Overview

Box is an enterprise cloud content management platform with a comprehensive API for uploading, downloading, organizing, and sharing files programmatically. It supports fine-grained permission management, webhooks, metadata templates, and collaboration workflows. The API uses OAuth 2.0 and is well-suited for document management systems and enterprise workflow automation.

Beginner Tip

Start at developer.box.com to create a free app and get OAuth credentials. Use the official Box SDK for your language rather than raw HTTP — it handles token refresh and pagination automatically, saving significant boilerplate.

Available Data

Use case: Integrate file sharing and storage data into web and mobile applications
Box data via REST API

Example Response

JSON Response
{
  "file_id": "f_abc123",
  "filename": "document.pdf",
  "size_bytes": 1048576,
  "mime_type": "application/pdf",
  "download_url": "https://example.com/files/f_abc123",
  "created_at": "2025-01-15T10:00:00Z"
}

Field Reference

id Unique Box identifier for the file or folder
type Entity type: 'file', 'folder', or 'web_link'
name Display name of the file or folder as stored in Box
size File size in bytes; present only for files, not folders
modified_at ISO 8601 timestamp of the last modification to the item
owned_by User object for the owner of the item, containing id, login, and name fields

Implementation Example

Request
const url = "https://developer.box.com/";
// Replace headers or query params with the values required by this API.
const response = await fetch(url, {
  headers: {
  "Authorization": "Bearer YOUR_API_KEY"
  }
});
if (!response.ok) throw new Error(`Request failed: ${response.status}`);
const data = await response.json();
console.log(data);

What Can You Build?

Note: These code examples are AI-generated and unverified. Always refer to the official API documentation for accurate usage.

Common Errors & Troubleshooting

401 Unauthorized — access token expired Box access tokens expire after 60 minutes
Use the refresh token to get a new access token automatically, or use a server-side JWT app for non-expiring service tokens.
409 Conflict on file upload A file with the same name already exists in the target folder
Use the If-Match header for updates, or query for the existing file first and use the update endpoint instead of create.
403 Forbidden on shared content The authenticated user does not have the required collaboration role in that folder
Ensure the user has at least 'viewer' or 'editor' role on the folder via the collaborations endpoint before accessing its content.

Metadata Score Breakdown

Estimated from metadata — endpoint not independently tested

This score is estimated from observable metadata — HTTPS support, authentication model, declared CORS, and documentation reachability — because the API requires authentication or exposes no publicly testable endpoint. The five-signal breakdown is only shown for live-tested APIs.

Metadata estimate · endpoint not independently tested

Technical Specifications

Auth OAuth
HTTPS REQUIRED
CORS UNKNOWN
Difficulty Advanced
Verified: 2026-04-07

Similar APIs

View All →