Current Box REST API reference for collisionspike archive integration, including server-side CCG authentication, folders, file requests, shared links, webhook signatures, retry behavior, and least-privilege scopes. Use when building or validating services/functions/box-webhook or an archive caller.
التثبيت
التثبيت باستخدام Codex أو Claude انسخ هذا Prompt والصقه في Codex أو Claude أو مساعد آخر ليراجع صفحة Skill ويثبّتها لك.
Current Box REST API reference for collisionspike archive integration, including server-side CCG authentication, folders, file requests, shared links, webhook signatures, retry behavior, and least-privilege scopes. Use when building or validating services/functions/box-webhook or an archive caller.
Box REST API
Use this skill for the current server-side archive integration. Read only the
reference needed for the task:
Mint the CCG token only in the archive function. Never expose credentials to a
browser or log them.
Use App Access Only with the minimum approved scopes (root_readwrite and
manage_webhook where webhook management is required).
Preserve the existing function routes and Data API contracts.
Treat the box:file:<file-id> source-message tag as the durable evidence
idempotency key. box_file_id is correlation data, not the dedup key.
Verify both webhook signatures in constant time inside the replay window.
Process the durable write before returning success. Return a retryable non-2xx
response for transient dependency failures because Box does not retry a 2xx.
User-facing product copy calls this integration Archive.
Implementation lives in services/functions/box-webhook; current environment
facts live in docs/operations/live-environment.md.
