Skip to content
Scalekit Docs
Talk to an Engineer Dashboard

Box

OAuth 2.0 productivitystorage

Connect this agent connector to let your agent:

  • List webhooks, users, user memberships — Retrieves all webhooks for the application
  • Update webhook, web link, user — Updates a webhook’s address or triggers
  • Get webhook, web link, user me — Retrieves a webhook’s details
  • Delete webhook, web link, user — Removes a webhook
  • Create webhook, web link, user — Creates a webhook to receive event notifications
  • Restore trash folder, trash file — Restores a folder from the trash

This connector uses OAuth 2.0. Scalekit acts as the OAuth client: it redirects your user to Box, obtains an access token, and automatically refreshes it before it expires. Your agent code never handles tokens directly — you only pass a connectionName and a user identifier.

You supply your Box Connected App credentials (Client ID + Secret) once per environment in the Scalekit dashboard.

Set up the connector

Connect Box to Scalekit so your agent can manage files, folders, users, tasks, and more on behalf of your users. Box uses OAuth 2.0 — users authorize access through Box’s login flow, and Scalekit handles token storage and refresh automatically.

You will need:

  • A Box developer account (free at developer.box.com)
  • Your Box OAuth app’s Client ID and Client Secret
  • The redirect URI from Scalekit to paste into Box
  1. Create a Box OAuth app

    • Go to the Box Developer Console and click Create New App.

    • Select Custom App as the app type.

    • Under authentication method, choose User Authentication (OAuth 2.0). This lets your agent act on behalf of each user who authorizes access.

    • Enter an app name (e.g. “My Agent App”) and click Create App.

  2. Copy the redirect URI from Scalekit

    • In Scalekit dashboard, go to Agent AuthCreate Connection.
    • Find Box and click Create.
    • Click Use your own credentials and copy the redirect URI. It looks like: https://<env>.scalekit.cloud/sso/v1/oauth/<conn_id>/callback

  3. Add the redirect URI to Box

    • In the Box Developer Console, open your app and go to the Configuration tab.
    • Under OAuth 2.0 Redirect URI, paste the redirect URI from Scalekit and click Save Changes.

  4. Select scopes for your app

    Still on the Configuration tab in Box, scroll down to Application Scopes and enable the permissions your agent needs:

    ScopeRequired for
    root_readonlyReading files and folders
    root_readwriteCreating, updating, and deleting files/folders
    manage_groupsCreating and managing groups
    manage_webhookCreating and managing webhooks
    manage_managed_usersCreating and managing enterprise users
    manage_enterprise_propertiesAccessing enterprise events

    Click Save Changes after selecting scopes.

  5. Add credentials in Scalekit

    • In the Box Developer Console, open your app → Configuration tab.
    • Copy your Client ID and Client Secret.
    • In Scalekit dashboard, go to Agent AuthConnections, open the Box connection you created, and enter:
      • Client ID — from Box
      • Client Secret — from Box
      • Scopes — select the same scopes you enabled in Box (e.g. root_readonly, root_readwrite)

    • Click Save.
  6. Add a connected account for each user

    Each user who authorizes Box access becomes a connected account. During authorization, Box will show your app name and request the scopes you configured.

    Via dashboard (for testing)

    • In Scalekit dashboard, go to your Box connection → Connected AccountsAdd Account.
    • Enter a User ID (your internal identifier for this user, e.g. user_123).
    • Click Add — you will be redirected to Box’s OAuth consent screen to authorize.

    Via API (for production)

    In production, generate an authorization link and redirect your user to it:

    const { link } = await scalekit.actions.getAuthorizationLink({
    connectionName: 'box',
    identifier: 'user_123',
    });
    // Redirect your user to `link`

    After the user authorizes, Scalekit stores their tokens. Your agent can then call Box tools on their behalf without any further redirects.

Code examples

Once a user has connected their Box account, your agent can call Box tools directly through Scalekit — no OAuth flow needed on subsequent calls. Scalekit manages token refresh automatically.

Proxy API calls

Use the proxy to call any Box REST API endpoint directly:

import { ScalekitClient } from '@scalekit-sdk/node';
const scalekit = new ScalekitClient(
process.env.SCALEKIT_ENV_URL,
process.env.SCALEKIT_CLIENT_ID,
process.env.SCALEKIT_CLIENT_SECRET
);
const actions = scalekit.actions;
// List files in the root folder
const result = await actions.request({
connectionName: 'box',
identifier: 'user_123',
path: '/2.0/folders/0/items',
method: 'GET',
});
console.log(result);

Use Scalekit tools

Call Box tools by name using execute_tool. Pass the tool name and the required input parameters.

List folder contents

Start here to discover file and folder IDs. Use "0" for the root folder.

const result = await actions.executeTool({
toolName: 'box_folder_items_list',
connectedAccountId: connectedAccount.id,
toolInput: {
folder_id: '0', // root folder
},
});
// result.entries[] contains files and folders with their IDs

Get file details

const file = await actions.executeTool({
toolName: 'box_file_get',
connectedAccountId: connectedAccount.id,
toolInput: { file_id: '12345678' },
});
const results = await actions.executeTool({
toolName: 'box_search',
connectedAccountId: connectedAccount.id,
toolInput: {
query: 'quarterly report',
type: 'file',
file_extensions: 'pdf,docx',
},
});

Create a task on a file

const task = await actions.executeTool({
toolName: 'box_task_create',
connectedAccountId: connectedAccount.id,
toolInput: {
file_id: '12345678',
message: 'Please review this document',
action: 'review',
due_at: '2025-12-31T00:00:00Z',
},
});
// task.id is the task ID — use it with box_task_assignment_create

Share a file

const link = await actions.executeTool({
toolName: 'box_shared_link_file_create',
connectedAccountId: connectedAccount.id,
toolInput: {
file_id: '12345678',
access: 'company', // open | company | collaborators
can_download: true,
},
});

Create a webhook

Webhooks require the manage_webhook scope. The triggers field is an array of event strings.

const webhook = await actions.executeTool({
toolName: 'box_webhook_create',
connectedAccountId: connectedAccount.id,
toolInput: {
target_id: '0',
target_type: 'folder',
address: 'https://your-app.com/webhooks/box',
triggers: ['FILE.UPLOADED', 'FILE.DELETED', 'FOLDER.CREATED'],
},
});

Add a collaborator to a folder

Collaborations grant a user or group access to a specific file or folder. You need the user’s Box ID or email login.

// First, get the user's Box ID using box_users_list or box_user_me_get
const collab = await actions.executeTool({
toolName: 'box_collaboration_create',
connectedAccountId: connectedAccount.id,
toolInput: {
item_id: 'FOLDER_ID',
item_type: 'folder',
accessible_by_id: 'USER_BOX_ID',
accessible_by_type: 'user',
role: 'editor',
},
});
// To find the collaboration ID later, use box_folder_collaborations_list

Scalekit Tools

box_collaboration_create Grants a user or group access to a file or folder. 8 params

Grants a user or group access to a file or folder.

Name Type Required Description
accessible_by_id string required ID of the user or group to collaborate with.
accessible_by_type string required Type: user or group.
item_id string required ID of the file or folder.
item_type string required Type of item: file or folder.
role string required Collaboration role: viewer, previewer, uploader, previewer_uploader, viewer_uploader, co-owner, or editor.
can_view_path string optional Allow user to see path to item (true/false).
expires_at string optional Expiry date in ISO 8601 format.
notify string optional Notify collaborator via email (true/false).
box_collaboration_delete Removes a collaboration, revoking user or group access. 1 param

Removes a collaboration, revoking user or group access.

Name Type Required Description
collaboration_id string required ID of the collaboration to delete.
box_collaboration_get Retrieves details of a specific collaboration. 3 params

Retrieves details of a specific collaboration.

Name Type Required Description
collaboration_id string required ID of the collaboration.
fields string optional Comma-separated list of fields to return.
xero_tenant_id string optional Xero tenant (organisation) ID.
box_collaboration_update Updates the role or status of a collaboration. 5 params

Updates the role or status of a collaboration.

Name Type Required Description
collaboration_id string required ID of the collaboration.
can_view_path boolean optional Allow user to see path to item.
expires_at string optional New expiry date in ISO 8601 format.
role string optional New collaboration role.
status string optional Collaboration status: accepted or rejected.
box_collection_items_list Retrieves the items in a collection (e.g. Favorites). 4 params

Retrieves the items in a collection (e.g. Favorites).

Name Type Required Description
collection_id string required ID of the collection.
fields string optional Comma-separated list of fields to return.
limit integer optional Max results.
offset integer optional Pagination offset.
box_collections_list Retrieves all collections (e.g. Favorites) for the user. 3 params

Retrieves all collections (e.g. Favorites) for the user.

Name Type Required Description
fields string optional Comma-separated list of fields to return.
limit integer optional Max results.
offset integer optional Pagination offset.
box_comment_create Adds a comment to a file. 4 params

Adds a comment to a file.

Name Type Required Description
item_id string required ID of the file to comment on.
item_type string required Type of item: file or comment.
message string required Text of the comment.
tagged_message string optional Comment text with @mentions using @[user_id:user_name] syntax.
box_comment_delete Removes a comment. 1 param

Removes a comment.

Name Type Required Description
comment_id string required ID of the comment to delete.
box_comment_get Retrieves a comment. 2 params

Retrieves a comment.

Name Type Required Description
comment_id string required ID of the comment.
fields string optional Comma-separated list of fields to return.
box_comment_update Updates the text of a comment. 2 params

Updates the text of a comment.

Name Type Required Description
comment_id string required ID of the comment to update.
message string required New text for the comment.
box_events_list Retrieves events from the event stream. 6 params

Retrieves events from the event stream.

Name Type Required Description
created_after string optional Return events after this date (ISO 8601).
created_before string optional Return events before this date (ISO 8601).
event_type string optional Comma-separated list of event types to filter.
limit integer optional Max events to return.
stream_position string optional Pagination position from a previous response.
stream_type string optional Event stream type: all, changes, sync, or admin_logs.
box_file_collaborations_list Retrieves all collaborations on a file. 2 params

Retrieves all collaborations on a file.

Name Type Required Description
file_id string required ID of the file.
fields string optional Comma-separated list of fields to return.
box_file_comments_list Retrieves all comments on a file. 2 params

Retrieves all comments on a file.

Name Type Required Description
file_id string required ID of the file.
fields string optional Comma-separated list of fields to return.
box_file_copy Creates a copy of a file in a specified folder. 3 params

Creates a copy of a file in a specified folder.

Name Type Required Description
file_id string required ID of the file to copy.
parent_id string required ID of the destination folder.
name string optional New name for the copied file (optional).
box_file_delete Moves a file to the trash. 1 param

Moves a file to the trash.

Name Type Required Description
file_id string required ID of the file to delete.
box_file_get Retrieves detailed information about a file. 2 params

Retrieves detailed information about a file.

Name Type Required Description
file_id string required ID of the file.
fields string optional Comma-separated list of fields to return.
box_file_metadata_create Applies metadata to a file. 4 params

Applies metadata to a file.

Name Type Required Description
data_json string required JSON object of metadata fields and values.
file_id string required ID of the file.
scope string required Scope: global or enterprise.
template_key string required Metadata template key.
box_file_metadata_delete Removes a metadata instance from a file. 3 params

Removes a metadata instance from a file.

Name Type Required Description
file_id string required ID of the file.
scope string required Scope: global or enterprise.
template_key string required Metadata template key.
box_file_metadata_get Retrieves a specific metadata instance on a file. 3 params

Retrieves a specific metadata instance on a file.

Name Type Required Description
file_id string required ID of the file.
scope string required Scope: global or enterprise.
template_key string required Metadata template key.
box_file_metadata_list Retrieves all metadata instances attached to a file. 1 param

Retrieves all metadata instances attached to a file.

Name Type Required Description
file_id string required ID of the file.
box_file_tasks_list Retrieves all tasks associated with a file. 1 param

Retrieves all tasks associated with a file.

Name Type Required Description
file_id string required ID of the file.
box_file_thumbnail_get Retrieves a thumbnail image for a file. 4 params

Retrieves a thumbnail image for a file.

Name Type Required Description
extension string required Thumbnail format: jpg or png.
file_id string required ID of the file.
min_height integer optional Minimum height of the thumbnail in pixels.
min_width integer optional Minimum width of the thumbnail in pixels.
box_file_update Updates a file's name, description, tags, or moves it to another folder. 5 params

Updates a file's name, description, tags, or moves it to another folder.

Name Type Required Description
file_id string required ID of the file to update.
description string optional New description for the file.
name string optional New name for the file.
parent_id string optional ID of the folder to move the file into.
tags string optional Comma-separated list of tags. Pass as JSON string.
box_file_versions_list Retrieves all previous versions of a file. 1 param

Retrieves all previous versions of a file.

Name Type Required Description
file_id string required ID of the file.
box_folder_collaborations_list Retrieves all collaborations on a folder. 2 params

Retrieves all collaborations on a folder.

Name Type Required Description
folder_id string required ID of the folder.
fields string optional Comma-separated list of fields to return.
box_folder_copy Creates a copy of a folder and its contents. 3 params

Creates a copy of a folder and its contents.

Name Type Required Description
folder_id string required ID of the folder to copy.
parent_id string required ID of the destination folder.
name string optional New name for the copied folder (optional).
box_folder_create Creates a new folder inside a parent folder. 3 params

Creates a new folder inside a parent folder.

Name Type Required Description
name string required Name of the new folder.
parent_id string required ID of the parent folder. Use '0' for root.
fields string optional Comma-separated list of fields to return.
box_folder_delete Moves a folder to the trash. 2 params

Moves a folder to the trash.

Name Type Required Description
folder_id string required ID of the folder to delete.
recursive string optional Delete non-empty folders recursively (true/false).
box_folder_get Retrieves a folder's details and its items. 6 params

Retrieves a folder's details and its items.

Name Type Required Description
folder_id string required ID of the folder. Use '0' for root.
direction string optional Sort direction: ASC or DESC.
fields string optional Comma-separated list of fields to return.
limit integer optional Max items to return (max 1000).
offset integer optional Pagination offset.
sort string optional Sort order: id, name, date, or size.
box_folder_items_list Retrieves a paginated list of items in a folder. 6 params

Retrieves a paginated list of items in a folder.

Name Type Required Description
folder_id string required ID of the folder. Use '0' for root.
direction string optional ASC or DESC.
fields string optional Comma-separated list of fields to return.
limit integer optional Max items to return (max 1000).
offset integer optional Pagination offset.
sort string optional Sort field: id, name, date, or size.
box_folder_metadata_list Retrieves all metadata instances on a folder. 1 param

Retrieves all metadata instances on a folder.

Name Type Required Description
folder_id string required ID of the folder.
box_folder_update Updates a folder's name, description, or moves it. 4 params

Updates a folder's name, description, or moves it.

Name Type Required Description
folder_id string required ID of the folder to update.
description string optional New description for the folder.
name string optional New name for the folder.
parent_id string optional ID of the new parent folder to move into.
box_group_create Creates a new group in the enterprise. 5 params

Creates a new group in the enterprise.

Name Type Required Description
name string required Name of the group.
description string optional Description of the group.
invitability_level string optional Who can invite to group: admins_only, admins_and_members, all_managed_users.
member_viewability_level string optional Who can view group members: admins_only, admins_and_members, all_managed_users.
provenance string optional Identifier to distinguish manually vs synced groups.
box_group_delete Permanently deletes a group. 1 param

Permanently deletes a group.

Name Type Required Description
group_id string required ID of the group to delete.
box_group_get Retrieves information about a group. 2 params

Retrieves information about a group.

Name Type Required Description
group_id string required ID of the group.
fields string optional Comma-separated list of fields to return.
box_group_members_list Retrieves all members of a group. 3 params

Retrieves all members of a group.

Name Type Required Description
group_id string required ID of the group.
limit integer optional Max results.
offset integer optional Pagination offset.
box_group_membership_add Adds a user to a group. 3 params

Adds a user to a group.

Name Type Required Description
group_id string required ID of the group.
user_id string required ID of the user to add.
role string optional Role in the group: member or admin.
box_group_membership_get Retrieves a specific group membership. 2 params

Retrieves a specific group membership.

Name Type Required Description
group_membership_id string required ID of the group membership.
fields string optional Comma-separated list of fields to return.
box_group_membership_remove Removes a user from a group. 1 param

Removes a user from a group.

Name Type Required Description
group_membership_id string required ID of the group membership to remove.
box_group_membership_update Updates a user's role in a group. 2 params

Updates a user's role in a group.

Name Type Required Description
group_membership_id string required ID of the membership to update.
role string optional New role: member or admin.
box_group_update Updates a group's properties. 5 params

Updates a group's properties.

Name Type Required Description
group_id string required ID of the group to update.
description string optional New description.
invitability_level string optional Who can invite: admins_only, admins_and_members, all_managed_users.
member_viewability_level string optional Who can view members.
name string optional New name for the group.
box_groups_list Retrieves all groups in the enterprise. 4 params

Retrieves all groups in the enterprise.

Name Type Required Description
fields string optional Comma-separated list of fields to return.
filter_term string optional Filter groups by name.
limit integer optional Max results.
offset integer optional Pagination offset.
box_metadata_template_get Retrieves a metadata template schema. 2 params

Retrieves a metadata template schema.

Name Type Required Description
scope string required Scope of the template: global or enterprise.
template_key string required Key of the metadata template.
box_metadata_templates_list Retrieves all metadata templates for the enterprise. 2 params

Retrieves all metadata templates for the enterprise.

Name Type Required Description
limit integer optional Max results.
marker string optional Pagination marker.
box_recent_items_list Retrieves files and folders accessed recently. 3 params

Retrieves files and folders accessed recently.

Name Type Required Description
fields string optional Comma-separated list of fields to return.
limit integer optional Max results.
marker string optional Pagination marker.
box_task_assignment_create Assigns a task to a user. 3 params

Assigns a task to a user.

Name Type Required Description
task_id string required ID of the task to assign.
user_id string optional ID of the user to assign the task to.
user_login string optional Email login of the user (alternative to user_id).
box_task_assignment_delete Removes a task assignment from a user. 1 param

Removes a task assignment from a user.

Name Type Required Description
task_assignment_id string required ID of the task assignment to remove.
box_task_assignment_get Retrieves a specific task assignment. 1 param

Retrieves a specific task assignment.

Name Type Required Description
task_assignment_id string required ID of the task assignment.
box_task_assignment_update Updates a task assignment (complete, approve, or reject). 3 params

Updates a task assignment (complete, approve, or reject).

Name Type Required Description
task_assignment_id string required ID of the task assignment.
message string optional Optional message/comment for the resolution.
resolution_state string optional Resolution state: completed, incomplete, approved, or rejected.
box_task_assignments_list Retrieves all assignments for a task. 1 param

Retrieves all assignments for a task.

Name Type Required Description
task_id string required ID of the task.
box_task_create Creates a task on a file. 5 params

Creates a task on a file.

Name Type Required Description
file_id string required ID of the file to attach the task to.
action string optional Action: review or complete.
completion_rule string optional Completion rule: all_assignees or any_assignee.
due_at string optional Due date in ISO 8601 format.
message string optional Task message/description.
box_task_delete Removes a task from a file. 1 param

Removes a task from a file.

Name Type Required Description
task_id string required ID of the task to delete.
box_task_get Retrieves a task's details. 1 param

Retrieves a task's details.

Name Type Required Description
task_id string required ID of the task.
box_task_update Updates a task's message, due date, or completion rule. 5 params

Updates a task's message, due date, or completion rule.

Name Type Required Description
task_id string required ID of the task to update.
action string optional New action: review or complete.
completion_rule string optional New completion rule: all_assignees or any_assignee.
due_at string optional New due date in ISO 8601 format.
message string optional New message for the task.
box_trash_file_permanently_delete Permanently deletes a trashed file. 1 param

Permanently deletes a trashed file.

Name Type Required Description
file_id string required ID of the trashed file.
box_trash_file_restore Restores a file from the trash. 3 params

Restores a file from the trash.

Name Type Required Description
file_id string required ID of the trashed file.
name string optional New name if original name is taken.
parent_id string optional Parent folder ID if original is unavailable.
box_trash_folder_permanently_delete Permanently deletes a trashed folder. 1 param

Permanently deletes a trashed folder.

Name Type Required Description
folder_id string required ID of the trashed folder.
box_trash_folder_restore Restores a folder from the trash. 3 params

Restores a folder from the trash.

Name Type Required Description
folder_id string required ID of the trashed folder.
name string optional New name if original is taken.
parent_id string optional New parent folder ID if original is unavailable.
box_trash_list Retrieves items in the user's trash. 5 params

Retrieves items in the user's trash.

Name Type Required Description
direction string optional Sort direction: ASC or DESC.
fields string optional Comma-separated list of fields to return.
limit integer optional Max results.
offset integer optional Pagination offset.
sort string optional Sort field: name, date, or size.
box_user_create Creates a new user in the enterprise. 5 params

Creates a new user in the enterprise.

Name Type Required Description
name string required Full name of the user.
is_platform_access_only boolean optional Set true for app users (no login).
login string optional Email address (login) for managed users.
role string optional User role: user or coadmin.
space_amount integer optional Storage quota in bytes (-1 for unlimited).
box_user_delete Removes a user from the enterprise. 3 params

Removes a user from the enterprise.

Name Type Required Description
user_id string required ID of the user to delete.
force string optional Force deletion even if user owns content (true/false).
notify string optional Notify user via email (true/false).
box_user_get Retrieves information about a specific user. 2 params

Retrieves information about a specific user.

Name Type Required Description
user_id string required ID of the user.
fields string optional Comma-separated list of fields to return.
box_user_me_get Retrieves information about the currently authenticated user. 1 param

Retrieves information about the currently authenticated user.

Name Type Required Description
fields string optional Comma-separated list of fields to return.
box_user_memberships_list Retrieves all group memberships for a user. 3 params

Retrieves all group memberships for a user.

Name Type Required Description
user_id string required ID of the user.
limit integer optional Max results.
offset integer optional Pagination offset.
box_user_update Updates a user's properties in the enterprise. 6 params

Updates a user's properties in the enterprise.

Name Type Required Description
user_id string required ID of the user to update.
name string optional New full name.
role string optional New role: user or coadmin.
space_amount integer optional Storage quota in bytes.
status string optional New status: active, inactive, or cannot_delete_edit.
tracking_codes string optional Tracking codes as JSON array string.
box_users_list Retrieves all users in the enterprise. 5 params

Retrieves all users in the enterprise.

Name Type Required Description
fields string optional Comma-separated list of fields to return.
filter_term string optional Filter users by name or login.
limit integer optional Max users to return.
offset integer optional Pagination offset.
user_type string optional Filter by type: all, managed, or external.
box_webhook_create Creates a webhook to receive event notifications. 4 params

Creates a webhook to receive event notifications.

Name Type Required Description
address string required HTTPS URL to receive webhook notifications.
target_id string required ID of the file or folder to watch.
target_type string required Type of target: file or folder.
triggers array required Array of trigger events, e.g. ["FILE.UPLOADED","FILE.DELETED"].
box_webhook_delete Removes a webhook. 1 param

Removes a webhook.

Name Type Required Description
webhook_id string required ID of the webhook to delete.
box_webhook_get Retrieves a webhook's details. 1 param

Retrieves a webhook's details.

Name Type Required Description
webhook_id string required ID of the webhook.
box_webhook_update Updates a webhook's address or triggers. 5 params

Updates a webhook's address or triggers.

Name Type Required Description
webhook_id string required ID of the webhook to update.
address string optional New HTTPS URL for notifications.
target_id string optional New target ID.
target_type string optional New target type: file or folder.
triggers array optional New array of trigger events, e.g. ["FILE.UPLOADED","FILE.DELETED"].
box_webhooks_list Retrieves all webhooks for the application. 2 params

Retrieves all webhooks for the application.

Name Type Required Description
limit integer optional Max results.
marker string optional Pagination marker.