      3. Pull request updated with **Change** filter = **Status updated**

      <Steps>
        <Step title="Create the webhook subscription">
          1) Navigate to the Azure DevOps project that contains the repository you want to connect to Omni.
          2) Click **Project settings**.
          3) Click **Service hooks**, located in the **General** section of the sidebar.
          4) On the **Service Hooks** page, click the **+ icon** or **Create subscription**.
          5) On the **Service** screen, click **Web Hooks** and then **Next**.
        </Step>

        <Step title="Configure the Trigger">
          1. On the **Trigger** screen, select one of the following for the **Trigger on this type of event** field:
             1. **Pull request created**
             2. **Pull request updated** — After selecting this trigger, set the **Change** filter to **Source branch updated**
             3. **Pull request updated** — After selecting this trigger, set the **Change** filter to **Status updated**
          2. Select the **Repository** you want to connect to Omni.
          3. If the **Target branch** field displays, select the **main** branch.
          4. When finished, click **Next**.
        </Step>

        <Step title="Configure the Action">
          On the **Action** screen, fill in the fields as follows:

          * **URL** - Copy and paste the **Webhook URL** from the Omni **Git settings** page
          * **Basic auth username** - `omni`
          * **Basic auth password** - Copy and paste the **Webhook secret** from the Omni **Git settings** page
          * **HTTP headers** - The value of this field depends on the subscription you're configuring:
            1. **Pull request created** — `x-azuredevops-omni-event:created`
            2. **Pull request updated** (Change = Source branch updated) — `x-azuredevops-omni-event:update-push`
            3. **Pull request updated** (Change = Status updated) — `x-azuredevops-omni-event:update-status`

          When finished, click **Finish** to create the webhook.
        </Step>

        <Step title="Repeat steps 1-3">
          Repeat these steps for each of the three webhook subscription types.
        </Step>
      </Steps>
    </Step>

    <Step title="Test the connection">
      To verify the setup, navigate back to the **Git settings** page in Omni. Click the **Test git connection** button near the top of the page to test the connection.
    </Step>
  </Steps>
</View>

<View title="SSH + Your private key" id="ssh-your-private-key">
  ## Requirements

  To {introCopy_1}, you'll need:

  * [**Connection Admin permissions**](/administration/users/permissions) for the Omni model you want to connect to git
  * **An existing {provider_1} repository**
  * **Permissions in {provider_1} that allow you to:**
    * {permission1_1}
    * {permission2_1}

  Refer to [Azure DevOps documentation](https://learn.microsoft.com/en-us/azure/devops/organizations/security/permissions?view=azure-devops) for information about user permissions.

  To generate the keypair and supply the private key to Omni, you'll also need:

  * An [Omni API key](/api/authentication)
  * **The shared model's `modelId`,** which you can retrieve using the [List models](/api/models/list-models) endpoint
  * **`ssh-keygen` installed locally** to generate keypairs

  ## Configure SSH authentication with your private key

  In this guide, you'll set up SSH authentication that uses the private key you generate as part of a public-private keypair.

  <Steps titleSize="h3">
    <Step title="Retrieve the repository's SSH URL">
      1. In your browser, navigate to the Azure DevOps repository you want to connect to Omni.
      2. Click the **Clone** button near the top right corner of the page.
      3. Click the **{type_1}** option to display the repository's {type_1} URL.

      Keep this page open—you'll need it in the next step.
    </Step>

    <Step title="Connect the repository to Omni">
      1. In Omni, click **Develop** in the [sidebar](/administration/settings/sidebar).
      2. Click the model you want to connect to git.
      3. In the model IDE, click **Model > Git settings**.
      4. You'll be prompted to enter connection details for the repository:
         * **Authentication Method** - Select **SSH (Deploy Key)** from the dropdown.
         * **SSH URL** - Copy and paste the repository's SSH URL from Step 1.
         * **Base Branch** - Enter the name of the default branch for the repository. Omni will default to `main` unless a different name is specified.
         * **Git follower** - Select this option if the repository should be treated as a [follower](/integrations/git/follower-mode).
      5. Click **Configure Git**.

      The page will update to display additional git settings, including information for deploy keys and webhooks.
    </Step>

    <Step title="Generate a new keypair">
      Use `ssh-keygen` to generate a new RSA or ED25519 keypair.

      <Tabs>
        <Tab title="ED25519">
          ```bash wrap theme={null}
          ssh-keygen -t ed25519 -C "omni-deploy-key-rotation-$(date +%Y%m%d)" -f omni_deploy_key
          ```
        </Tab>

        <Tab title="RSA">
          ```bash wrap theme={null}
          ssh-keygen -t rsa -b 4096 -C "omni-deploy-key-rotation-$(date +%Y%m%d)" -f omni_deploy_key
          ```
        </Tab>
      </Tabs>

      When prompted for a passphrase:

      * **To leave the key unencrypted**, press `Enter`.
      * **To encrypt the key**, provide a passphrase. This is more secure at rest, but you'll need to supply it to Omni.

      This generates two files:

      * `omni_deploy_key` — The private key, which you'll supply to Omni
      * `omni_deploy_key.pub` — The public key, which you'll authorize with your Git provider
    </Step>

    <Step title="Add a repository deploy key">
      <Note>
        If the repository is already linked to another Omni model, skip this step. Omni will use the existing deploy key.
      </Note>

      Add the public key (`omni_deploy_key.pub`) to your Git repository as a deploy key with **write access**. This step ensures the new key is authorized before you supply the private key to Omni.

      1. Browse to the Azure DevOps web portal (ex: `https://dev.azure.com/<your-org-name>/`).
      2. Click the **User settings** icon next to your avatar in the top right corner of the page.
      3. Click **SSH public keys**.
      4. On the page that displays, click **+ New Key**.
      5. In the **Add New SSH Key** panel that displays, fill in the following:
         * **Name** - Enter a descriptive name, such as *Omni Snowflake Model*
         * **Public Key Data** - {keyInstructions_1}
      6. Click **Add**.
    </Step>

    <Step title="Add repository webhooks">
      <Note>
        If the repository is already linked to another Omni model, skip this step. Omni will use the existing deploy key.
      </Note>

      You'll create **three** webhook subscriptions for the Azure DevOps repository:

      1. Pull request created
      2. Pull request updated with **Change** filter = **Source branch updated**
      3. Pull request updated with **Change** filter = **Status updated**

      <Steps>
        <Step title="Create the webhook subscription">
          1) Navigate to the Azure DevOps project that contains the repository you want to connect to Omni.
          2) Click **Project settings**.
          3) Click **Service hooks**, located in the **General** section of the sidebar.
          4) On the **Service Hooks** page, click the **+ icon** or **Create subscription**.
          5) On the **Service** screen, click **Web Hooks** and then **Next**.
        </Step>

        <Step title="Configure the Trigger">
          1. On the **Trigger** screen, select one of the following for the **Trigger on this type of event** field:
             1. **Pull request created**
             2. **Pull request updated** — After selecting this trigger, set the **Change** filter to **Source branch updated**
             3. **Pull request updated** — After selecting this trigger, set the **Change** filter to **Status updated**
          2. Select the **Repository** you want to connect to Omni.
          3. If the **Target branch** field displays, select the **main** branch.
          4. When finished, click **Next**.
        </Step>

        <Step title="Configure the Action">
          On the **Action** screen, fill in the fields as follows:

          * **URL** - Copy and paste the **Webhook URL** from the Omni **Git settings** page
          * **Basic auth username** - `omni`
          * **Basic auth password** - Copy and paste the **Webhook secret** from the Omni **Git settings** page
          * **HTTP headers** - The value of this field depends on the subscription you're configuring:
            1. **Pull request created** — `x-azuredevops-omni-event:created`
            2. **Pull request updated** (Change = Source branch updated) — `x-azuredevops-omni-event:update-push`
            3. **Pull request updated** (Change = Status updated) — `x-azuredevops-omni-event:update-status`

          When finished, click **Finish** to create the webhook.
        </Step>

        <Step title="Repeat steps 1-3">
          Repeat these steps for each of the three webhook subscription types.
        </Step>
      </Steps>
    </Step>

    <Step title="Supply the private key to Omni with the API">
      <Note>
        If the repository is already linked to another Omni model, skip this step. Omni will use the existing deploy key.
      </Note>

      Next, call the [Update Git configuration](/api/model-git-configuration/update-git-configuration) API and provide the private key.

      <Tabs>
        <Tab title="Unencrypted keys">
          In the terminal, navigate to the same location where the `omni_deploy_key` file was saved. Then, run the following:

          ```bash wrap theme={null}
          curl -X PATCH https://<your-subdomain>.omniapp.co/api/v1/models/<MODEL_ID>/git \
            -H "Authorization: Bearer <YOUR_API_TOKEN>" \
            -H "Content-Type: application/json" \
            -d "$(jq -n --arg key "$(cat omni_deploy_key)" '{deployPrivateKey: $key}')"
          ```

          Replace the following variables:

          * `<your-subdomain>` - Your Omni subdomain
          * `<MODEL_ID>` - The shared model's UUID
          * `<YOUR_API_TOKEN>` - Your Omni API key

          A successful response will include the derived public key in the `publicKey` field.
        </Tab>

        <Tab title="Passphrase-protected keys">
          1. In the terminal, navigate to the same location where the `omni_deploy_key` file was saved.
          2. Run the following to create a plain shell variable for the passphrase:

             ```bash wrap theme={null}
             printf "Passphrase: " && read -rs DEPLOY_KEY_PASSPHRASE && echo
             ```
          3. When prompted, enter the passphrase.
          4. Then, run the following to supply Omni with the private key and passphrase:

             ```bash wrap theme={null}
             curl -X PATCH https://<your-subdomain>.omniapp.co/api/v1/models/<MODEL_ID>/git \
               -H "Authorization: Bearer <YOUR_API_TOKEN>" \
               -H "Content-Type: application/json" \
               -d "$(jq -n \
                     --arg key "$(cat omni_deploy_key)" \
                     --arg passphrase "$DEPLOY_KEY_PASSPHRASE" \
                     '{deployPrivateKey: $key, deployKeyPassphrase: $passphrase}')"
             ```

             Replace the following:

             * `<your-subdomain>` - Your Omni subdomain
             * `<MODEL_ID>` - The shared model's UUID
             * `<YOUR_API_TOKEN>` - Your Omni API key

             A successful response will include the derived public key in the `publicKey` field.
          5. After you receive a successful response, run the following to unset the passphrase variable:

             ```bash theme={null}
             unset DEPLOY_KEY_PASSPHRASE
             ```
        </Tab>
      </Tabs>

      <Note>
        If you run into issues, see the [Troubleshooting section in the Rotate Git SSH keys guide](/guides/api/rotate-ssh-deploy-keys#troubleshooting).
      </Note>
    </Step>

    <Step title="Test the connection">
      To verify the setup, navigate back to the **Git settings** page in Omni. Click the **Test git connection** button near the top of the page to test the connection.

      <Tip>
        **Need to rotate keys?** See [Rotate Git SSH deploy keys](/guides/api/rotate-ssh-deploy-keys) for step-by-step instructions.
      </Tip>
    </Step>
  </Steps>
</View>

## What's next?

After the setup is complete, you can configure the integration's behavior by changing its settings. Refer to the [git integration settings reference](/integrations/git/settings) for more information.