Reference · built on requestConnectorFiles, documents & spreadsheets

Box

Files, folders, metadata, collaborations, and event webhooks in Box through the Box Platform API.

Request accessPricing ↗

About

Box is a content platform for enterprises. Its API at api.box.com/2.0 exposes files and folders, file versions, collaborations that grant a user or group a role on an item, shared links, comments and tasks, metadata templates with instances on files, retention policies, legal holds, and an events stream. Webhooks post to your endpoint when a file or folder event fires.

Through Fibric, an operator listens for those events, reads the metadata on the file, and proposes a collaboration, a metadata value, or an upload into the right folder. You approve it in Box's terms. The receipt names the item, the change, the reason, and the way back.

This is a reference listing. It documents what Fibric would read from Box and what it could propose, based on the vendor's published interfaces. Fibric builds it under a managed deployment when you request it; selecting it here installs nothing.

Inputs

  • Folder contents through GET /folders/{folder_id}/items, up to 1000 items a page, with the root folder as ID 0
  • Files, file versions, comments, and tasks on an item
  • Collaborations on a file or folder, with roles from viewer to co-owner and an optional expires_at
  • Metadata templates from GET /metadata_templates/enterprise, and the instance values attached to a file
  • Webhook events such as FILE.UPLOADED, FILE.MOVED, FOLDER.CREATED, COLLABORATION.CREATED, and SHARED_LINK.CREATED
  • The events stream at GET /events: user events, or enterprise events through admin_logs for up to one year

Proposed actions

  • Target capability: propose an upload through POST https://upload.box.com/api/2.0/files/content, with the parent folder named
  • Target capability: propose a collaboration through POST /collaborations, with the role and expiry shown first
  • Target capability: propose a metadata instance on a file from an enterprise template
  • Target capability: propose a webhook on a folder through POST /webhooks, for the triggers you choose

Proposed actions are target capabilities. Every action runs propose-first and needs a validated deployment and the appropriate permissions.

What you can build

  • Prove a control with the file that evidences it

    The operator watches FILE.UPLOADED on the evidence folder, reads the metadata template values, and proposes the file as evidence against the control it matches.

    With Compliance Evidence, Audit Trail

  • Review who still has access

    The operator lists collaborations across the folders you name, flags roles that outlive their expires_at or a departed user, and proposes removals for your approval.

    With Access Review, Offboarding Sweep

  • Chase a contract before it lapses

    The operator reads the expiry field in a metadata instance on each contract file and proposes a reminder and a task before the date passes.

    With Contract Lapse, Renewal Reminder

Requirements

  • A Box enterprise and an application created in the Box Developer Console
  • For server authentication, admin authorization of the app; Box then creates a Service Account that acts only through the API
  • An HTTPS address for webhooks, answering with a 2xx status within 30 seconds
  • For enterprise events, a user with the admin permission to run and access reports
Authentication
OAuth 2.0 for a user app, or Client Credentials Grant or JWT for a server app acting as a Service Account, after an admin authorizes the app in the Admin Console.

Limits

  • 1000 API requests and 240 uploads per minute per user; 6 searches per second per user and 12 per second per enterprise
  • Files over 50MB should use the chunked upload APIs rather than a single POST
  • Webhook deliveries are retried up to 5 times over 1 hour; a delivery fails if no 2xx arrives within 30 seconds
  • admin_logs_streaming holds only two weeks of events, and the enterprise stream does not support long polling

Access and pricing

Reference listing. Fibric builds the connector under a managed deployment when you request it. Your quote covers the build, capabilities, usage, and support.

Request Box ↗

Questions and answers

What events can a Box webhook send?
Triggers on a file or folder, including FILE.UPLOADED, FILE.PREVIEWED, FILE.DOWNLOADED, FILE.TRASHED, FILE.DELETED, FILE.MOVED, FILE.RENAMED, FOLDER.CREATED, COMMENT.CREATED, COLLABORATION.CREATED, SHARED_LINK.CREATED, METADATA_INSTANCE.UPDATED, and SIGN_REQUEST.COMPLETED. Each delivery is signed with BOX-SIGNATURE-PRIMARY and BOX-SIGNATURE-SECONDARY headers.
Which authentication should a server integration use?
Client Credentials Grant or JWT. Both need an admin to authorize the app, after which Box creates a Service Account with no login that acts through the API. OAuth 2.0 is for apps acting as a user. A Developer Token lasts 60 minutes and is for development only.
How does Box rate-limit an app?
1000 API requests per minute per user, 240 uploads per minute per user, and 6 searches per second per user. Over the limit, Box returns 429 Too Many Requests with rate_limit_exceeded and a retry-after header in seconds.
Ask about Box

Ask about the capabilities and requirements in this listing.

For project-specific requirements, contact Fibric.

This connector listing is developed, published, and supported by Fibric. It describes integration with Box through published interfaces. Third-party names and logos identify the systems an integration connects to; they are the property of their respective owners, who are not affiliated with Fibric and do not sponsor or endorse this listing. Trademark policy