Microsoft Teams integration

The Teams integration has two halves: announcements into a channel via an incoming webhook, and an action endpoint your automation (an outgoing webhook or a Power Automate flow) can call to approve or reject.

Announcements

1. Add an Incoming Webhook to your Teams channel and copy its URL.
2. In QueryProxy, open ChatOps (as DBA), paste the webhook URL and set an HMAC secret (any strong random string — you’ll use the same secret for the action endpoint below). Both are stored encrypted.

New requests are posted as a card with the requester, connection, statement count, a SQL preview and a Review in QueryProxy link. Decisions are announced back to the channel as they happen.

The action endpoint

To approve or reject from Teams-side automation, call:

POST https://your-queryproxy-host/webhooks/teams/actions
Authorization: HMAC <base64(HMAC_SHA256(raw_body, secret))>
Content-Type: application/json

{
  "action": "approve",
  "request_id": 123,
  "actor_email": "[email protected]",
  "reason": "optional — used for reject"
}

• action — approve or reject.
• request_id — the request number from the announcement card.
• actor_email — the QueryProxy account making the decision. The same rules apply as on the web: the user needs the DBA role in the request’s team, and cannot decide on their own request.
• reason — optional for reject; defaults to “Rejected via Teams by <name>”.

The signature scheme matches Microsoft Teams outgoing webhooks — HMAC-SHA256 of the raw request body, base64-encoded, in the Authorization: HMAC … header — so a Teams outgoing webhook can call the endpoint directly, and a Power Automate flow can compute the same header.

Security

• An invalid or missing HMAC returns 401 and changes nothing.
• Responses are JSON ({"ok": true|false, "message": "…"}); authorization failures return 403 with the reason.
• The endpoint is rate-limited like every webhook in QueryProxy.

Full interactive Adaptive Card buttons (as with Slack) require a Teams bot registration and are on the roadmap; the action endpoint covers approvals-from-Teams today.