The Core API is the underlying interface for all of our official Dropbox mobile apps and our SDKs. It's the most direct way to access the API. This reference document is designed for those interested in developing for platforms not supported by the SDKs or for those interested in exploring API features in detail.
This API will evolve. Future versions of this API may add new endpoints or parameters. In order to keep older clients working, the behavior and return value of APIs with given parameter values will not change from the currently documented behavior and return values, with two important exceptions: currently undocumented request parameters (whether they are actually ignored or not) may be given a specific meaning, and objects returned in responses may contain additional keys in the future.
Thus, clients that want to be future-proof should avoid passing undocumented parameters (as they may cause different behavior in the future), and they should avoid strict checks on the keys of objects found in responses.
For example, you should not consider a /metadata response invalid if it contains additional keys besides those currently documented below.
We require that all requests are done over SSL.
Some API endpoints require a root folder path in the URL. The recommended option, auto
, automatically determines the appropriate root folder using your app's permission level as described in app types and permissions. Other options are sandbox
(the codename for app folder level) and dropbox
(full dropbox access).
Every string passed to and from the Dropbox API needs to be UTF-8 encoded. For maximum compatibility, normalize to Unicode Normalization Form C (NFC) before UTF-8 encoding.
All dates in the API are strings in the following format:
"Sat, 21 Aug 2010 22:31:20 +0000"
In code format, which can be used in all programming languages that support strftime
or strptime
:
"%a, %d %b %Y %H:%M:%S %z"
Dropbox uses the locale
parameter to specify language settings of content responses. If your app supports any language other than English, insert the appropriate IETF language tag. When a supported language is specified, Dropbox will returned translated size
and/or user_error
fields (where applicable).
Errors are returned using standard HTTP error code syntax. Any additional info is included in the body of the return call, JSON-formatted. Error codes not listed here are in the REST API methods listed below.
Code | Description |
---|---|
400 | Bad input parameter. Error message should indicate which one and why. |
401 | Bad or expired token. This can happen if the user or Dropbox revoked or expired an access token. To fix, you should re-authenticate the user. |
403 | Bad OAuth request (wrong consumer key, bad nonce, expired timestamp...). Unfortunately, re-authenticating the user won't help here. |
404 | File or folder not found at the specified path. |
405 | Request method not expected (generally should be GET or POST). |
429 | Your app is making too many requests and is being rate limited. 429s can trigger on a per-app or per-user basis. |
503 | If the response includes the Retry-After header, this means your OAuth 1.0 app is being rate limited. Otherwise, this indicates a transient server error, and your app should retry its request. |
507 | User is over Dropbox storage quota. |
5xx | Server error. Check DropboxOps. |
OAuth 1.0 continues to be supported for all API requests, but OAuth 2.0 is now preferred.
Step 1 of authentication. Obtain an OAuth request token to be used for the rest of the authentication process.
This method corresponds to Obtaining an Unauthorized Request Token in the OAuth Core 1.0 specification.
https://api.dropbox.com/1/oauth/request_token
There are no Dropbox-specific parameters for this method. See Consumer Obtains a Request Token in the OAuth Core 1.0 specification for a description of the OAuth parameters used for fetching a request token. Since this method is on behalf of an unauthenticated user, no access token or secret should be involved when signing or sending the request.
A request token and the corresponding request token secret, URL-encoded. This token/secret pair is meant to be used with /oauth/access_token
to complete the authentication process and cannot be used for any other API calls. See Service Provider Issues an Unauthorized Request Token in the OAuth Core 1.0 specification for additional discussion of the values returned when fetching a request token.
Sample response
oauth_token_secret=b9q1n5il4lcc&oauth_token=mh7an9dkrg59
Step 2 of authentication. Applications should direct the user to /oauth/authorize
. This isn't an API call per se, but rather a web endpoint that lets the user sign in to Dropbox and choose whether to grant the application the ability to access files on their behalf. Without the user's authorization in this step, it isn't possible for your application to obtain an access token from /oauth/access_token
.
This method corresponds to Obtaining User Authorization in the OAuth Core 1.0 specification.
https://www.dropbox.com/1/oauth/authorize
Note: This is the only step that requires an endpoint on www.dropbox.com
. All other API requests are done via api.dropbox.com
, api-content.dropbox.com
, or api-notify.dropbox.com
. The user must be redirected to the Dropbox website over HTTPS. After the user decides whether or not to authorize your application, they will be redirected to the URL specified by oauth_callback
(more on that below).
/oauth/request_token
.Because the application doesn't call /oauth/authorize
directly, there is no direct return value. After the user authorizes the application, the request token can be used to retrieve an access token via the /oauth/access_token
API call. If the oauth_callback
parameter is omitted, the application must find some other way of determining when the authorization step is complete. For example, the application can have the user explicitly indicate to it that this step is complete, but this flow may be less intuitive for users than the redirect flow.
If oauth_callback
is specified and the user authorizes the application, they will get redirected to the specified URL with the following additional URL query parameters appended:
If the user chooses not to authorize the application, they will get redirected to the oauth_callback
URL with the additional URL query parameter not_approved=true.
Step 3 of authentication. After the /oauth/authorize
step is complete, the application can call /oauth/access_token
to acquire an access token.
This method corresponds to Obtaining an Access Token in the OAuth Core 1.0 specification.
https://api.dropbox.com/1/oauth/access_token
There are no Dropbox-specific parameters for this method. See Consumer Requests an Access Token in the OAuth Core 1.0 specification for a description of the parameters used for fetching an access token. Note that the oauth_token
and oauth_token_secret
for this method are the request token and request token secret obtained previously via /oauth/request_token
.
URL-encoded access token, access token secret, and Dropbox user id. Upon return, the authorization process is now complete and the access token and corresponding secret can be used to sign requests for the main API calls. See Service Provider Grants an Access Token in the OAuth Core 1.0 specification for additional discussion of the values returned when fetching an access token. If your app is configured to work within an app folder, that folder is also created during this step.
Sample response
oauth_token_secret=95grkd9na7hm&oauth_token=ccl4li5n1q9b&uid=100
Dropbox supports OAuth 2.0 for authenticating all API requests.
This starts the OAuth 2.0 authorization flow. This isn't an API call—it's the web page that lets the user sign in to Dropbox and authorize your app. After the user decides whether or not to authorize your app, they will be redirected to the URI specified by redirect_uri
.
OAuth 2.0 supports two authorization flows:
code
flow returns a code via the redirect_uri
callback which should then be converted into a bearer token using the /oauth2/token
call. This is the recommended flow for apps that are running on a server.token
or implicit grant flow returns the bearer token via the redirect_uri
callback, rather than requiring your app to make a second call to a server. This is useful for pure client-side apps, such as mobile apps or JavaScript-based apps.For more information on the two flows, see Section 1.3 of the OAuth 2 spec.
https://www.dropbox.com/1/oauth2/authorize
Note: This is the only step that requires an endpoint on www.dropbox.com
. All other API requests are done via api.dropbox.com
, api-content.dropbox.com
, or api-notify.dropbox.com
.
token
or code
.token
flow, but optional for code
. If the redirect URI is omitted, the code
will be presented directly to the user and they will be invited to enter the information in your app.false
(default), a user who has already approved the application may be automatically redirected to the URI specified by redirect_uri
. If true
, the user will not be automatically redirected and will have to approve the app again.Because /oauth2/authorize
is a website, there is no direct return value. However, after the user authorizes your app, they will be sent to your redirect URI. The type of response varies based on the response_type
.
These parameters are passed in the query string (after the ? in the URL):
/oauth2/token
./oauth2/authorize
.Sample response
[REDIRECT_URI]?code=ABCDEFG&state=[STATE]
These parameters are passed in the URL fragment (after the # in the URL):
bearer
./oauth2/authorize
.Sample response
[REDIRECT_URI]#access_token=ABCDEFG&token_type=bearer&uid=12345&state=[STATE]
In either flow, if an error occurs, including if the user has chosen not to authorize the app, the following parameters will be included in the redirect URI:
/oauth2/authorize
.This endpoint only applies to apps using the authorization code flow. An app calls this endpoint to acquire a bearer token once the user has authorized the app.
Calls to /oauth2/token
need to be authenticated using the apps's key and secret. These can either be passed as POST parameters (see parameters below) or via HTTP basic authentication. If basic authentication is used, the app key should be provided as the username, and the app secret should be provided as the password.
https://api.dropbox.com/1/oauth2/token
/oauth2/authorize?response_type=code
.authorization_code
.POST
parameters, this parameter should be present and should be the app's key (found in the App Console).POST
parameters, this parameter should be present and should be the app's secret./oauth2/authorize
, not used to redirect again.A JSON-encoded dictionary including an access token (access_token
), token type (token_type
), and Dropbox user ID (uid). The token type will always be "bearer".
Sample response
{"access_token": "ABCDEFG", "token_type": "bearer", "uid": "12345"}
This endpoint should be used by apps transitioning from OAuth 1 to OAuth 2. It will return an OAuth 2 token for the authenticated user.
Calls to /oauth2/token_from_oauth1
must be authenticated via OAuth 1.
https://api.dropbox.com/1/oauth2/token_from_oauth1
A JSON-encoded dictionary including an access token (access_token
) and a token type (token_type
). The token type will always be "bearer".
Sample response
{"access_token": "ABCDEFG", token_type: "bearer"}
https://api.dropbox.com/1/account/info
User account information.
Sample JSON response
{ "uid": 12345678, "display_name": "John User", "name_details": { "familiar_name": "John", "given_name": "John", "surname": "User" }, "referral_link": "https://www.dropbox.com/referrals/r1a2n3d4m5s6t7", "country": "US", "locale": "en", "is_paired": false, "team": { "name": "Acme Inc.", "team_id": "dbtid:1234abcd" }, "quota_info": { "shared": 253738410565, "quota": 107374182400000, "normal": 680031877871 } }
Return value definitions
field | description |
---|---|
uid | The user's unique Dropbox ID. |
display_name | The user's display name. |
name_details/given_name | The user's given name. |
name_details/surname | The user's surname. |
name_details/familiar_name | The locale-dependent familiar name for the user. |
referral_link | The user's referral link. |
country | The user's two-letter country code, if available. |
locale | Locale preference set by the user (e.g. en-us). |
is_paired | If true , there is a paired account associated with this user. |
team | If the user belongs to a team, contains team information. Otherwise, null. |
team/name | The name of the team the user belongs to. |
team/team_id | The ID of the team the user belongs to. |
quota_info/normal | The user's used quota outside of shared folders (bytes). |
quota_info/shared | The user's used quota in shared folders (bytes). |
quota_info/quota | The user's total quota allocation (bytes). |
Downloads a file. Note that this call goes to api-content.dropbox.com instead of api.dropbox.com.
https://api-content.dropbox.com/1/files/auto/<path>
The specified file's contents at the requested revision.
The HTTP response contains the content metadata in JSON format within an x-dropbox-metadata
header.
404 | The file wasn't found at the specified path, or wasn't found at the specified rev . |
This method also supports HTTP Range Retrieval Requests to allow retrieving partial file contents.
Uploads a file using PUT semantics. Note that this call goes to api-content.dropbox.com instead of api.dropbox.com.
The preferred HTTP method for this call is PUT. For compatibility with browser environments, the POST HTTP method is also recognized.
Note: Providing a Content-Length
header set to the size of the uploaded file is required so that the server can verify that it has received the entire file contents.
https://api-content.dropbox.com/1/files_put/auto/<path>?param=val
required The file contents to be uploaded. Since the entire PUT body will be treated as the file, any parameters must be passed as part of the request URL. The request URL should be signed just as you would sign any other OAuth request URL.
size
field translated based on the given locale.true
(default) or false
, determines whether an existing file will be overwritten by this upload. If true
, any existing file will be overwritten. If false
, the other parameters determine whether a conflict occurs and how that conflict is resolved.parent_rev
matches the latest version of the file on the user's Dropbox, that file will be replaced. Otherwise, a conflict will occur. (See below.) If you specify a parent_rev
and that revision doesn't exist, the file won't save (error 400). You can get the most recent rev
by performing a call to /metadata.true
(default) or false
, determines what happens when there is a conflict. If true
, the file being uploaded will be automatically renamed to avoid the conflict. (For example, test.txt might be automatically renamed to test (1).txt.) The new name can be obtained from the returned metadata. If false
, the call will fail with a 409 (Conflict) response code.The metadata for the uploaded file. More information on the returned metadata fields are available here.
Sample JSON response
{ "size": "225.4KB", "rev": "35e97029684fe", "thumb_exists": false, "bytes": 230783, "modified": "Tue, 19 Jul 2011 21:55:38 +0000", "path": "/Getting_Started.pdf", "is_dir": false, "icon": "page_white_acrobat", "root": "dropbox", "mime_type": "application/pdf", "revision": 220823 }
409 | The call failed because a conflict occurred. This means a file already existed at the specified path, overwrite was false, and the parent_rev (if specified) didn't match the current rev . |
411 | Missing Content-Length header (this endpoint doesn't support HTTP chunked transfer encoding). |
/files_put
has a maximum file size limit of 150 MB and does not support uploads with chunked encoding. To upload larger files, use /chunked_upload
instead.
https://api.dropbox.com/1/metadata/auto/<path>
/metadata
on a folder will return a hash
field, generated by hashing all of the metadata contained in that response. On later calls to /metadata
, you should provide that value via this parameter so that if nothing has changed, the response will be a 304 (Not Modified) status code instead of the full, potentially very large, folder listing. This parameter is ignored if the specified path is associated with a file or if list=false
.true
and false
are valid values. true
is the default. If true
, the folder's metadata will include a contents
field with a list of metadata entries for the contents of the folder. If false
, the contents
field will be omitted.list
is set. If this parameter is set to true, then contents
will include the metadata of deleted children. Note that the target of the metadata call is always returned even when it has been deleted (with is_deleted
set to true) regardless of this flag.size
field translated based on the given locale. For more information see above.photo_info
dictionary for photos and a video_info
dictionary for videos with additional media info. If the data isn't available yet, the string pending
will be returned instead of a dictionary.The metadata for the file or folder at the given <path>
. If <path>
represents a folder and the list
parameter is true
, the metadata will also include a listing of metadata for the folder's contents.
Sample JSON return value for a file
{ "size": "225.4KB", "rev": "35e97029684fe", "thumb_exists": false, "bytes": 230783, "modified": "Tue, 19 Jul 2011 21:55:38 +0000", "client_mtime": "Mon, 18 Jul 2011 18:04:35 +0000", "path": "/Getting_Started.pdf", "is_dir": false, "icon": "page_white_acrobat", "root": "dropbox", "mime_type": "application/pdf", "revision": 220823 }
Sample JSON return value for a folder when list
parameter is set to true
. If list
is false
the contents
key will simply be omitted from the result.
{ "size": "0 bytes", "hash": "37eb1ba1849d4b0fb0b28caf7ef3af52", "bytes": 0, "thumb_exists": false, "rev": "714f029684fe", "modified": "Wed, 27 Apr 2011 22:18:51 +0000", "path": "/Photos", "is_dir": true, "icon": "folder", "root": "dropbox", "contents": [ { "size": "2.3 MB", "rev": "38af1b183490", "thumb_exists": true, "bytes": 2453963, "modified": "Mon, 07 Apr 2014 23:13:16 +0000", "client_mtime": "Thu, 29 Aug 2013 01:12:02 +0000", "path": "/Photos/flower.jpg", "photo_info": { "lat_long": [ 37.77256666666666, -122.45934166666667 ], "time_taken": "Wed, 28 Aug 2013 18:12:02 +0000" }, "is_dir": false, "icon": "page_white_picture", "root": "dropbox", "mime_type": "image/jpeg", "revision": 14511 } ], "revision": 29007 }
Return value definitions
field | description |
---|---|
size | A human-readable description of the file size (translated by locale ). |
bytes | The file size in bytes. |
path | Returns the canonical path to the file or folder. |
is_dir | Whether the given entry is a folder or not. |
is_deleted | Whether the given entry is deleted (only included if deleted files are being returned). |
rev | A unique identifier for the current revision of a file. This field is the same rev as elsewhere in the API and can be used to detect changes and avoid conflicts. |
hash | A folder's hash is useful for indicating changes to the folder's contents in later calls to /metadata . This is roughly the folder equivalent to a file's rev . |
thumb_exists | True if the file is an image that can be converted to a thumbnail via the /thumbnails call. |
photo_info | Only returned when the include_media_info parameter is true and the file is an image. A dictionary that includes the creation time (time_taken ) and the GPS coordinates (lat_long ). |
video_info | Only returned when the include_media_info parameter is true and the file is a video. A dictionary that includes the creation time (time_taken ), the GPS coordinates (lat_long ), and the length of the video in milliseconds (duration ). |
icon | The name of the icon used to illustrate the file type in Dropbox's icon library. |
modified | The last time the file was modified on Dropbox, in the standard date format (not included for the root folder). |
client_mtime | For files, this is the modification time set by the desktop client when the file was added to Dropbox, in the standard date format. Since this time is not verified (the Dropbox server stores whatever the desktop client sends up), this should only be used for display purposes (such as sorting) and not, for example, to determine if a file has changed or not. |
root | The root or top-level folder depending on your access level. All paths returned are relative to this root level. Permitted values are either dropbox or app_folder . |
revision | A deprecated field that semi-uniquely identifies a file. Use rev instead. |
shared_folder | This field will be included for shared folders. The value is a dictionary with the field id . If the include_membership parameter is passed, there will additionally be a membership field and a groups field. See /shared_folders for a sample shared folder response. |
read_only | For shared folders, this field specifies whether the user has read-only access to the folder. For files within a shared folder, this specifies the read-only status of the parent shared folder. |
parent_shared_folder_id | For files within a shared folder, this field specifies the ID of the containing shared folder. |
modifier | For files within a shared folder, this field specifies which user last modified this file. The value is a user dictionary with the fields uid (user ID), display_name , and, if the linked account is a member of a Dropbox for Business team, same_team (whether the user is on the same team as the linked account). If this endpoint is called by a Dropbox for Business app and the user is on that team, a member_id field will also be present in the user dictionary. If the modifying user no longer exists, the value will be null. |
Note: modified
, rev
, and revision
aren't returned in the metadata for the root/top-level path.
304 | The folder contents have not changed (relies on hash parameter). |
406 | There are too many file entries to return. |
/delta
to get a list of "delta entries", which are instructions on how to update your local state to match the server's state.https://api.dropbox.com/1/delta
size
field translated based on the given locale. For more information see above.path_prefix
of "/Photos/Vacation" will return entries for the path "/Photos/Vacation" and any files and folders under that path. If you use the path_prefix
parameter, you must continue to pass the correct prefix on subsequent calls using the returned cursor. You can switch the path_prefix
on any existing cursor to a descendant of the existing path_prefix
on subsequent calls to /delta
. For example if your cursor has no path_prefix
, you can switch to any path_prefix
. If your cursor has a path_prefix
of "/Photos", you can switch it to "/Photos/Vacaction".photo_info
dictionary for photos and a video_info
dictionary for videos with additional media info. When include_media_info
is specified, files will only appear in delta responses when the media info is ready. If you use the include_media_info
parameter, you must continue to pass the same value on subsequent calls using the returned cursor.A JSON object with four fields:
true
, clear your local state before processing the delta entries. reset
is always true
on the initial call to /delta
(i.e. when no cursor is passed in). Otherwise, it is true
in rare situations, such as after server or account maintenance, or if a user deletes their app folder./delta
, pass in this value.true
, then there are more entries available; you can call /delta
again immediately to retrieve those entries. If 'false', then wait for at least five minutes (preferably longer) before checking again.Each delta entry is a 2-item list of one of the following forms:
[<path>, <metadata>]
- Indicates that there is a file/folder at the given path. You should add the entry to your local state. The metadata value is the same as what would be returned by the /metadata
call, except folder metadata doesn't have hash
or contents
fields. To correctly process delta entries:<path>
. If it's a file, replace it with the new entry. If it's a folder, apply the new <metadata>
to the folder, but don't modify the folder's children. If your local state doesn't yet include this path, create it as a folder.read-only
field set to true
, apply the read-only permission recursively to all files within the shared folder.[<path>, null]
- Indicates that there is no file/folder at the given path. To update your local state to match, anything at path and all its children should be deleted. Deleting a folder in your Dropbox will sometimes send down a single deleted entry for that folder, and sometimes separate entries for the folder and all child paths. If your local state doesn't have anything at path, ignore this entry.Note: Dropbox treats file names in a case-insensitive but case-preserving way. To facilitate this, the <path>
values above are lower-cased versions of the actual path. The last path component of the <metadata>
value will be case-preserved.
A way to quickly get a cursor for the server's state, for use with /delta. Unlike /delta, /delta/latest_cursor
does not return any entries, so your app will not know about any existing files or folders in the Dropbox account. For example, if your app processes future delta entries and sees that a folder was deleted, your app won't know what files were in that folder. Use this endpoint if your app only needs to know about new files and modifications and doesn't need to know about files that already exist in Dropbox.
If you need to build local state to match the server state in Dropbox, you should instead use /delta.
https://api.dropbox.com/1/delta/latest_cursor
A JSON object with one field:
has_more
is false
.A long-poll endpoint to wait for changes on an account. In conjunction with /delta, this call gives you a low-latency way to monitor an account for file changes.
Note that this call goes to api-notify.dropbox.com instead of api.dropbox.com.
Unlike most other API endpoints, this call does not require OAuth authentication. The passed in cursor
can only be acquired via an authenticated call to /delta.
https://api-notify.dropbox.com/1/longpoll_delta
include_media_info=true
is incompatible with /longpoll_delta and an error will be returned.The connection will block until there are changes available or a timeout occurs. In both cases, the HTTP status code will be 200, and the response will be a JSON dictionary. The value of the changes
field indicates whether new changes are available. If this value is true, you should call /delta to retrieve the changes. If this value is false, it means the call to /longpoll_delta
timed out.
If present, the value of the backoff
field indicates how many seconds your code should wait before calling /longpoll_delta
again.
Sample JSON return value
{"changes": false, "backoff": 60}
400 | One or more parameters were invalid. The response will be of the form {"error": "<reason>"} . |
Obtains metadata for the previous revisions of a file.
Only revisions up to thirty days old are available (or more if the Dropbox user has Packrat). You can use the revision number in conjunction with the /restore
call to revert the file to its previous state.
https://api.dropbox.com/1/revisions/auto/<path>
size
field translated based on the given locale. For more information see above.A list of revisions formatted just like file metadata. More information on the returned metadata fields are available here.
Sample JSON return value
[ { "is_deleted": true, "revision": 4, "rev": "40000000d", "thumb_exists": false, "bytes": 0, "modified": "Wed, 20 Jul 2011 22:41:09 +0000", "path": "/hi2", "is_dir": false, "icon": "page_white", "root": "app_folder", "mime_type": "application/octet-stream", "size": "0 bytes" }, { "revision": 1, "rev": "10000000d", "thumb_exists": false, "bytes": 3, "modified": "Wed, 20 Jul 2011 22:40:43 +0000", "path": "/hi2", "is_dir": false, "icon": "page_white", "root": "app_folder", "mime_type": "application/octet-stream", "size": "3 bytes" } ]
Restores a file path to a previous revision.
Unlike downloading a file at a given revision and then re-uploading it, this call is atomic. It also saves a bunch of bandwidth.
https://api.dropbox.com/1/restore/auto/<path>
size
field translated based on the given locale. For more information see above.The metadata of the restored file. More information on the returned metadata fields are available here.
Sample JSON response
{ "is_deleted": true, "revision": 4, "rev": "40000000d", "thumb_exists": false, "bytes": 0, "modified": "Wed, 20 Jul 2011 22:41:09 +0000", "path": "/hi2", "is_dir": false, "icon": "page_white", "root": "sandbox", "mime_type": "application/octet-stream", "size": "0 bytes" }
404 | Unable to find the revision at that path |
Returns metadata for all files and folders whose filename contains the given search string as a substring.
Searches are limited to the folder path and its sub-folder hierarchy provided in the call.
https://api.dropbox.com/1/search/auto/<path>
file_limit
search results will be returned.size
field translated based on the given locale. For more information see above.List of metadata entries for any matching files and folders. More information on the returned metadata fields are available here.
Sample JSON return value for a search for .txt in Dropbox/Public folder
[ { "size": "0 bytes", "rev": "35c1f029684fe", "thumb_exists": false, "bytes": 0, "modified": "Mon, 18 Jul 2011 20:13:43 +0000", "path": "/Public/latest.txt", "is_dir": false, "icon": "page_white_text", "root": "dropbox", "mime_type": "text/plain", "revision": 220191 } ]
Creates and returns a shared link to a file or folder.
https://api.dropbox.com/1/shares/auto/<path>
true
(default), the URL returned will be shortened using the Dropbox URL shortener. If false
, the URL will link directly to the file's preview page.A JSON dictionary containing a shared link as well as information about the link's visibility and expiration. The url
field contains the actual shared link URL. The expires
field returns the link's expiration in the Dropbox API's usual date format. Dropbox for Business users can set restrictions on shared links; the visibility
field indicates what (if any) restrictions are set on this particular link. Possible values include: "PUBLIC
" (anyone can view), "TEAM_ONLY
" (only the owner's team can view), "PASSWORD
" (a password is required), "TEAM_AND_PASSWORD
" (a combination of "TEAM_ONLY
" and "PASSWORD
" restrictions), or "SHARED_FOLDER_ONLY
" (only members of the enclosing shared folder can view). Note that other values may be added at any time.
Sample JSON return value for a file
{ "url": "https://db.tt/c0mFuu1Y", "expires": "Tue, 01 Jan 2030 00:00:00 +0000", "visibility": "PUBLIC" }
Returns a link directly to a file.
Similar to /shares
. The difference is that this bypasses the Dropbox webserver, used to provide a preview of the file, so that you can effectively stream the contents of your media. This URL should not be used to display content directly in the browser.
https://api.dropbox.com/1/media/auto/<path>
A url that serves the media directly. Also returns the link's expiration date in Dropbox's usual date format.
Sample JSON return value for a file
{ "url": "https://dl.dropboxusercontent.com/1/view/abcdefghijk/example", "expires": "Fri, 16 Sep 2011 01:01:25 +0000" }
/media
link expires after four hours, allotting enough time to stream files, but not enough to leave a connection open indefinitely.Creates and returns a copy_ref to a file. This reference string can be used to copy that file to another user's Dropbox by passing it in as the from_copy_ref
parameter on /fileops/copy.
https://api.dropbox.com/1/copy_ref/auto/<path>
A copy_ref to the specified file. For compatibility reasons, it returns the link's expiration date in Dropbox's usual date format. All links are currently set to expire far enough in the future so that expiration is effectively not an issue.
Sample JSON return value for a file
{ "copy_ref": "z1X6ATl6aWtzOGq0c3g5Ng", "expires": "Fri, 31 Jan 2042 21:01:05 +0000" }
https://api-content.dropbox.com/1/thumbnails/auto/<path>
jpeg
(default) or png
. For images that are photos, jpeg
should be preferred, while png
is better for screenshots and digital art.size One of the following values (default: s
):
value | dimensions (px) |
---|---|
xs | 32x32 |
s | 64x64 |
m | 128x128 |
l | 640x480 |
xl | 1024x768 |
A thumbnail of the specified image's contents. The image returned may be larger or smaller than the size requested, depending on the size and aspect ratio of the original image.
The HTTP response contains the content metadata in JSON format within an x-dropbox-metadata
header.
404 | The file path wasn't found or the file extension doesn't allow conversion to a thumbnail. |
415 | The image is invalid and cannot be converted to a thumbnail. |
This method currently supports files with the following file extensions: "jpg", "jpeg", "png", "tiff", "tif", "gif", and "bmp".
Photos that are larger than 20MB in size won't be converted to a thumbnail.
Gets a preview for a file. Note that this call goes to api-content.dropbox.com instead of api.dropbox.com.
https://api-content.dropbox.com/1/previews/auto/<path>
Data that represents a preview of the file. The Content-Type
header will be either application/pdf
or text/html
. There is a Original-Content-Length
header which contains the size of the preview data.
404 | The file wasn't found at the specified path, or wasn't found at the specified rev . |
409 | No preview has been generated yet or unable to generate a preview for the file. |
Previews are only generated for the files with the following extensions: .doc, .docx, .docm, .ppt, .pps, .ppsx, .ppsm, .pptx, .pptm, .xls, .xlsx, .xlsm, .rtf, .pdf
Uploads large files to Dropbox in multiple chunks. Also has the ability to resume if the upload is interrupted. This allows for uploads larger than the /files_put
maximum of 150 MB.
Typical usage:
/chunked_upload
with the first chunk of the file without setting upload_id, and receive an upload_id in return./commit_chunked_upload
to complete the upload.Chunks can be any size up to 150 MB. A typical chunk is 4 MB. Using large chunks will mean fewer calls to /chunked_upload
and faster overall throughput. However, whenever a transfer is interrupted, you will have to resume at the beginning of the last chunk, so it is often safer to use smaller chunks.
If the offset you submit does not match the expected offset on the server, the server will ignore the request and respond with a 400 error that includes the current offset. To resume upload, seek to the correct offset (in bytes) within the file and then resume uploading from that point.
A chunked upload can take a maximum of 48 hours before expiring.
https://api-content.dropbox.com/1/chunked_upload?param=val
required A chunk of data from the file being uploaded. If resuming, the chunk should begin at the number of bytes into the file that equals the offset.
Sample JSON response
{ "upload_id": "v0k84B0AT9fYkfMUp0sBTA", "offset": 31337, "expires": "Tue, 19 Jul 2011 21:55:38 +0000" }
404 | The upload_id does not exist or has expired. |
400 | The offset parameter does not match up with what the server expects. The body of the error response will be JSON similar to the above, indicating the correct offset to upload. |
Completes an upload initiated by the /chunked_upload
method. Saves a file uploaded via /chunked_upload
to a user's Dropbox.
/commit_chunked_upload
is similar to /files_put
. The main difference is that while /files_put
takes the file contents in the request body, /commit_chunked_upload
takes a parameter upload_id
, which is obtained when the file contents are uploaded via /chunked_upload
.
Note that this call goes to api-content.dropbox.com instead of api.dropbox.com.
https://api-content.dropbox.com/1/commit_chunked_upload/auto/<path>
size
field translated based on the given locale.true
(default) or false
, determines whether an existing file will be overwritten by this upload. If true
, any existing file will be overwritten. If false
, the other parameters determine whether a conflict occurs and how that conflict is resolved.parent_rev
matches the latest version of the file on the user's Dropbox, that file will be replaced. Otherwise, a conflict will occur. (See below.) If you specify a parent_rev
and that revision doesn't exist, the file won't save (error 400). You can get the most recent rev
by performing a call to /metadata.true
(default) or false
, determines what happens when there is a conflict. If true
, the file being uploaded will be automatically renamed to avoid the conflict. (For example, test.txt might be automatically renamed to test (1).txt.) The new name can be obtained from the returned metadata. If false
, the call will fail with a 409 (Conflict) response code.The metadata for the uploaded file. More information on the returned metadata fields are available here.
Sample JSON response
{ "size": "225.4KB", "rev": "35e97029684fe", "thumb_exists": false, "bytes": 230783, "modified": "Tue, 19 Jul 2011 21:55:38 +0000", "path": "/Getting_Started.pdf", "is_dir": false, "icon": "page_white_acrobat", "root": "dropbox", "mime_type": "application/pdf", "revision": 220823 }
409 | The call failed because a conflict occurred. This means a file already existed at the specified path, overwrite was false, and the parent_rev (if specified) didn't match the current rev . |
400 | Returned if the request does not contain an upload_id or if there is no chunked upload matching the given upload_id. |
Returns a list of all shared folders the authenticated user has access to or metadata about a specific shared folder.
This API call requires Full Dropbox or File type permissions.
https://api.dropbox.com/1/shared_folders/<shared_folder_id>
shared_folder_id
is specified. If true, include a list of members and a list of groups for the shared folder.A list of shared folders metadata objects, or the metadata for a specific shared folder if the shared_folder_id
parameter is specified.
Note that same_team
is only present if the linked account is a member of a Dropbox for Business team, and member_id
is only present when this endpoint is called by a Dropbox for Business app and the user is on that team.
The membership
field only contains users who have joined the shared folder and does not include users who have been invited but have not accepted. When the active
field is false, it means that a user has left a shared folder (but may still rejoin).
[ { "shared_folder_id": "...", "shared_folder_name": "test", "path": "...", "access_type": "editor", "shared_link_policy": "all", "owner": { ... }, "groups": [...], "membership": [ { "user": { "uid": 87654321, "display_name": "Jane P. User", "same_team": true, "member_id": "dbmid:abcd1234" }, "access_type": "owner", "active": true }, ... ] }, ... ]
400 | Returned if the shared folder ID is not valid. |
403 | Returned if this app does not have Full Dropbox or File type permissions, or if the user doesn't have access to the specified shared folder. |
The various fileops
calls provide the standard file operations. Files and folders can be moved, copied, or deleted. Folders can be created.
https://api.dropbox.com/1/fileops/copy
from_path
and to_path
are specified. Valid values are auto
(recommended), sandbox
, and dropbox
.root
.root
.size
field translated based on the given locale. For more information see above.from_path
parameter.Metadata for the copy of the file or folder. More information on the returned metadata fields are available here.
Sample JSON response
{ "size": "15 bytes", "rev": "1f0a503351f", "thumb_exists": false, "bytes": 15, "modified": "Wed, 10 Aug 2011 18:21:29 +0000", "path": "/test1.txt", "is_dir": false, "icon": "page_white_text", "root": "dropbox", "mime_type": "text/plain", "revision": 496342 }
403 | An invalid copy operation was attempted (e.g. there is already a file at the given destination, or trying to copy a shared folder). |
404 | The source file wasn't found at the specified path. |
406 | Too many files would be involved in the operation for it to complete successfully. The limit is currently 10,000 files and folders. |
https://api.dropbox.com/1/fileops/create_folder
path
is specified. Valid values are auto
(recommended), sandbox
, and dropbox
.root
.size
field translated based on the given locale. For more information see above.Metadata for the new folder. More information on the returned metadata fields are available here.
Sample JSON response
{ "size": "0 bytes", "rev": "1f477dd351f", "thumb_exists": false, "bytes": 0, "modified": "Wed, 10 Aug 2011 18:21:30 +0000", "path": "/new_folder", "is_dir": true, "icon": "folder", "root": "dropbox", "revision": 5023410 }
403 | There is already a folder at the given destination. |
https://api.dropbox.com/1/fileops/delete
path
is specified. Valid values are auto
(recommended), sandbox
, and dropbox
.size
field translated based on the given locale. For more information see above.Metadata for the deleted file or folder. More information on the returned metadata fields are available here.
Sample JSON response
{ "size": "0 bytes", "is_deleted": true, "bytes": 0, "thumb_exists": false, "rev": "1f33043551f", "modified": "Wed, 10 Aug 2011 18:21:30 +0000", "path": "/test .txt", "is_dir": false, "icon": "page_white_text", "root": "dropbox", "mime_type": "text/plain", "revision": 492341 }
404 | No file was found at the specified path. |
406 | Too many files would be involved in the operation for it to complete successfully. The limit is currently 10,000 files and folders. |
https://api.dropbox.com/1/fileops/move
from_path
and to_path
are specified. Valid values are auto
(recommended), sandbox
, and dropbox
.root
.root
.size
field translated based on the given locale. For more information see above.Metadata for the moved file or folder. More information on the returned metadata fields are available here.
Sample JSON response
{ "size": "15 bytes", "rev": "1e0a503351f", "thumb_exists": false, "bytes": 15, "modified": "Wed, 10 Aug 2011 18:21:29 +0000", "path": "/test2.txt", "is_dir": false, "icon": "page_white_text", "root": "dropbox", "mime_type": "text/plain", "revision": 496342 }
403 | An invalid move operation was attempted (e.g. there is already a file at the given destination, or moving a shared folder into a shared folder). |
404 | The source file wasn't found at the specified path. |
406 | Too many files would be involved in the operation for it to complete successfully. The limit is currently 10,000 files and folders. |