Box Api

Box is the enterprise cloud file storage platform — strong compliance (FedRAMP, HIPAA, SOC 2) and fine-grained access controls make it the choice for regulated industries. For agents: Server Authentication (JWT) enables server-to-server access without user interaction — ideal for backend automation. Box AI provides native document Q&A (ask questions about a file without extracting text first). Metadata templates add structured data to files (useful for document classification). Webhooks push file lifecycle events (upload, edit, delete, share). Confidence is docs-derived.

REST API at api.box.com/2.0. Resources: files, folders, users, groups, metadata, webhooks. POST /files/content uploads a file (multipart: attributes JSON + file binary). GET /files/{file_id}/content downloads file. POST /folders creates a folder ({name, parent: {id: "0"}}). GET /folders/{folder_id}/items lists folder contents. POST /files/{file_id}/copy copies a file. POST /shared_links creates a shared link ({shared_link: {access: "open"|"company"|"collaborators"}}). GET /users lists enterprise users. POST /collaborations grants folder access to user/group. Box AI: POST /ai/ask asks a question about a file ({mode: "single_item_qa", prompt, items: [{id, type: "file"}]}). POST /webhooks/{id} creates a webhook for file events.

OAuth2: Server Auth (JWT) for M2M — POST /oauth2/token ({grant_type: urn:ietf:params:oauth:grant-type:jwt-bearer, assertion: {signed JWT}}). JWT signed with RSA private key from Box app configuration. App credentials from Box Developer Console → App Settings → Configuration. OAuth2 authorization code for user-interactive flows. HTTPS enforced. App users: create managed App Users for isolated automation contexts. Scopes: manage_enterprise_properties, read_all_files, write_all_files, etc. Webhooks: Box signs payloads with HMAC-SHA256 (BOX-SIGNATURE headers).

Standard HTTP status codes with JSON error bodies ({type, code, message, context_info}). 404 for missing file/folder. 409 for item name conflict in folder. File upload: two-step for large files (create upload session → upload parts → commit). Chunked upload sessions expire after 72 hours. Webhook delivery: Box retries with exponential backoff. Box AI: processes file content server-side (no local extraction needed). Box uptime at status.box.com. Rate limiting: varies by API tier — 1000 req/min for standard. Enterprise file locks: collaborators can lock files — check lock status before write operations.

developer.box.com covers REST API reference, OAuth2/JWT guide, SDK documentation, Box AI API reference, metadata templates guide, and webhook documentation. Getting started: create Box developer account (free), create Box app, configure JWT auth — first file upload in under 15 minutes. Official SDKs: boxsdk (Python), box-node-sdk, box-java-sdk, box-dotnet-sdk. Community via Box Developer Forum and GitHub. Good documentation for an enterprise platform; JWT setup is the key complexity for server-side automation.