Box Connector

The Box connector indexes files, folders, comments, tasks, and web links in Box, along with the users and groups that define who can access them.

Setup takes three steps:

1. Create the Box app.
2. Authorize it for your enterprise.
3. Provide the connector its credentials.

Create the Box Application

Create a Custom App using Server Authentication (Client Credentials Grant) in the Box Developer Console (admin or co-admin account). In the app’s Configuration tab:

• App Access Level: App + Enterprise Access — required to enumerate and impersonate managed users and groups.
• Application Scopes: Read all files and folders stored in Box; Manage users; Manage groups; Manage enterprise properties.
• Advanced Features: Generate user access tokens; Make API calls using the as-user header.

Save changes.

Authorize the Application

A CCG app cannot call the API until an admin authorizes it: in the Box Admin Console → Apps → Custom Apps Manager, add/authorize the app by its Client ID and confirm the scopes. Until then the connection test fails with an authorization error.

Credentials

Provide Configuration

Only the three credentials are required; every other field has a safe default.

connector: box
instance: default
source: box
common:
  enabled: true
configuration:
  client_id:
    value: "<your-client-id>"
  client_secret:
    value: "<your-client-secret>"
  enterprise_id:
    value: "<your-enterprise-id>"

Note: Leave the rate-limit, concurrency, cache, and event-polling knobs at their defaults unless tuning throughput, memory, event latency, or responding to 429 pressure.

Note: The backfill window only scopes what backfill emits — it does not limit Stream(), which always processes new events as they arrive.

Filtering Indexed Resources

By default everything reachable is indexed. To narrow scope, map a resource key to an included (allowlist) and/or excluded (blocklist).

configuration:
  # ... credentials ...
  resources:
    user:
      excluded:
        - svc-indexer@example.com
    acl_group:
      included:
        - "engineering"
        - "admins"

Semantics: no filters → index all; included → only listed entries; excluded → all but listed entries; both → included minus excluded (exclude wins). Match values are compared for exact equality.

Match values are the native Box identifiers (not Atolio xIDs), since filtering happens during enumeration before any xID is assigned:

Filters are enforced for the identity resources (user, acl_group), which are backfilled first because the rest of the connector’s ACLs depend on them.

Indexed Resources