Box
Let hires find and read files in Box, PDFs included, and upload, share or delete only as you allow.
Explore 6 actions and their permissionsExact inputs, sign-in scopes, access limits and approval rules.
With Box, a hire can:
- find files by the words in their name or content,
- list what's in a folder,
- read a file as text: PDFs and other documents through the text Box makes of them, Word, Excel, PowerPoint and OpenDocument files, and text files. Of large files it reads the start. Images and other files show their name, size and date only, never their content.
If you allow changes, a hire can also:
- upload text as a file. It never overwrites a file: replacing one asks a person first.
- make a shared link to a file, view only, for people in your company or for anyone, optionally ending after a number of days. This always asks a person first.
- delete a file. This always asks a person first. It goes to Box's trash.
Hires never see the sign-in. Passwords and keys written inside files are hidden from hires when they read them.
1. Make a Box app
Straight there: the Box Developer Console.
In the Box Developer Console: Create Platform App. Choose one way to sign in:
- User Authentication (OAuth 2.0): a person signs in, and hires see what that person sees.
Under Configuration, add the redirect URI Roster shows on the connection (it ends in
/api/integrations/box/oauth/callback). - Server Authentication (Client Credentials Grant): no person signs in. The app acts as your company's service account or as one user. A Box admin must authorize the app (Admin Console → Integrations → Platform Apps Manager).
Then, under Application Scopes, tick Read all files and folders stored in Box, and Write all files and folders stored in Box to allow changes. Copy the Client ID and Client Secret.
2. Connect it in Roster
- Open Integrations → Tools → Add a tool, search for Box and choose it.
- How Roster signs in: OAuth 2.0 or Client Credentials Grant, as you made the app.
- Paste the client ID and secret. For Client Credentials, choose who it acts as (the service account or one user) and give the enterprise ID (Admin Console → Account & Billing) or the user's ID.
- What hires may do: Find and read files, or also upload, share and delete.
- For OAuth, click Connect with Box and sign in.
Roster checks the key when you click Connect. Once it's accepted, the connection shows Connected as your Box enterprise (or the user) and the account Roster acts as. If it's refused, Roster says what to fix (a mistyped key, a missing permission) and saves nothing.
3. Give hires access
On the hire's Tools tab, click Give access on Box. Read only gives the reading tools; Read and write adds upload, links and delete (if the connection allows changes).
- Folders: folder IDs, the number after
/folder/in a folder's address. Files in subfolders count. Leave it empty for everything the account can see.
When it asks first
| What the hire does | Asks a person |
|---|---|
| Makes a shared link | always |
| Deletes a file | always |
| Uploads a file with a taken name | only when it asks to replace the old file |
You can change this per hire on the hire's Tools tab, under When it asks first.
If something goes wrong
- "Box is still making this file's text": Box prepares text for new files in the background. Ask again in a minute.
- Nothing is found with Client Credentials: the service account sees only what's shared with it. Share the folders with it, or act as a user instead.
- Links for anyone fail: your Box admin may allow only company links.
Tools and permissions reference
This reference is built from the same definitions Roster uses to connect Box and give hires access. It updates with each release.
Authentication and requested permissions
The account or app you connect sets the outer limit. Each hire's access can narrow it further. Connecting a tool gives it to no hire until you give access on that hire's Tools tab.
OAuth 2.0
A person signs in and approves access.
For: How Roster signs in: OAuth 2.0 (a person signs in); What hires may do: Find and read files.
Requested scopes:
root_readonly
OAuth 2.0
A person signs in and approves access.
For: How Roster signs in: OAuth 2.0 (a person signs in); What hires may do: Also upload, share (asks first) and delete (asks first).
Requested scopes:
root_readwrite
OAuth client credentials
A server app signs in with its client ID and secret.
For: How Roster signs in: Client Credentials Grant (a server app).
Connection fields
| Field | What to provide |
|---|---|
How Roster signs insignInOptional | OAuth: a person signs in and hires see what they see. Client Credentials: a server app acting as your enterprise's service account or one user, with no person signing in. Choices: OAuth 2.0 (a person signs in) (oauth); Client Credentials Grant (a server app) (ccg). Starts with: |
Client IDclientIdOptional | From the app's Configuration page in the Box Developer Console. |
Client secretclientSecretOptional · sealed secret | Use the value for your account or connection. |
Acts assubjectTypeOptional | Use the value for your account or connection. Choices: The enterprise's service account (enterprise); One user (user). Starts with: Shown when |
Enterprise or user IDsubjectIdOptional | The enterprise ID (Admin Console → Account & Billing) or the user's ID. Shown when |
What hires may doaccessOptional | Read only asks Box for less, and hires get no tool that changes anything. Changing this may mean signing in again. Choices: Find and read files (read); Also upload, share (asks first) and delete (asks first) (write). Starts with: |
Per-hire limits
Read-only hires receive only actions that read. Read-and-write access also allows actions that change things, where the connection itself permits them. An empty resource allowlist usually means everything the connected account can reach; each field below explains its meaning.
| Field | What to provide |
|---|---|
FoldersfoldersOptional | IDs of folders the hire may use: the number after /folder/ in the folder's address. Files in their subfolders count. Leave empty for everything the account can see. |
Actions
6 actions: 3 only read and 3 change something. A read action may still need approval when your workspace or hire is set to ask. A locked approval requirement always applies.
6 of 6 actions. Open an action for its arguments and full input schema.
search_filesRead only
Find files in Box by words in their name or content, optionally inside one folder.
Approval: Uses your workspace and hire approval settings.
| Argument | Type | Details |
|---|---|---|
textRequired | string | words to look for |
folderOptional | string | a folder's ID, in [brackets] in list_folder and search_files |
limitOptional | integer | See input schema below.Default: 20 |
Full input schema (JSON)
{
"$schema": "http://json-schema.org/draft-07/schema#",
"type": "object",
"properties": {
"text": {
"type": "string",
"minLength": 1,
"maxLength": 200,
"description": "words to look for"
},
"folder": {
"type": "string",
"minLength": 1,
"maxLength": 1024,
"description": "a folder's ID, in [brackets] in list_folder and search_files"
},
"limit": {
"default": 20,
"type": "integer",
"minimum": 1,
"maximum": 50
}
},
"required": [
"text"
]
}list_folderRead only
What's directly inside a Box folder: files and subfolders, newest first where Box sorts.
Approval: Uses your workspace and hire approval settings.
| Argument | Type | Details |
|---|---|---|
folderOptional | string | a folder (ID); leave out for the top |
limitOptional | integer | See input schema below.Default: 50 |
Full input schema (JSON)
{
"$schema": "http://json-schema.org/draft-07/schema#",
"type": "object",
"properties": {
"folder": {
"description": "a folder (ID); leave out for the top",
"type": "string",
"minLength": 1,
"maxLength": 1024
},
"limit": {
"default": 50,
"type": "integer",
"minimum": 1,
"maximum": 200
}
}
}read_fileRead only
Read a Box file as text: text files (the start of large ones), Word, Excel, PowerPoint and OpenDocument files, and whatever Box converts to text itself. Other files (PDFs, images) show their details only.
Approval: Uses your workspace and hire approval settings.
| Argument | Type | Details |
|---|---|---|
fileRequired | string | the file's ID, in [brackets] in list_folder and search_files |
Full input schema (JSON)
{
"$schema": "http://json-schema.org/draft-07/schema#",
"type": "object",
"properties": {
"file": {
"type": "string",
"minLength": 1,
"maxLength": 1024,
"description": "the file's ID, in [brackets] in list_folder and search_files"
}
},
"required": [
"file"
]
}upload_fileRead and write
Save text as a file in a Box folder (a note, a CSV, a Markdown report). It never overwrites: if the name is taken it says so, and replace: true replaces the file after a person approves.
Approval: when it would replace a file that's already there.
Available with: What hires may do: Also upload, share (asks first) and delete (asks first).
| Argument | Type | Details |
|---|---|---|
folderRequired | string | a folder's ID, in [brackets] in list_folder and search_files |
nameRequired | string | the file's name with its extension, like summary.md or rates.csv |
textRequired | string | the file's whole content, as text |
replaceOptional | boolean | replace a file of the same name (asks a person first)Default: false |
Full input schema (JSON)
{
"$schema": "http://json-schema.org/draft-07/schema#",
"type": "object",
"properties": {
"folder": {
"type": "string",
"minLength": 1,
"maxLength": 1024,
"description": "a folder's ID, in [brackets] in list_folder and search_files"
},
"name": {
"type": "string",
"minLength": 1,
"maxLength": 200,
"description": "the file's name with its extension, like summary.md or rates.csv"
},
"text": {
"type": "string",
"maxLength": 1000000,
"description": "the file's whole content, as text"
},
"replace": {
"default": false,
"description": "replace a file of the same name (asks a person first)",
"type": "boolean"
}
},
"required": [
"folder",
"name",
"text"
]
}share_linkRead and write
Make a link to a Box file for people in the organisation, or anyone who has it. It waits for a person's approval: Roster asks in the thread and makes the link, once, when they approve.
Approval: Always asks for approval.
Available with: What hires may do: Also upload, share (asks first) and delete (asks first).
| Argument | Type | Details |
|---|---|---|
fileRequired | string | the file's ID, in [brackets] in list_folder and search_files |
audienceOptional | "organization" | "anyone" | anyone with the link, or only people signed in to the organisationDefault: "organization" |
expires_in_daysOptional | integer | when the link stops working, if the service supports it |
Full input schema (JSON)
{
"$schema": "http://json-schema.org/draft-07/schema#",
"type": "object",
"properties": {
"file": {
"type": "string",
"minLength": 1,
"maxLength": 1024,
"description": "the file's ID, in [brackets] in list_folder and search_files"
},
"audience": {
"default": "organization",
"description": "anyone with the link, or only people signed in to the organisation",
"type": "string",
"enum": [
"organization",
"anyone"
]
},
"expires_in_days": {
"description": "when the link stops working, if the service supports it",
"type": "integer",
"minimum": 1,
"maximum": 365
}
},
"required": [
"file"
]
}delete_fileRead and write
Delete a Box file (to Box's trash). It waits for a person's approval: Roster asks in the thread and deletes it, once, when they approve. Folders aren't deleted here.
Approval: Always asks for approval.
Available with: What hires may do: Also upload, share (asks first) and delete (asks first).
| Argument | Type | Details |
|---|---|---|
fileRequired | string | the file's ID, in [brackets] in list_folder and search_files |
Full input schema (JSON)
{
"$schema": "http://json-schema.org/draft-07/schema#",
"type": "object",
"properties": {
"file": {
"type": "string",
"minLength": 1,
"maxLength": 1024,
"description": "the file's ID, in [brackets] in list_folder and search_files"
}
},
"required": [
"file"
]
}Watches and incoming events
- No built-in watch is declared. Give a hire a scheduled responsibility if it should check this service regularly.
- No incoming webhook handler is declared for this integration.
Limits and troubleshooting
- Permission errors: check both the connected account's rights and the hire's resource and read/write limits.
- Expired or revoked access: reconnect or replace the key on the connection.
- Rate limits and unavailable services can interrupt work. The hire's timecard records the outcome.
- The action schema describes accepted inputs. It does not grant additional access or bypass approvals.