Current Box REST API reference for collisionspike archive integration, including server-side CCG authentication, folders, file requests, shared links, webhook signatures, retry behavior, and least-privilege scopes. Use when building or validating services/functions/box-webhook or an archive caller.
Current Box REST API reference for collisionspike archive integration, including server-side CCG authentication, folders, file requests, shared links, webhook signatures, retry behavior, and least-privilege scopes. Use when building or validating services/functions/box-webhook or an archive caller.
Box REST API
Use this skill for the current server-side archive integration. Read only the
reference needed for the task:
Mint the CCG token only in the archive function. Never expose credentials to a
browser or log them.
Use App Access Only with the minimum approved scopes (root_readwrite and
manage_webhook where webhook management is required).
Preserve the existing function routes and Data API contracts.
Treat the box:file:<file-id> source-message tag as the durable evidence
idempotency key. box_file_id is correlation data, not the dedup key.
Verify both webhook signatures in constant time inside the replay window.
Process the durable write before returning success. Return a retryable non-2xx
response for transient dependency failures because Box does not retry a 2xx.
User-facing product copy calls this integration Archive.
Implementation lives in services/functions/box-webhook; current environment
facts live in docs/operations/live-environment.md.
