Dropbox

​

Overview

​

Setup

1. In the App Console, create a Scoped access app. Pick App folder to keep the broker inside /Apps/<app name>/, or Full Dropbox if it must reach existing team folders. Paths in payloads are relative to that root.
2. Under Permissions, enable the scopes the events need: account_info.read, files.metadata.read, files.metadata.write, files.content.read, files.content.write, sharing.read, sharing.write, file_requests.read, file_requests.write. Leave out the ones you do not use.
3. Authorise the app once with token_access_type=offline (for example https://www.dropbox.com/oauth2/authorize?client_id=<APP_KEY>&token_access_type=offline&response_type=code) and exchange the code at /oauth2/token. Keep the refresh token, app key and app secret in broker secrets (for example DROPBOX_REFRESH_TOKEN, DROPBOX_APP_KEY, DROPBOX_APP_SECRET). For a quick test, Generate access token on the app’s settings page gives a short-lived token.
4. Keep the current access token in a broker secret (for example DROPBOX_ACCESS_TOKEN) and inject it in a LoT action with GET SECRET. Never retain topics that carry it.

​

Authentication

{"access_token": "YOUR_DROPBOX_ACCESS_TOKEN"}

{"form": "grant_type=refresh_token&refresh_token=<DROPBOX_REFRESH_TOKEN>&client_id=<DROPBOX_APP_KEY>&client_secret=<DROPBOX_APP_SECRET>"}

​

Payloads

​

Examples

{"access_token": "<token>", "arg": {"path": "/Coreflux/Porto/line-2/2026-10-05-shift-A.json", "mode": "add", "autorename": true, "mute": true}, "content": {"line": "2", "shift": "A", "oee": 0.87, "scrap": 14}}

{"access_token": "<token>", "arg": {"path": "/Coreflux/Porto/line-2/recipe.json"}}

1. Get a cursor for future changes (storage/dropbox/folders/latest-cursor/get):
   {"access_token": "<token>", "body": {"path": "/Coreflux/Porto/inbox", "recursive": true}}
   
2. Wait for a change (storage/dropbox/folders/longpoll, no token). The call blocks for up to timeout seconds plus up to 90 seconds of jitter, then returns {"changes": true} or {"changes": false}, sometimes with backoff (seconds to wait before the next longpoll):
   {"body": {"cursor": "<cursor>", "timeout": 120}}
   
3. When changes is true, list them (storage/dropbox/folders/list/continue) and store the new cursor from the response:
   {"access_token": "<token>", "body": {"cursor": "<cursor>"}}
   

{"access_token": "<token>", "body": {"from_path": "/Coreflux/Porto/inbox/report.csv", "to_path": "/Coreflux/Porto/archive/2026-10/report.csv", "autorename": true}}

{"access_token": "<token>", "body": {"path": "/Coreflux/firmware/gw-2.4.1.bin"}}

{"access_token": "<token>", "body": {"title": "Press 7 bearing photos", "destination": "/Coreflux/Porto/maintenance/press-7", "open": true, "description": "Work order WO-4711"}}

​

Events

​

Limits

• Dropbox rate-limits per linked user (per team for team-linked apps) and does not publish the numbers. Above the limit it answers 429 with a Retry-After header. Wait that long, and batch work (FolderCreateBatch, CopyBatch, MoveBatch) instead of sending many single calls.
• FileUpload accepts up to 150 MiB per file, but keep MQTT payloads small. Larger files need upload sessions, which are not packaged.
• On Dropbox Business plans with a data transport limit, upload and download calls count against the team’s monthly allowance. Over the limit Dropbox answers 403 invalid_account_type/feature.
• FolderList returns at most 2000 entries per page; follow has_more with FolderListContinue. FolderLongpoll accepts a timeout from 30 to 480 seconds, and the notify connector allows 600 seconds per request.
• Temporary links expire after four hours. Temporary upload links last 60 to 14400 seconds. SaveUrl transfers must finish within 15 minutes.

​

Not packaged

• Delete-style functions on purpose: files/delete_v2, delete_batch, permanently_delete, files/tags/remove, shared link revoke and file request delete. Archive files with FileMove instead.
• Upload sessions (upload_session/start, append_v2, finish, batch variants) for files over 150 MiB, and binary downloads such as thumbnails, previews, download_zip and export.
• Team (Business) endpoints and the Dropbox-API-Select-User, Dropbox-API-Select-Admin and Dropbox-API-Path-Root headers for team spaces. Shared folder membership, Paper, file properties templates, file locking, contacts and account administration.
• Webhooks. Dropbox registers webhook URIs in the App Console, not through the API. A receiver would be a separate ENABLE_SERVER REST_API connector that answers the GET verification by echoing challenge within ten seconds and checks X-Dropbox-Signature (HMAC-SHA256 of the body with the app secret). Notifications only carry account ids, so the connector would then call FolderListContinue. FolderLongpoll covers the same need without a public endpoint.

​

Suggested branches