Skip to content
Docs
Files & storage

Box

Let hires find and read files in Box, PDFs included, and upload, share or delete only as you allow.

Explore 6 actions and their permissionsExact inputs, sign-in scopes, access limits and approval rules.

With Box, a hire can:

  • find files by the words in their name or content,
  • list what's in a folder,
  • read a file as text: PDFs and other documents through the text Box makes of them, Word, Excel, PowerPoint and OpenDocument files, and text files. Of large files it reads the start. Images and other files show their name, size and date only, never their content.

If you allow changes, a hire can also:

  • upload text as a file. It never overwrites a file: replacing one asks a person first.
  • make a shared link to a file, view only, for people in your company or for anyone, optionally ending after a number of days. This always asks a person first.
  • delete a file. This always asks a person first. It goes to Box's trash.

Hires never see the sign-in. Passwords and keys written inside files are hidden from hires when they read them.

1. Make a Box app

Straight there: the Box Developer Console.

In the Box Developer Console: Create Platform App. Choose one way to sign in:

  • User Authentication (OAuth 2.0): a person signs in, and hires see what that person sees. Under Configuration, add the redirect URI Roster shows on the connection (it ends in /api/integrations/box/oauth/callback).
  • Server Authentication (Client Credentials Grant): no person signs in. The app acts as your company's service account or as one user. A Box admin must authorize the app (Admin Console → Integrations → Platform Apps Manager).

Then, under Application Scopes, tick Read all files and folders stored in Box, and Write all files and folders stored in Box to allow changes. Copy the Client ID and Client Secret.

2. Connect it in Roster

  1. Open Integrations → Tools → Add a tool, search for Box and choose it.
  2. How Roster signs in: OAuth 2.0 or Client Credentials Grant, as you made the app.
  3. Paste the client ID and secret. For Client Credentials, choose who it acts as (the service account or one user) and give the enterprise ID (Admin Console → Account & Billing) or the user's ID.
  4. What hires may do: Find and read files, or also upload, share and delete.
  5. For OAuth, click Connect with Box and sign in.

Roster checks the key when you click Connect. Once it's accepted, the connection shows Connected as your Box enterprise (or the user) and the account Roster acts as. If it's refused, Roster says what to fix (a mistyped key, a missing permission) and saves nothing.

3. Give hires access

On the hire's Tools tab, click Give access on Box. Read only gives the reading tools; Read and write adds upload, links and delete (if the connection allows changes).

  • Folders: folder IDs, the number after /folder/ in a folder's address. Files in subfolders count. Leave it empty for everything the account can see.

When it asks first

What the hire doesAsks a person
Makes a shared linkalways
Deletes a filealways
Uploads a file with a taken nameonly when it asks to replace the old file

You can change this per hire on the hire's Tools tab, under When it asks first.

If something goes wrong

  • "Box is still making this file's text": Box prepares text for new files in the background. Ask again in a minute.
  • Nothing is found with Client Credentials: the service account sees only what's shared with it. Share the folders with it, or act as a user instead.
  • Links for anyone fail: your Box admin may allow only company links.

Tools and permissions reference

This reference is built from the same definitions Roster uses to connect Box and give hires access. It updates with each release.

Authentication and requested permissions

The account or app you connect sets the outer limit. Each hire's access can narrow it further. Connecting a tool gives it to no hire until you give access on that hire's Tools tab.

OAuth 2.0

A person signs in and approves access.

For: How Roster signs in: OAuth 2.0 (a person signs in); What hires may do: Find and read files.

Requested scopes:

  • root_readonly

OAuth 2.0

A person signs in and approves access.

For: How Roster signs in: OAuth 2.0 (a person signs in); What hires may do: Also upload, share (asks first) and delete (asks first).

Requested scopes:

  • root_readwrite

OAuth client credentials

A server app signs in with its client ID and secret.

For: How Roster signs in: Client Credentials Grant (a server app).

Connection fields

Box connection fields
FieldWhat to provide
How Roster signs in
signIn
Optional
OAuth: a person signs in and hires see what they see. Client Credentials: a server app acting as your enterprise's service account or one user, with no person signing in.

Choices: OAuth 2.0 (a person signs in) (oauth); Client Credentials Grant (a server app) (ccg).

Starts with: oauth.

Client ID
clientId
Optional
From the app's Configuration page in the Box Developer Console.
Client secret
clientSecret
Optional · sealed secret
Use the value for your account or connection.
Acts as
subjectType
Optional
Use the value for your account or connection.

Choices: The enterprise's service account (enterprise); One user (user).

Starts with: enterprise.

Shown when signIn: ccg.

Enterprise or user ID
subjectId
Optional
The enterprise ID (Admin Console → Account & Billing) or the user's ID.

Shown when signIn: ccg.

What hires may do
access
Optional
Read only asks Box for less, and hires get no tool that changes anything. Changing this may mean signing in again.

Choices: Find and read files (read); Also upload, share (asks first) and delete (asks first) (write).

Starts with: read.

Per-hire limits

Read-only hires receive only actions that read. Read-and-write access also allows actions that change things, where the connection itself permits them. An empty resource allowlist usually means everything the connected account can reach; each field below explains its meaning.

Box per-hire limits
FieldWhat to provide
Folders
folders
Optional
IDs of folders the hire may use: the number after /folder/ in the folder's address. Files in their subfolders count. Leave empty for everything the account can see.

Actions

6 actions: 3 only read and 3 change something. A read action may still need approval when your workspace or hire is set to ask. A locked approval requirement always applies.

6 of 6 actions. Open an action for its arguments and full input schema.

search_filesRead only

Find files in Box by words in their name or content, optionally inside one folder.

Approval: Uses your workspace and hire approval settings.

Arguments for search_files
ArgumentTypeDetails
textRequiredstringwords to look for
folderOptionalstringa folder's ID, in [brackets] in list_folder and search_files
limitOptionalintegerSee input schema below.Default: 20
Full input schema (JSON)
{
  "$schema": "http://json-schema.org/draft-07/schema#",
  "type": "object",
  "properties": {
    "text": {
      "type": "string",
      "minLength": 1,
      "maxLength": 200,
      "description": "words to look for"
    },
    "folder": {
      "type": "string",
      "minLength": 1,
      "maxLength": 1024,
      "description": "a folder's ID, in [brackets] in list_folder and search_files"
    },
    "limit": {
      "default": 20,
      "type": "integer",
      "minimum": 1,
      "maximum": 50
    }
  },
  "required": [
    "text"
  ]
}
list_folderRead only

What's directly inside a Box folder: files and subfolders, newest first where Box sorts.

Approval: Uses your workspace and hire approval settings.

Arguments for list_folder
ArgumentTypeDetails
folderOptionalstringa folder (ID); leave out for the top
limitOptionalintegerSee input schema below.Default: 50
Full input schema (JSON)
{
  "$schema": "http://json-schema.org/draft-07/schema#",
  "type": "object",
  "properties": {
    "folder": {
      "description": "a folder (ID); leave out for the top",
      "type": "string",
      "minLength": 1,
      "maxLength": 1024
    },
    "limit": {
      "default": 50,
      "type": "integer",
      "minimum": 1,
      "maximum": 200
    }
  }
}
read_fileRead only

Read a Box file as text: text files (the start of large ones), Word, Excel, PowerPoint and OpenDocument files, and whatever Box converts to text itself. Other files (PDFs, images) show their details only.

Approval: Uses your workspace and hire approval settings.

Arguments for read_file
ArgumentTypeDetails
fileRequiredstringthe file's ID, in [brackets] in list_folder and search_files
Full input schema (JSON)
{
  "$schema": "http://json-schema.org/draft-07/schema#",
  "type": "object",
  "properties": {
    "file": {
      "type": "string",
      "minLength": 1,
      "maxLength": 1024,
      "description": "the file's ID, in [brackets] in list_folder and search_files"
    }
  },
  "required": [
    "file"
  ]
}
upload_fileRead and write

Save text as a file in a Box folder (a note, a CSV, a Markdown report). It never overwrites: if the name is taken it says so, and replace: true replaces the file after a person approves.

Approval: when it would replace a file that's already there.

Available with: What hires may do: Also upload, share (asks first) and delete (asks first).

Arguments for upload_file
ArgumentTypeDetails
folderRequiredstringa folder's ID, in [brackets] in list_folder and search_files
nameRequiredstringthe file's name with its extension, like summary.md or rates.csv
textRequiredstringthe file's whole content, as text
replaceOptionalbooleanreplace a file of the same name (asks a person first)Default: false
Full input schema (JSON)
{
  "$schema": "http://json-schema.org/draft-07/schema#",
  "type": "object",
  "properties": {
    "folder": {
      "type": "string",
      "minLength": 1,
      "maxLength": 1024,
      "description": "a folder's ID, in [brackets] in list_folder and search_files"
    },
    "name": {
      "type": "string",
      "minLength": 1,
      "maxLength": 200,
      "description": "the file's name with its extension, like summary.md or rates.csv"
    },
    "text": {
      "type": "string",
      "maxLength": 1000000,
      "description": "the file's whole content, as text"
    },
    "replace": {
      "default": false,
      "description": "replace a file of the same name (asks a person first)",
      "type": "boolean"
    }
  },
  "required": [
    "folder",
    "name",
    "text"
  ]
}
share_linkRead and write

Make a link to a Box file for people in the organisation, or anyone who has it. It waits for a person's approval: Roster asks in the thread and makes the link, once, when they approve.

Approval: Always asks for approval.

Available with: What hires may do: Also upload, share (asks first) and delete (asks first).

Arguments for share_link
ArgumentTypeDetails
fileRequiredstringthe file's ID, in [brackets] in list_folder and search_files
audienceOptional"organization" | "anyone"anyone with the link, or only people signed in to the organisationDefault: "organization"
expires_in_daysOptionalintegerwhen the link stops working, if the service supports it
Full input schema (JSON)
{
  "$schema": "http://json-schema.org/draft-07/schema#",
  "type": "object",
  "properties": {
    "file": {
      "type": "string",
      "minLength": 1,
      "maxLength": 1024,
      "description": "the file's ID, in [brackets] in list_folder and search_files"
    },
    "audience": {
      "default": "organization",
      "description": "anyone with the link, or only people signed in to the organisation",
      "type": "string",
      "enum": [
        "organization",
        "anyone"
      ]
    },
    "expires_in_days": {
      "description": "when the link stops working, if the service supports it",
      "type": "integer",
      "minimum": 1,
      "maximum": 365
    }
  },
  "required": [
    "file"
  ]
}
delete_fileRead and write

Delete a Box file (to Box's trash). It waits for a person's approval: Roster asks in the thread and deletes it, once, when they approve. Folders aren't deleted here.

Approval: Always asks for approval.

Available with: What hires may do: Also upload, share (asks first) and delete (asks first).

Arguments for delete_file
ArgumentTypeDetails
fileRequiredstringthe file's ID, in [brackets] in list_folder and search_files
Full input schema (JSON)
{
  "$schema": "http://json-schema.org/draft-07/schema#",
  "type": "object",
  "properties": {
    "file": {
      "type": "string",
      "minLength": 1,
      "maxLength": 1024,
      "description": "the file's ID, in [brackets] in list_folder and search_files"
    }
  },
  "required": [
    "file"
  ]
}

Watches and incoming events

  • No built-in watch is declared. Give a hire a scheduled responsibility if it should check this service regularly.
  • No incoming webhook handler is declared for this integration.

Limits and troubleshooting

  • Permission errors: check both the connected account's rights and the hire's resource and read/write limits.
  • Expired or revoked access: reconnect or replace the key on the connection.
  • Rate limits and unavailable services can interrupt work. The hire's timecard records the outcome.
  • The action schema describes accepted inputs. It does not grant additional access or bypass approvals.

Service documentation · Integration source reference

On this page