connector
Bot Framework Connector API client - how a reply actually reaches Teams.
This is the part that makes the difference between a chat API and a bot. Azure
Bot Service does NOT read replies from the body of the /messages response:
it expects 200 (an acknowledgement that the activity was accepted) and then
a separate, authenticated call back to the serviceUrl the activity arrived
with. So a turn is inherently asynchronous - acknowledge, think, then deliver.
Two calls are modelled, both POST to the conversation’s activity collection:
- sendActivity -
POST /v3/conversations/{id}/activities/{replyToId}delivers a reply threaded under the user’s message. - sendTyping - the same call with a
typingactivity, which is what puts the “…” indicator in the channel while the agent works.
serviceUrl is always supplied by the CALLER from a validated source (see
isAllowedServiceUrl), never read straight off an untrusted request body:
these calls carry the bot’s bearer token, so the destination host is a
security-relevant input.