Box Group Memberships API

openapi: 3.2.0
info:
  title: Box Platform Group memberships API
  description: Box Platform provides functionality to provide access to content stored within Box. It provides endpoints for basic manipulation of files and folders, management of users within an enterprise, as well as more complex topics such as legal holds and retention policies.
  termsOfService: https://cloud.app.box.com/s/rmwxu64h1ipr41u49w3bbuvbsa29wku9
  contact:
    name: Box, Inc
    url: https://developer.box.com
    email: devrel@box.com
  license:
    name: Apache-2.0
    url: https://www.apache.org/licenses/LICENSE-2.0
  version: '2024.0'
  x-box-commit-hash: 53bdced3cd
servers:
- url: https://api.box.com/2.0
  description: Box Platform API server.
security:
- OAuth2Security: []
tags:
- name: Group memberships
  description: Group memberships signify that a user is a part of the group.
  x-box-tag: memberships
paths:
  /users/{user_id}/memberships:
    get:
      operationId: get_users_id_memberships
      summary: List user's groups
      description: Retrieves all the groups for a user. Only members of this group or users with admin-level permissions will be able to use this API.
      parameters:
      - name: user_id
        in: path
        description: The ID of the user.
        required: true
        schema:
          type: string
        example: '12345'
      - name: limit
        in: query
        description: The maximum number of items to return per page.
        required: false
        schema:
          type: integer
          format: int64
          maximum: 1000
        example: 1000
      - name: offset
        in: query
        description: 'The offset of the item at which to begin the response.


          Queries with offset parameter value exceeding 10000 will be rejected with a 400 response.'
        required: false
        schema:
          type: integer
          format: int64
          default: 0
        example: 1000
      responses:
        '200':
          description: Returns a collection of membership objects. If there are no memberships, an empty collection will be returned.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/GroupMemberships'
        default:
          description: An unexpected client error.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ClientError'
      x-box-tag: memberships
      tags:
      - Group memberships
      x-codeSamples:
      - lang: curl
        label: List user's groups
        source: "curl -i -X GET \"https://api.box.com/2.0/users/12345/memberships\" \\\n     -H \"authorization: Bearer <ACCESS_TOKEN>\""
      - lang: dotnet
        label: List user's groups
        source: 'await client.Memberships.GetUserMembershipsAsync(userId: user.Id);'
      - lang: swift
        label: List user's groups
        source: 'try await client.memberships.getUserMemberships(userId: user.id)'
      - lang: java
        label: List user's groups
        source: client.getMemberships().getUserMemberships(user.getId())
      - lang: node
        label: List user's groups
        source: await client.memberships.getUserMemberships(user.id);
      - lang: python
        label: List user's groups
        source: client.memberships.get_user_memberships(user.id)
  /groups/{group_id}/memberships:
    get:
      operationId: get_groups_id_memberships
      summary: List members of group
      description: Retrieves all the members for a group. Only members of this group or users with admin-level permissions will be able to use this API.
      parameters:
      - name: group_id
        in: path
        description: The ID of the group.
        required: true
        schema:
          type: string
        example: '57645'
      - name: limit
        in: query
        description: The maximum number of items to return per page.
        required: false
        schema:
          type: integer
          format: int64
          maximum: 1000
        example: 1000
      - name: offset
        in: query
        description: 'The offset of the item at which to begin the response.


          Queries with offset parameter value exceeding 10000 will be rejected with a 400 response.'
        required: false
        schema:
          type: integer
          format: int64
          default: 0
        example: 1000
      responses:
        '200':
          description: Returns a collection of membership objects. If there are no memberships, an empty collection will be returned.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/GroupMemberships'
        default:
          description: An unexpected client error.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ClientError'
      x-box-tag: memberships
      tags:
      - Group memberships
      x-codeSamples:
      - lang: curl
        label: List members of group
        source: "curl -i -X GET \"https://api.box.com/2.0/groups/57645/memberships\" \\\n     -H \"authorization: Bearer <ACCESS_TOKEN>\""
      - lang: dotnet
        label: List members of group
        source: 'await client.Memberships.GetGroupMembershipsAsync(groupId: group.Id);'
      - lang: swift
        label: List members of group
        source: 'try await client.memberships.getGroupMemberships(groupId: group.id)'
      - lang: java
        label: List members of group
        source: client.getMemberships().getGroupMemberships(group.getId())
      - lang: node
        label: List members of group
        source: await client.memberships.getGroupMemberships(group.id);
      - lang: python
        label: List members of group
        source: client.memberships.get_group_memberships(group.id)
  /group_memberships:
    post:
      operationId: post_group_memberships
      summary: Add user to group
      description: Creates a group membership. Only users with admin-level permissions will be able to use this API.
      parameters:
      - name: fields
        in: query
        description: 'A comma-separated list of attributes to include in the response. This can be used to request fields that are not normally returned in a standard response.


          Be aware that specifying this parameter will have the effect that none of the standard fields are returned in the response unless explicitly specified, instead only fields for the mini representation are returned, additional to the fields requested.'
        required: false
        schema:
          type: array
          items:
            type: string
        example:
        - id
        - type
        - name
        explode: false
      requestBody:
        content:
          application/json:
            schema:
              type: object
              properties:
                user:
                  description: The user to add to the group.
                  type: object
                  properties:
                    id:
                      description: The ID of the user to add to the group.
                      type: string
                      example: '1434325'
                  required:
                  - id
                group:
                  description: The group to add the user to.
                  type: object
                  properties:
                    id:
                      description: The ID of the group to add the user to.
                      type: string
                      example: '4545523'
                  required:
                  - id
                role:
                  description: The role of the user in the group.
                  type: string
                  example: member
                  enum:
                  - member
                  - admin
                configurable_permissions:
                  description: 'Custom configuration for the permissions an admin if a group will receive. This option has no effect on members with a role of `member`.


                    Setting these permissions overwrites the default access levels of an admin.


                    Specifying a value of `null` for this object will disable all configurable permissions. Specifying permissions will set them accordingly, omitted permissions will be enabled by default.'
                  type:
                  - object
                  - 'null'
                  example:
                    can_run_reports: true
                  additionalProperties:
                    type: boolean
                    description: A key value pair of custom permissions.
                    example: true
                    x-box-example-key: can_run_reports
              required:
              - user
              - group
      responses:
        '201':
          description: Returns a new group membership object.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/GroupMembership'
        '403':
          description: 'Returns an error when the user cannot be added to a group.


            - `forbidden_by_policy`: Adding a user to a group is forbidden due to information barrier restrictions.'
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ClientError'
        default:
          description: An unexpected client error.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ClientError'
      x-box-tag: memberships
      tags:
      - Group memberships
      x-codeSamples:
      - lang: curl
        label: Add user to group
        source: "curl -i -X POST \"https://api.box.com/2.0/group_memberships\" \\\n     -H \"authorization: Bearer <ACCESS_TOKEN>\" \\\n     -H \"content-type: application/json\" \\\n     -d '{\n       \"user\": {\n         \"id\": \"1434325\"\n       },\n       \"group\": {\n         \"id\": \"4545523\"\n       }\n     }'"
      - lang: dotnet
        label: Add user to group
        source: 'await client.Memberships.CreateGroupMembershipAsync(requestBody: new CreateGroupMembershipRequestBody(user: new CreateGroupMembershipRequestBodyUserField(id: user.Id), group: new CreateGroupMembershipRequestBodyGroupField(id: group.Id)));'
      - lang: swift
        label: Add user to group
        source: 'try await client.memberships.createGroupMembership(requestBody: CreateGroupMembershipRequestBody(user: CreateGroupMembershipRequestBodyUserField(id: user.id), group: CreateGroupMembershipRequestBodyGroupField(id: group.id)))'
      - lang: java
        label: Add user to group
        source: client.getMemberships().createGroupMembership(new CreateGroupMembershipRequestBody(new CreateGroupMembershipRequestBodyUserField(user.getId()), new CreateGroupMembershipRequestBodyGroupField(group.getId())))
      - lang: node
        label: Add user to group
        source: "await client.memberships.createGroupMembership({\n  user: { id: user.id } satisfies CreateGroupMembershipRequestBodyUserField,\n  group: { id: group.id } satisfies CreateGroupMembershipRequestBodyGroupField,\n} satisfies CreateGroupMembershipRequestBody);"
      - lang: python
        label: Add user to group
        source: "client.memberships.create_group_membership(\n    CreateGroupMembershipUser(id=user.id), CreateGroupMembershipGroup(id=group.id)\n)"
  /group_memberships/{group_membership_id}:
    get:
      operationId: get_group_memberships_id
      summary: Get group membership
      description: Retrieves a specific group membership. Only admins of this group or users with admin-level permissions will be able to use this API.
      parameters:
      - name: group_membership_id
        in: path
        description: The ID of the group membership.
        required: true
        schema:
          type: string
        example: '434534'
      - name: fields
        in: query
        description: 'A comma-separated list of attributes to include in the response. This can be used to request fields that are not normally returned in a standard response.


          Be aware that specifying this parameter will have the effect that none of the standard fields are returned in the response unless explicitly specified, instead only fields for the mini representation are returned, additional to the fields requested.'
        required: false
        schema:
          type: array
          items:
            type: string
        example:
        - id
        - type
        - name
        explode: false
      responses:
        '200':
          description: Returns the group membership object.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/GroupMembership'
        default:
          description: An unexpected client error.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ClientError'
      x-box-tag: memberships
      tags:
      - Group memberships
      x-codeSamples:
      - lang: curl
        label: Get group membership
        source: "curl -i -X GET \"https://api.box.com/2.0/group_memberships/434534\" \\\n     -H \"authorization: Bearer <ACCESS_TOKEN>\""
      - lang: dotnet
        label: Get group membership
        source: 'await client.Memberships.GetGroupMembershipByIdAsync(groupMembershipId: NullableUtils.Unwrap(groupMembership.Id));'
      - lang: swift
        label: Get group membership
        source: 'try await client.memberships.getGroupMembershipById(groupMembershipId: groupMembership.id!)'
      - lang: java
        label: Get group membership
        source: client.getMemberships().getGroupMembershipById(groupMembership.getId())
      - lang: node
        label: Get group membership
        source: await client.memberships.getGroupMembershipById(groupMembership.id!);
      - lang: python
        label: Get group membership
        source: client.memberships.get_group_membership_by_id(group_membership.id)
    put:
      operationId: put_group_memberships_id
      summary: Update group membership
      description: Updates a user's group membership. Only admins of this group or users with admin-level permissions will be able to use this API.
      parameters:
      - name: group_membership_id
        in: path
        description: The ID of the group membership.
        required: true
        schema:
          type: string
        example: '434534'
      - name: fields
        in: query
        description: 'A comma-separated list of attributes to include in the response. This can be used to request fields that are not normally returned in a standard response.


          Be aware that specifying this parameter will have the effect that none of the standard fields are returned in the response unless explicitly specified, instead only fields for the mini representation are returned, additional to the fields requested.'
        required: false
        schema:
          type: array
          items:
            type: string
        example:
        - id
        - type
        - name
        explode: false
      requestBody:
        content:
          application/json:
            schema:
              type: object
              properties:
                role:
                  description: The role of the user in the group.
                  type: string
                  example: member
                  enum:
                  - member
                  - admin
                configurable_permissions:
                  description: 'Custom configuration for the permissions an admin if a group will receive. This option has no effect on members with a role of `member`.


                    Setting these permissions overwrites the default access levels of an admin.


                    Specifying a value of `null` for this object will disable all configurable permissions. Specifying permissions will set them accordingly, omitted permissions will be enabled by default.'
                  type:
                  - object
                  - 'null'
                  example:
                    can_run_reports: true
                  additionalProperties:
                    type: boolean
                    description: A key value pair of custom permissions.
                    example: true
                    x-box-example-key: can_run_reports
      responses:
        '200':
          description: Returns a new group membership object.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/GroupMembership'
        default:
          description: An unexpected client error.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ClientError'
      x-box-tag: memberships
      tags:
      - Group memberships
      x-codeSamples:
      - lang: curl
        label: Update group membership
        source: "curl -i -X PUT \"https://api.box.com/2.0/group_memberships/434534\" \\\n     -H \"authorization: Bearer <ACCESS_TOKEN>\" \\\n     -H \"content-type: application/json\" \\\n     -d '{\n       \"role\": \"admin\"\n     }'"
      - lang: dotnet
        label: Update group membership
        source: 'await client.Memberships.UpdateGroupMembershipByIdAsync(groupMembershipId: NullableUtils.Unwrap(groupMembership.Id), requestBody: new UpdateGroupMembershipByIdRequestBody() { Role = UpdateGroupMembershipByIdRequestBodyRoleField.Admin });'
      - lang: swift
        label: Update group membership
        source: 'try await client.memberships.updateGroupMembershipById(groupMembershipId: groupMembership.id!, requestBody: UpdateGroupMembershipByIdRequestBody(role: UpdateGroupMembershipByIdRequestBodyRoleField.admin))'
      - lang: java
        label: Update group membership
        source: client.getMemberships().updateGroupMembershipById(groupMembership.getId(), new UpdateGroupMembershipByIdRequestBody.Builder().role(UpdateGroupMembershipByIdRequestBodyRoleField.ADMIN).build())
      - lang: node
        label: Update group membership
        source: "await client.memberships.updateGroupMembershipById(groupMembership.id!, {\n  requestBody: {\n    role: 'admin' as UpdateGroupMembershipByIdRequestBodyRoleField,\n  } satisfies UpdateGroupMembershipByIdRequestBody,\n} satisfies UpdateGroupMembershipByIdOptionalsInput);"
      - lang: python
        label: Update group membership
        source: "client.memberships.update_group_membership_by_id(\n    group_membership.id, role=UpdateGroupMembershipByIdRole.ADMIN\n)"
    delete:
      operationId: delete_group_memberships_id
      summary: Remove user from group
      description: Deletes a specific group membership. Only admins of this group or users with admin-level permissions will be able to use this API.
      parameters:
      - name: group_membership_id
        in: path
        description: The ID of the group membership.
        required: true
        schema:
          type: string
        example: '434534'
      responses:
        '204':
          description: A blank response is returned if the membership was successfully deleted.
        default:
          description: An unexpected client error.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ClientError'
      x-box-tag: memberships
      tags:
      - Group memberships
      x-codeSamples:
      - lang: curl
        label: Remove user from group
        source: "curl -i -X DELETE \"https://api.box.com/2.0/group_memberships/434534\" \\\n     -H \"authorization: Bearer <ACCESS_TOKEN>\""
      - lang: dotnet
        label: Remove user from group
        source: 'await client.Memberships.DeleteGroupMembershipByIdAsync(groupMembershipId: NullableUtils.Unwrap(groupMembership.Id));'
      - lang: swift
        label: Remove user from group
        source: 'try await client.memberships.deleteGroupMembershipById(groupMembershipId: groupMembership.id!)'
      - lang: java
        label: Remove user from group
        source: client.getMemberships().deleteGroupMembershipById(groupMembership.getId())
      - lang: node
        label: Remove user from group
        source: await client.memberships.deleteGroupMembershipById(groupMembership.id!);
      - lang: python
        label: Remove user from group
        source: client.memberships.delete_group_membership_by_id(group_membership.id)
components:
  schemas:
    Group--Base:
      description: A base representation of a group.
      type: object
      properties:
        id:
          description: The unique identifier for this object.
          type: string
          example: '11446498'
        type:
          description: The value will always be `group`.
          type: string
          example: group
          enum:
          - group
      required:
      - id
      - type
      title: Group (Base)
      x-box-resource-id: group--base
      x-box-tag: groups
      x-box-variant: base
      x-box-variants:
      - base
      - mini
      - standard
      - full
    GroupMemberships:
      description: A list of group memberships.
      type: object
      allOf:
      - type: object
        description: The part of an API response that describes pagination.
        properties:
          total_count:
            description: 'One greater than the offset of the last entry in the entire collection. The total number of entries in the collection may be less than `total_count`.


              This field is only returned for calls that use offset-based pagination. For marker-based paginated APIs, this field will be omitted.'
            type: integer
            format: int64
            example: 5000
          limit:
            description: The limit that was used for these entries. This will be the same as the `limit` query parameter unless that value exceeded the maximum value allowed. The maximum value varies by API.
            type: integer
            format: int64
            example: 1000
          offset:
            description: 'The 0-based offset of the first entry in this set. This will be the same as the `offset` query parameter.


              This field is only returned for calls that use offset-based pagination. For marker-based paginated APIs, this field will be omitted.'
            type: integer
            format: int64
            example: 2000
          order:
            description: 'The order by which items are returned.


              This field is only returned for calls that use offset-based pagination. For marker-based paginated APIs, this field will be omitted.'
            type: array
            items:
              type: object
              description: The order in which a pagination is ordered.
              properties:
                by:
                  description: The field to order by.
                  type: string
                  example: type
                direction:
                  description: The direction to order by, either ascending or descending.
                  type: string
                  example: ASC
                  enum:
                  - ASC
                  - DESC
      - properties:
          entries:
            description: A list of group memberships.
            type: array
            items:
              $ref: '#/components/schemas/GroupMembership'
      title: Group memberships
      x-box-resource-id: group_memberships
      x-box-tag: memberships
    Group--Mini:
      description: Mini representation of a group, including id and name of group.
      type: object
      allOf:
      - $ref: '#/components/schemas/Group--Base'
      - properties:
          name:
            description: The name of the group.
            type: string
            example: Support
          group_type:
            description: The type of the group.
            type: string
            example: managed_group
            enum:
            - managed_group
            - all_users_group
      title: Group (Mini)
      x-box-resource-id: group--mini
      x-box-tag: groups
      x-box-variant: mini
    GroupMembership:
      description: Membership is used to signify that a user is part of a group.
      type: object
      properties:
        id:
          description: The unique identifier for this group membership.
          type: string
          example: '11446498'
        type:
          description: The value will always be `group_membership`.
          type: string
          example: group_membership
          enum:
          - group_membership
        user:
          allOf:
          - $ref: '#/components/schemas/User--Mini'
          - description: The user that the membership applies to.
        group:
          allOf:
          - $ref: '#/components/schemas/Group--Mini'
          - description: The group that the membership applies to.
        role:
          description: The role of the user in the group.
          type: string
          example: member
          enum:
          - member
          - admin
        created_at:
          description: The time this membership was created.
          type: string
          format: date-time
          example: '2012-12-12T10:53:43-08:00'
        modified_at:
          description: The time this membership was last modified.
          type: string
          format: date-time
          example: '2012-12-12T10:53:43-08:00'
      title: Group membership
      x-box-resource-id: group_membership
      x-box-tag: memberships
    ClientError:
      description: A generic error.
      type: object
      properties:
        type:
          description: The value will always be `error`.
          type: string
          example: error
          enum:
          - error
        status:
          description: The HTTP status of the response.
          type: integer
          format: int32
          example: 400
        code:
          description: A Box-specific error code.
          type: string
          example: item_name_invalid
          enum:
          - created
          - accepted
          - no_content
          - redirect
          - not_modified
          - bad_request
          - unauthorized
          - forbidden
          - not_found
          - method_not_allowed
          - conflict
          - precondition_failed
          - unprocessable_entity
          - too_many_requests
          - internal_server_error
          - unavailable
          - item_name_invalid
          - insufficient_scope
        message:
          description: A short message describing the error.
          type: string
          example: Method Not Allowed
        context_info:
          description: A free-form object that contains additional context about the error. The possible fields are defined on a per-endpoint basis. `message` is only one example.
          type:
          - object
          - 'null'
          example:
            message: Something went wrong
          additionalProperties: {}
        help_url:
          description: A URL that links to more information about why this error occurred.
          type: string
          example: https://developer.box.com/guides/api-calls/permissions-and-errors/common-errors/
        request_id:
          description: A unique identifier for this response, which can be used when contacting Box support.
          type: string
          example: abcdef123456
      title: Client error
      x-box-resource-id: client_error
    User--Mini:
      description: A mini representation of a user, as can be returned when nested within other resources.
      type: object
      allOf:
      - $ref: '#/components/schemas/User--Base'
      - properties:
          name:
            description: The display name of this user.
            type: string
            example: Aaron Levie
            maxLength: 50
          login:
            description: The primary email address of this user.
            type: string
            format: email
            example: ceo@example.com
      title: User (Mini)
      x-box-resource-id: user--mini
      x-box-tag: users
      x-box-variant: mini
    User--Base:
      description: A mini representation of a user, used when nested within another resource.
      type: object
      properties:
        id:
          description: The unique identifier for this user.
          type: string
          example: '11446498'
        type:
          description: The value will always be `user`.
          type: string
          example: user
          enum:
          - user
      required:
      - type
      - id
      title: User (Base)
      x-box-resource-id: user--base
      x-box-tag: users
      x-box-variant: base
      x-box-variants:
      - base
      - mini
      - standard
      - full
  securitySchemes:
    OAuth2Security:
      type: oauth2
      description: The access token received from the authorization server in the OAuth 2.0 flow.
      flows:
        authorizationCode:
          authorizationUrl: https://account.box.com/api/oauth2/authorize
          tokenUrl: https://api.box.com/oauth2/token
          scopes:
            root_readonly: Read all files and folders stored in Box
            root_readwrite: Read and write all files and folders stored in Box
            manage_app_users: Provision and manage app users
            manage_managed_users: Provision and manage managed users
            manage_groups: Manage an enterprise's groups
            manage_webhook: Create webhooks programmatically through the API
            manage_enterprise_properties: Manage enterprise properties
            manage_data_retention: Manage data retention polices
            manage_legal_hold: Manage Legal Holds
externalDocs:
  description: Box Developer Documentation.
  url: https://developer.box.com
x-mint:
  mcp:
    enabled: true
x-provenance:
  method: harvested
  publisher: Box
  source: https://developer.box.com/box-openapi.json
  note: split by refine-openapis from the provider's own published document, verified by fetch (openapi/_original/*.fetch.json);
    stamped by stamp-openapi-provenance.py (roadmap#793)