Dropbox
Files and folders in your client's Dropbox, including uploads and downloads.
- Website
- dropbox.com
- Connects by
- Signing in with Dropbox
- Category
- Files and docs
- Services
- 1
- Tools
- 3
| Service | Key | Base URL |
|---|---|---|
| Dropbox | dropbox | https://api.dropboxapi.com/2 |
Connecting
Your client presses Connect, signs in to Dropbox, sees what the app will be able to do, and allows it.
curl https://api.operate.as/v1/me/clients \ -H "Authorization: Bearer $OPERATE_AS_API_KEY"[ { "id": "6f1c2a7e-...", "name": "Miller Dental", "services": [ "dropbox" ] }]Good to know
Two hosts, one service
Dropbox serves most calls from api.dropboxapi.com, but file uploads and downloads (such as files/upload and files/download) from content.dropboxapi.com. Start a pass-through path with @content/ to send it to the content host. Everything else goes to the usual address.
File details go in a header
Content calls take their arguments as JSON in the Dropbox-API-Arg header, not in the body. Operate As passes that header on to Dropbox. The body is the file's raw bytes.
Downloads come back as base64
A file isn't JSON, so the answer's data is the file's bytes base64-encoded, and the result says "encoding": "base64". Decode it to get the file.
Offline access, so it renews
Dropbox's access only lasts a short time. Operate As asks for offline access when your client signs in, so Dropbox also hands over a renewal key. That keeps the connection working without your client signing in again.
Permissions
| What the client reads | Permission it asks for |
|---|---|
| See the names of your files and folders | files.metadata.read |
| Open your files | files.content.read |
| Add and edit files | files.content.write |
Tools
Install Dropbox's typed package for your language:
pip install operate-as-dropboxdropbox.download_filecurl -X POST https://api.operate.as/v1/actions/dropbox.download_file \ -H "Authorization: Bearer $OPERATE_AS_API_KEY" \ -H "Content-Type: application/json" \ -d '{ "clientId": "6f1c2a7e-...", "input": { "path": "<path>" } }'| Input | Type | What it is |
|---|---|---|
pathrequired | string | The file, e.g. /Reports/october.csv |
{ "status": 200, "data": { "…": "the service's own response" }, "encoding": "json"}Pass-through
Dropbox's API takes POST for almost every call. Paths continue from https://api.dropboxapi.com/2, or from https://content.dropboxapi.com/2 when they start with @content/.
See Pass-through requests for the full request and response format.
POST /v1/clients/{clientId}/dropbox/files/list_folder
POST /v1/clients/{clientId}/dropbox/files/search_v2
POST /v1/clients/{clientId}/dropbox/@content/files/upload
POST /v1/clients/{clientId}/dropbox/@content/files/downloadPOST /v1/clients/{clientId}/dropbox/files/list_folder
Authorization: Bearer oa_...
Content-Type: application/json
{ "path": "" }When access ends
| How long access lasts | A few hours at a time. Operate As renews it before it runs out and checks every connection daily. |
| Renewal | Your client's approval, and the renewal key, last until it's revoked. |
| What ends it | Your client removes the app in their Dropbox settings. |
| When it's removed | We cancel the access with Dropbox too. |
See Keeping access alive and Removing access.
HTTP/1.1 409 ConflictContent-Type: application/json{ "detail": "Miller Dental's Dropbox access ended. Send them their link to reconnect."}{ "id": "evt_3f9a1c…", "type": "connection.expired", "createdAt": "2026-10-16T08:00:00+00:00", "data": { "clientId": "6f1c2a7e-...", "clientName": "Miller Dental", "provider": "dropbox", "services": [ "dropbox" ], "reconnectUrl": "https://…" }}