Box Authorization API

openapi: 3.2.0
info:
  title: Box Platform Authorization API
  description: Box Platform provides functionality to provide access to content stored within Box. It provides endpoints for basic manipulation of files and folders, management of users within an enterprise, as well as more complex topics such as legal holds and retention policies.
  termsOfService: https://cloud.app.box.com/s/rmwxu64h1ipr41u49w3bbuvbsa29wku9
  contact:
    name: Box, Inc
    url: https://developer.box.com
    email: devrel@box.com
  license:
    name: Apache-2.0
    url: https://www.apache.org/licenses/LICENSE-2.0
  version: '2024.0'
  x-box-commit-hash: 53bdced3cd
servers:
- url: https://api.box.com/2.0
  description: Box Platform API server.
security:
- OAuth2Security: []
tags:
- name: Authorization
  description: A set of endpoints used to manage user authorization process.
  x-box-tag: authorization
  x-box-priority: true
paths:
  /authorize:
    get:
      operationId: get_authorize
      summary: Authorize user
      description: 'Authorize a user by sending them through the Box website and request their permission to act on their behalf.


        This is the first step when authenticating a user using OAuth 2.0. To request a user''s authorization to use the Box APIs on their behalf you will need to send a user to the URL with this format.'
      parameters:
      - name: response_type
        in: query
        description: The type of response we'd like to receive.
        required: true
        schema:
          type: string
          format: token
          enum:
          - code
        example: code
      - name: client_id
        in: query
        description: The Client ID of the application that is requesting to authenticate the user. To get the Client ID for your application, log in to your Box developer console and click the **Edit Application** link for the application you're working with. In the OAuth 2.0 Parameters section of the configuration page, find the item labelled `client_id`. The text of that item is your application's Client ID.
        required: true
        schema:
          type: string
        example: ly1nj6n11vionaie65emwzk575hnnmrk
      - name: redirect_uri
        in: query
        description: The URI to which Box redirects the browser after the user has granted or denied the application permission. This URI match one of the redirect URIs in the configuration of your application. It must be a valid HTTPS URI and it needs to be able to handle the redirection to complete the next step in the OAuth 2.0 flow. Although this parameter is optional, it must be a part of the authorization URL if you configured multiple redirect URIs for the application in the developer console. A missing parameter causes a `redirect_uri_missing` error after the user grants application access.
        required: false
        schema:
          type: string
          format: url
        example: http://example.com/auth/callback
      - name: state
        in: query
        description: A custom string of your choice. Box will pass the same string to the redirect URL when authentication is complete. This parameter can be used to identify a user on redirect, as well as protect against hijacked sessions and other exploits.
        required: false
        schema:
          type: string
        example: my_state
      - name: scope
        in: query
        description: A space-separated list of application scopes you'd like to authenticate the user for. This defaults to all the scopes configured for the application in its configuration page.
        required: false
        schema:
          type: string
        example: admin_readwrite
      responses:
        '200':
          description: Does not return any data, but rather should be used in the browser.
          content:
            text/html:
              schema:
                type: string
                format: html
        default:
          description: Does not return any data, but rather should be used in the browser.
          content:
            text/html:
              schema:
                type: string
                format: html
      x-box-tag: authorization
      security: []
      servers:
      - url: https://account.box.com/api/oauth2
        description: Server for client-side authentication.
      tags:
      - Authorization
      x-codeSamples:
      - lang: curl
        label: Authorize user
        source: curl -i -X GET "https://account.box.com/api/oauth2/authorize?response_type=code&client_id=ly1nj6n11vionaie65emwzk575hnnmrk&redirect_uri=http://example.com/auth/callback"
      - lang: dotnet
        label: Authorize user
        source: 'using Box.Sdk.Gen;


          var config = new OAuthConfig(clientId: "YOUR_CLIENT_ID", clientSecret: "YOUR_CLIENT_SECRET");

          var auth = new BoxOAuth(config: config);


          // the URL to redirect the user to

          var authorizeUrl = auth.GetAuthorizeUrl();'
      - lang: swift
        label: Authorize user
        source: "do {\n    // Initialize configuration with required clientId and clientSecret\n    let config = OAuthConfig(clientId: \"<<YOUR CLIENT ID HERE>>\", clientSecret: \"<<YOUR CLIENT SECRET HERE>>\")\n    // Initialize BoxOAuth with configuration\n    let oauth = BoxOAuth(config: config)\n    // Run login flow which opens a secure web view,\n    // where users enter their login credentials to obtain an authorization code,\n    // which is then exchanged for an access token.\n    try await oauth.runLoginFlow(options: .init(), context: self)\n    // Initialize BoxClient with already authorized OAuth\n    let client = BoxClient(auth: oauth)\n\n    // Use client to make API calls\n    let folder = try await client.folders.getFolderById(folderId: \"<<YOUR_FOLDER_ID>>\")\n} catch {\n    print(\"An error occurred: \\(error)\")\n}"
      - lang: java
        label: Authorize user
        source: 'OAuthConfig oauthConfig = new OAuthConfig("CLIENT_ID", "CLIENT_SECRET");

          BoxOAuth oauth = new BoxOAuth(oauthConfig);

          String authorizationUrl = oauth.getAuthorizeUrl();'
      - lang: node
        label: Authorize user
        source: "import { BoxOAuth, OAuthConfig } from 'box-node-sdk/box';\n\nconst config = new OAuthConfig({\n  clientId: 'OAUTH_CLIENT_ID',\n  clientSecret: 'OAUTH_CLIENT_SECRET',\n});\nconst oauth = new BoxOAuth({ config: config });\n\n// the URL to redirect the user to\nvar authorize_url = oauth.getAuthorizeUrl();"
      - lang: python
        label: Authorize user
        source: "from box_sdk_gen import BoxOAuth, OAuthConfig\n\nauth = BoxOAuth(\n    OAuthConfig(client_id=\"YOUR_CLIENT_ID\", client_secret=\"YOUR_CLIENT_SECRET\")\n)\nauth_url = auth.get_authorize_url()"
  /oauth2/token:
    post:
      operationId: post_oauth2_token
      summary: Request access token
      description: 'Request an Access Token using either a client-side obtained OAuth 2.0 authorization code or a server-side JWT assertion.


        An Access Token is a string that enables Box to verify that a request belongs to an authorized session. In the normal order of operations you will begin by requesting authentication from the authorize endpoint and Box will send you an authorization code.


        You will then send this code to this endpoint to exchange it for an Access Token. The returned Access Token can then be used to to make Box API calls.'
      requestBody:
        content:
          application/x-www-form-urlencoded:
            schema:
              $ref: '#/components/schemas/PostOAuth2Token'
      responses:
        '200':
          description: 'Returns a new Access Token that can be used to make authenticated API calls by passing along the token in a authorization header as follows `Authorization: Bearer <Token>`.'
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/AccessToken'
        '400':
          description: An authentication error.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/OAuth2Error'
        default:
          description: An authentication error.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/OAuth2Error'
      x-box-tag: authorization
      security: []
      servers:
      - url: https://api.box.com
        description: Server for server-side authentication.
      tags:
      - Authorization
      x-codeSamples:
      - lang: curl
        label: Request access token
        source: "curl -i -X POST \"https://api.box.com/oauth2/token\" \\\n     -H \"content-type: application/x-www-form-urlencoded\" \\\n     -d \"client_id=[CLIENT_ID]\" \\\n     -d \"client_secret=[CLIENT_SECRET]\" \\\n     -d \"code=[CODE]\" \\\n     -d \"grant_type=authorization_code\""
      - lang: dotnet
        label: Request access token
        source: await auth.RetrieveTokenAsync();
      - lang: swift
        label: Request access token
        source: try await auth.retrieveToken();
      - lang: java
        label: Request access token
        source: auth.retrieveToken();
      - lang: node
        label: Request access token
        source: await auth.retrieveToken();
      - lang: python
        label: Request access token
        source: auth.retrieve_token()
  /oauth2/token#refresh:
    post:
      operationId: post_oauth2_token#refresh
      summary: Refresh access token
      description: Refresh an Access Token using its client ID, secret, and refresh token.
      requestBody:
        content:
          application/x-www-form-urlencoded:
            schema:
              $ref: '#/components/schemas/PostOAuth2Token--RefreshAccessToken'
      responses:
        '200':
          description: 'Returns a new Access Token that can be used to make authenticated API calls by passing along the token in a authorization header as follows `Authorization: Bearer <Token>`.'
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/AccessToken'
        '400':
          description: An authentication error.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/OAuth2Error'
        default:
          description: An authentication error.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/OAuth2Error'
      x-box-tag: authorization
      security: []
      servers:
      - url: https://api.box.com
        description: Server for server-side authentication.
      tags:
      - Authorization
      x-box-is-variation: true
      x-codeSamples:
      - lang: curl
        label: Refresh access token
        source: "curl -i -X POST \"https://api.box.com/oauth2/token\" \\\n     -H \"content-type: application/x-www-form-urlencoded\" \\\n     -d \"client_id=[CLIENT_ID]\" \\\n     -d \"client_secret=[CLIENT_SECRET]\" \\\n     -d \"refresh_token=[REFRESH_TOKEN]\" \\\n     -d \"grant_type=refresh_token\""
      - lang: dotnet
        label: Refresh access token
        source: await auth.RefreshTokenAsync();
      - lang: swift
        label: Refresh access token
        source: try await auth.refreshToken();
      - lang: java
        label: Refresh access token
        source: auth.refreshToken();
      - lang: node
        label: Refresh access token
        source: await auth.refreshToken();
      - lang: python
        label: Refresh access token
        source: auth.refresh_token()
  /oauth2/revoke:
    post:
      operationId: post_oauth2_revoke
      summary: Revoke access token
      description: Revoke an active Access Token, effectively logging a user out that has been previously authenticated.
      requestBody:
        content:
          application/x-www-form-urlencoded:
            schema:
              $ref: '#/components/schemas/PostOAuth2Revoke'
      responses:
        '200':
          description: Returns an empty response when the token was successfully revoked.
        '400':
          description: An authentication error.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/OAuth2Error'
        default:
          description: An authentication error.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/OAuth2Error'
      x-box-tag: authorization
      security: []
      servers:
      - url: https://api.box.com
        description: Server for server-side authentication.
      tags:
      - Authorization
      x-codeSamples:
      - lang: curl
        label: Revoke access token
        source: "curl -i -X POST \"https://api.box.com/oauth2/revoke\" \\\n     -H \"content-type: application/x-www-form-urlencoded\" \\\n     -d \"client_id=[CLIENT_ID]\" \\\n     -d \"client_secret=[CLIENT_SECRET]\" \\\n     -d \"token=[ACCESS_TOKEN]\""
      - lang: dotnet
        label: Revoke access token
        source: await auth.RevokeTokenAsync();
      - lang: swift
        label: Revoke access token
        source: try await auth.revokeToken()
      - lang: java
        label: Revoke access token
        source: 'auth.revokeToken();

          // client''s tokens have been revoked'
      - lang: node
        label: Revoke access token
        source: 'await auth.revokeTokens();

          // client''s tokens have been revoked'
      - lang: python
        label: Revoke access token
        source: client.auth.revoke_token()
components:
  schemas:
    AccessToken:
      description: A token that can be used to make authenticated API calls.
      type: object
      properties:
        access_token:
          description: The requested access token.
          type: string
          format: token
          example: c3FIOG9vSGV4VHo4QzAyg5T1JvNnJoZ3ExaVNyQWw6WjRsanRKZG5lQk9qUE1BVQ
        expires_in:
          description: The time in seconds by which this token will expire.
          type: integer
          format: int64
          example: 3600
        token_type:
          description: The type of access token returned.
          type: string
          example: bearer
          enum:
          - bearer
        restricted_to:
          description: The permissions that this access token permits, providing a list of resources (files, folders, etc) and the scopes permitted for each of those resources.
          type: array
          items:
            $ref: '#/components/schemas/ResourceScope'
        refresh_token:
          description: The refresh token for this access token, which can be used to request a new access token when the current one expires.
          type: string
          format: token
          example: c3FIOG9vSGV4VHo4QzAyg5T1JvNnJoZ3ExaVNyQWw6WjRsanRKZG5lQk9qUE1BVQ
        issued_token_type:
          description: The type of downscoped access token returned. This is only returned if an access token has been downscoped.
          type: string
          format: urn
          example: urn:ietf:params:oauth:token-type:access_token
          enum:
          - urn:ietf:params:oauth:token-type:access_token
      title: Access token
      x-box-resource-id: access_token
      x-box-tag: authorization
    ResourceScope:
      description: A relation between a resource (file or folder) and the scopes for which the resource can be accessed.
      type: object
      properties:
        scope:
          description: The scopes for the resource access.
          type: string
          example: item_download
          enum:
          - annotation_edit
          - annotation_view_all
          - annotation_view_self
          - base_explorer
          - base_picker
          - base_preview
          - base_upload
          - item_delete
          - item_download
          - item_preview
          - item_rename
          - item_share
          - item_upload
          - item_read
        object:
          $ref: '#/components/schemas/Resource'
      title: Resource scope
    File--Mini:
      description: A mini representation of a file, used when nested under another resource.
      type:
      - object
      - 'null'
      allOf:
      - $ref: '#/components/schemas/File--Base'
      - properties:
          sequence_id:
            allOf:
            - type:
              - string
              - 'null'
              example: '3'
              description: 'A numeric identifier that represents the most recent user event that has been applied to this item.


                This can be used in combination with the `GET /events`-endpoint to filter out user events that would have occurred before this identifier was read.


                An example would be where a Box Drive-like application would fetch an item via the API, and then listen to incoming user events for changes to the item. The application would ignore any user events where the `sequence_id` in the event is smaller than or equal to the `sequence_id` in the originally fetched resource.'
            - {}
          name:
            description: The name of the file.
            type: string
            example: Contract.pdf
          sha1:
            description: The SHA1 hash of the file. This can be used to compare the contents of a file on Box with a local file.
            type: string
            format: digest
            example: 85136C79CBF9FE36BB9D05D0639C70C265C18D37
          file_version:
            allOf:
            - $ref: '#/components/schemas/FileVersion--Mini'
            - description: The information about the current version of the file.
      title: File (Mini)
      x-box-resource-id: file--mini
      x-box-tag: files
      x-box-variant: mini
    Folder--Mini:
      description: A mini representation of a file version, used when nested under another resource.
      type: object
      allOf:
      - $ref: '#/components/schemas/Folder--Base'
      - properties:
          sequence_id:
            allOf:
            - type:
              - string
              - 'null'
              example: '3'
              description: 'A numeric identifier that represents the most recent user event that has been applied to this item.


                This can be used in combination with the `GET /events`-endpoint to filter out user events that would have occurred before this identifier was read.


                An example would be where a Box Drive-like application would fetch an item via the API, and then listen to incoming user events for changes to the item. The application would ignore any user events where the `sequence_id` in the event is smaller than or equal to the `sequence_id` in the originally fetched resource.'
            - {}
          name:
            description: The name of the folder.
            type: string
            example: Contracts
      title: Folder (Mini)
      x-box-resource-id: folder--mini
      x-box-tag: folders
      x-box-variant: mini
    PostOAuth2Token--RefreshAccessToken:
      description: A request to refresh an Access Token. Use this API to refresh an expired Access Token using a valid Refresh Token.
      type: object
      properties:
        grant_type:
          description: The type of request being made, in this case a refresh request.
          type: string
          format: urn
          example: refresh_token
          enum:
          - refresh_token
        client_id:
          description: The client ID of the application requesting to refresh the token.
          type: string
          example: ly1nj6n11vionaie65emwzk575hnnmrk
        client_secret:
          description: The client secret of the application requesting to refresh the token.
          type: string
          example: hOzsTeFlT6ko0dme22uGbQal04SBPYc1
        refresh_token:
          description: The refresh token to refresh.
          type: string
          format: token
          example: c3FIOG9vSGV4VHo4QzAyg5T1JvNnJoZ3ExaVNyQWw6WjRsanRKZG5lQk9qUE1BVQ
      required:
      - grant_type
      - client_id
      - client_secret
      - refresh_token
      title: Refresh access token
    OAuth2Error:
      description: An OAuth 2.0 error.
      type: object
      properties:
        error:
          description: The type of the error returned.
          type: string
          example: invalid_client
        error_description:
          description: The type of the error returned.
          type: string
          example: The client credentials are not valid
      title: OAuth 2.0 error
      x-box-resource-id: oauth2_error
      x-box-tag: authorization
    Folder--Base:
      description: The bare basic representation of a folder, the minimal amount of fields returned when using the `fields` query parameter.
      type: object
      properties:
        id:
          description: 'The unique identifier that represent a folder.


            The ID for any folder can be determined by visiting a folder in the web application and copying the ID from the URL. For example, for the URL `https://*.app.box.com/folders/123` the `folder_id` is `123`.'
          type: string
          example: '12345'
        etag:
          description: The HTTP `etag` of this folder. This can be used within some API endpoints in the `If-Match` and `If-None-Match` headers to only perform changes on the folder if (no) changes have happened.
          type:
          - string
          - 'null'
          example: '1'
        type:
          description: The value will always be `folder`.
          type: string
          example: folder
          enum:
          - folder
      required:
      - id
      - type
      title: Folder (Base)
      x-box-resource-id: folder--base
      x-box-tag: folders
      x-box-variant: base
      x-box-variants:
      - base
      - mini
      - standard
      - full
    FileVersion--Mini:
      description: A mini representation of a file version, used when nested within another resource.
      type: object
      allOf:
      - $ref: '#/components/schemas/FileVersion--Base'
      - properties:
          sha1:
            description: The SHA1 hash of this version of the file.
            type: string
            example: 134b65991ed521fcfe4724b7d814ab8ded5185dc
      title: File version (Mini)
      x-box-resource-id: file_version--mini
      x-box-variant: mini
    PostOAuth2Token:
      description: A request for a new OAuth 2.0 token.
      type: object
      properties:
        grant_type:
          description: The type of request being made, either using a client-side obtained authorization code, a refresh token, a JWT assertion, client credentials grant or another access token for the purpose of downscoping a token.
          type: string
          format: urn
          example: authorization_code
          enum:
          - authorization_code
          - refresh_token
          - client_credentials
          - urn:ietf:params:oauth:grant-type:jwt-bearer
          - urn:ietf:params:oauth:grant-type:token-exchange
        client_id:
          description: 'The Client ID of the application requesting an access token.


            Used in combination with `authorization_code`, `client_credentials`, or `urn:ietf:params:oauth:grant-type:jwt-bearer` as the `grant_type`.'
          type: string
          example: ly1nj6n11vionaie65emwzk575hnnmrk
        client_secret:
          description: 'The client secret of the application requesting an access token.


            Used in combination with `authorization_code`, `client_credentials`, or `urn:ietf:params:oauth:grant-type:jwt-bearer` as the `grant_type`.'
          type: string
          example: hOzsTeFlT6ko0dme22uGbQal04SBPYc1
        code:
          description: 'The client-side authorization code passed to your application by Box in the browser redirect after the user has successfully granted your application permission to make API calls on their behalf.


            Used in combination with `authorization_code` as the `grant_type`.'
          type: string
          format: token
          example: n22JPxrh18m4Y0wIZPIqYZK7VRrsMTWW
        refresh_token:
          description: 'A refresh token used to get a new access token with.


            Used in combination with `refresh_token` as the `grant_type`.'
          type: string
          format: token
          example: c3FIOG9vSGV4VHo4QzAyg5T1JvNnJoZ3ExaVNyQWw6WjRsanRKZG5lQk9qUE1BVQ
        assertion:
          description: 'A JWT assertion for which to request a new access token.


            Used in combination with `urn:ietf:params:oauth:grant-type:jwt-bearer` as the `grant_type`.'
          type: string
          format: jwt
          example: xxxxx.yyyyy.zzzzz
        subject_token:
          description: 'The token to exchange for a downscoped token. This can be a regular access token, a JWT assertion, or an app token.


            Used in combination with `urn:ietf:params:oauth:grant-type:token-exchange` as the `grant_type`.'
          type: string
          format: token
          example: c3FIOG9vSGV4VHo4QzAyg5T1JvNnJoZ3ExaVNyQWw6WjRsanRKZG5lQk9qUE1BVQ
        subject_token_type:
          description: 'The type of `subject_token` passed in.


            Used in combination with `urn:ietf:params:oauth:grant-type:token-exchange` as the `grant_type`.'
          type: string
          example: urn:ietf:params:oauth:token-type:access_token
          enum:
          - urn:ietf:params:oauth:token-type:access_token
        actor_token:
          description: 'The token used to create an annotator token. This is a JWT assertion.


            Used in combination with `urn:ietf:params:oauth:grant-type:token-exchange` as the `grant_type`.'
          type: string
          format: token
          example: c3FIOG9vSGV4VHo4QzAyg5T1JvNnJoZ3ExaVNyQWw6WjRsanRKZG5lQk9qUE1BVQ
        actor_token_type:
          description: 'The type of `actor_token` passed in.


            Used in combination with `urn:ietf:params:oauth:grant-type:token-exchange` as the `grant_type`.'
          type: string
          format: urn
          example: urn:ietf:params:oauth:token-type:id_token
          enum:
          - urn:ietf:params:oauth:token-type:id_token
        scope:
          description: 'The space-delimited list of scopes that you want apply to the new access token.


            The `subject_token` will need to have all of these scopes or the call will error with **401 Unauthorized**..'
          type: string
          format: space_delimited_list
          example: item_upload item_preview base_explorer
        resource:
          description: Full URL for the file that the token should be generated for.
          type: string
          format: url
          example: https://api.box.com/2.0/files/123456
        box_subject_type:
          description: Used in combination with `client_credentials` as the `grant_type`.
          type: string
          example: enterprise
          enum:
          - enterprise
          - user
        box_subject_id:
          description: Used in combination with `client_credentials` as the `grant_type`. Value is determined by `box_subject_type`. If `user` use user ID and if `enterprise` use enterprise ID.
          type: string
          example: '123456789'
        box_shared_link:
          description: Full URL of the shared link on the file or folder that the token should be generated for.
          type: string
          format: url
          example: https://cloud.box.com/s/123456
      required:
      - grant_type
      title: Token request
    File--Base:
      description: The bare basic representation of a file, the minimal amount of fields returned when using the `fields` query parameter.
      type:
      - object
      - 'null'
      properties:
        id:
          description: 'The unique identifier that represent a file.


            The ID for any file can be determined by visiting a file in the web application and copying the ID from the URL. For example, for the URL `https://*.app.box.com/files/123` the `file_id` is `123`.'
          type: string
          example: '12345'
        etag:
          description: The HTTP `etag` of this file. This can be used within some API endpoints in the `If-Match` and `If-None-Match` headers to only perform changes on the file if (no) changes have happened.
          type:
          - string
          - 'null'
          example: '1'
        type:
          description: The value will always be `file`.
          type: string
          example: file
          enum:
          - file
      required:
      - id
      - type
      title: File (Base)
      x-box-resource-id: file--base
      x-box-tag: files
      x-box-variant: base
      x-box-variants:
      - base
      - mini
      - standard
      - full
    Resource:
      description: The file or folder resource.
      type: object
      oneOf:
      - $ref: '#/components/schemas/Folder--Mini'
      - $ref: '#/components/schemas/File--Mini'
      title: Resource
    PostOAuth2Revoke:
      description: A request to revoke an OAuth 2.0 token.
      type: object
      properties:
        client_id:
          description: The Client ID of the application requesting to revoke the access token.
          type: string
          example: ly1nj6n11vionaie65emwzk575hnnmrk
        client_secret:
          description: The client secret of the application requesting to revoke an access token.
          type: string
          example: hOzsTeFlT6ko0dme22uGbQal04SBPYc1
        token:
          description: The access token to revoke.
          type: string
          format: token
          example: n22JPxrh18m4Y0wIZPIqYZK7VRrsMTWW
      required:
      - grant_type
      title: Token revocation request
    FileVersion--Base:
      description: The bare basic representation of a file version, the minimal amount of fields returned when using the `fields` query parameter.
      type: object
      properties:
        id:
          description: The unique identifier that represent a file version.
          type: string
          example: '12345'
        type:
          description: The value will always be `file_version`.
          type: string
          example: file_version
          enum:
          - file_version
      required:
      - id
      - type
      title: File version (Base)
      x-box-resource-id: file_version--base
      x-box-variant: base
      x-box-variants:
      - base
      - mini
      - standard
      - full
  securitySchemes:
    OAuth2Security:
      type: oauth2
      description: The access token received from the authorization server in the OAuth 2.0 flow.
      flows:
        authorizationCode:
          authorizationUrl: https://account.box.com/api/oauth2/authorize
          tokenUrl: https://api.box.com/oauth2/token
          scopes:
            root_readonly: Read all files and folders stored in Box
            root_readwrite: Read and write all files and folders stored in Box
            manage_app_users: Provision and manage app users
            manage_managed_users: Provision and manage managed users
            manage_groups: Manage an enterprise's groups
            manage_webhook: Create webhooks programmatically through the API
            manage_enterprise_properties: Manage enterprise properties
            manage_data_retention: Manage data retention polices
            manage_legal_hold: Manage Legal Holds
externalDocs:
  description: Box Developer Documentation.
  url: https://developer.box.com
x-mint:
  mcp:
    enabled: true
x-provenance:
  method: harvested
  publisher: Box
  source: https://developer.box.com/box-openapi.json
  note: split by refine-openapis from the provider's own published document, verified by fetch (openapi/_original/*.fetch.json);
    stamped by stamp-openapi-provenance.py (roadmap#793)