Box package v1.0.0

An OAuth 2.0 access token for the customer's Box enterprise, held in the client's own secret manager. The stored material must be the complete Authorization header value: the scheme 'Bearer', one separating space, then the access token — 'Bearer <token>'. For the OAuth2 refresh flow, according to the reviewed guide, an external deployment process creates a Platform App in the Box Developer Console (OAuth 2.0 authentication method), copies its client_id and client_secret, drives the authorization redirect and user-consent flow, exchanges the returned authorization code at the token endpoint (POST https://api.box.com/oauth2/token with grant_type=authorization_code), and stores the resulting access-token header value under this reference.

The access token acts as the authorizing user and expires; the external process owns refresh (including any refresh token the grant returns) and renews the stored value before expiry — the injector injects the stored value verbatim and performs no OAuth itself. Token lifecycle from the retrieved token references (retrieved 2026-09-21): the refresh token is valid for 60 days, is single-use, and is rotated on every use — each refresh returns a new access token together with a new refresh token, so the external custody job must store the rotated pair every time or the chain breaks and the user must be re-authorized; and an access token can be revoked at any time by POSTing it (or the refresh token) with the app's client_id and client_secret to https://api.box.com/oauth2/revoke — the custody job should use that endpoint for explicit revocation on suspicion rather than relying on expiry.

The retrieved pages did not state the exact access-token lifetime or whether disabling the app in the Developer Console invalidates already-issued access tokens — confirm both against Box's token reference before enabling and treat disabling issuance as not necessarily invalidating already-issued tokens; an expired or revoked value fails closed.

Least privilege: configure the app with only the scopes these capabilities need, and note the retrieved guide's observation that the token is inherently tied to the authorizing user — authorize with a dedicated service account holding access only to the governed folders.

Executor hygiene: the value must live only in executor memory for the lifetime of a call, must never be written to logs, traces or diagnostics, and must not appear in crash dumps; a deployment that cannot meet that bar must not enable the pack.

The endpoint host 'box-api.invalid' is a reserved non-production placeholder (an RFC 2606 reserved TLD): substitute the real Box API host before enabling, in every endpoint, in the resource locator and in every egress allowlist entry — the reviewed documentation names the API host https://api.box.com with the /2.0 path prefix, and the OAuth2 token endpoint shares that host, so one placeholder covers both. The allowlist matches exactly, so endpoints and allowlist must be substituted together, and substitution is a required deployment step. FOLDER_ID and FILE_ID in the endpoint paths are placeholders the deployment binds before enabling; the reviewed documentation notes the root folder of a Box account is always ID 0.

Documented exclusions: this pack does not register collaborations (inviting a collaborator grants another party access to content — a share effect needing its own review), file upload, new-version upload, file copy, folder creation and watermarking, trash operations including permanent purge of trashed items (unrecoverable), retention policies and legal holds, user and enterprise administration, and the As-User impersonation header the retrieved OAuth2 guide mentions. The shared-link capability is registered only for files; creating shared links on folders is a deliberate exclusion — a folder link exposes everything the folder contains now and later, a larger and less reviewable blast radius.

Approval classification: shared-link creation declares update and share at the minimum R3 tier — the reviewed documentation shows access 'open' yields a public URL with a direct download_url, and disclosed information cannot be made private again once the other party has it. Endpoint scope: the shared-link capability is the general Update File PUT, so the exclusions above do not cover file moves or file metadata writes — both are reachable through that registered capability's unrestricted body (a parent change moves the file; name, description, tags and lock are writable), and policy, not intent, must constrain the access level and the other writable fields.

Folder deletion registers delete at R3 and the reviewed documentation shows the recursive query parameter deletes a non-empty folder and all of its content — high blast radius; the deployment should require per-request human approval for any recursive call.