Skip to main content
Events provide a way for an application to subscribe to any actions performed by any user, users, or service in an enterprise.

​
Event

The description of an event that happened within Box.
PropertyTypeRequiredDescription
typestringNoThe value will always be event.
created_atstringNoWhen the event object was created.
recorded_atstringNoWhen the event object was recorded in database.
event_idstringNoThe ID of the event object. You can use this to detect duplicate events.
created_byUser (Mini)NoThe user that performed the action represented by the event. Some events may be performed by users not logged into Box. In that case, not all attributes of the object are populated and the event is attributed to a unknown user (user_id = 2).
event_typeenum<string>NoAn event type that can trigger an event. Available options: ACCESS_GRANTED, ACCESS_REVOKED, ADD_DEVICE_ASSOCIATION, ADD_LOGIN_ACTIVITY_DEVICE, ADMIN_LOGIN, ADVANCED_FOLDER_SETTINGS_UPDATE, AI_SECURITY_DETECTION, ANNOTATIONV2_CREATE, ANNOTATIONV2_DELETE, ANNOTATIONV2_EDIT, APPLICATION_CREATED, APPLICATION_PUBLIC_KEY_ADDED, APPLICATION_PUBLIC_KEY_DELETED, BOX_AI_USER_FAILED_REQUEST, BOX_AI_USER_REQUEST, CHANGE_ADMIN_ROLE, CHANGE_FOLDER_PERMISSION, COLLABORATION_ACCEPT, COLLABORATION_EXPIRATION, COLLABORATION_INVITE, COLLABORATION_REMOVE, COLLABORATION_ROLE_CHANGE, COLLAB_ADD_COLLABORATOR, COLLAB_INVITE_COLLABORATOR, COLLAB_REMOVE_COLLABORATOR, COLLAB_ROLE_CHANGE, COLLECTION_CREATE, COLLECTION_DELETE, COLLECTION_ITEM_CREATE, COLLECTION_ITEM_DELETE, COLLECTION_ITEM_UPDATE, COLLECTION_UPDATE, COMMENT_CREATE, COMMENT_DELETE, COMMENT_EDIT, CONTENT_ACCESS, CONTENT_RECOVERY_REPORT_CREATE, CONTENT_RECOVERY_REPORT_DELETE, CONTENT_RECOVERY_REPORT_INITIATE, CONTENT_WORKFLOW_ABNORMAL_DOWNLOAD_ACTIVITY, CONTENT_WORKFLOW_AUTOMATION_ADD, CONTENT_WORKFLOW_AUTOMATION_DELETE, CONTENT_WORKFLOW_POLICY_ADD, CONTENT_WORKFLOW_SHARING_POLICY_VIOLATION, CONTENT_WORKFLOW_UPLOAD_POLICY_VIOLATION, COPY, DATA_RETENTION_CREATE_RETENTION, DATA_RETENTION_REMOVE_RETENTION, DELETE, DELETE_USER, DEVICE_TRUST_CHECK_FAILED, DISABLE_MULTI_FACTOR_AUTH, DOWNLOAD, EDIT, EDIT_USER, EDR_CROWDSTRIKE_ACCESS_ALLOWED_NO_CROWDSTRIKE_DEVICE, EDR_CROWDSTRIKE_ACCESS_REVOKED, EDR_CROWDSTRIKE_BOX_TOOLS_OUTDATED, EDR_CROWDSTRIKE_DEVICE_DETECTED, EDR_CROWDSTRIKE_DRIVE_OUTDATED, EDR_CROWDSTRIKE_NO_BOX_TOOLS, EMAIL_ALIAS_CONFIRM, EMAIL_ALIAS_PRIMARY, EMAIL_ALIAS_REMOVE, EMAIL_UPLOAD_DISABLED, EMAIL_UPLOAD_ENABLED, ENABLE_MULTI_FACTOR_AUTH, ENABLE_TWO_FACTOR_AUTH, ENTERPRISE_APP_AUTHORIZATION_UPDATE, EXTERNAL_COLLAB_SECURITY_SETTINGS, FAILED_LOGIN, FAVORITE, FILE_MARKED_MALICIOUS, FILE_REQUEST_CREATE, FILE_REQUEST_DELETE, FILE_REQUEST_UPDATE, FILE_VERSION_RESTORE, FILE_WATERMARKED_DOWNLOAD, GROUP_ADD_ITEM, GROUP_ADD_USER, GROUP_ADMIN_CREATED, GROUP_ADMIN_DELETED, GROUP_ADMIN_PERMISSIONS_UPDATED, GROUP_CREATION, GROUP_DELETION, GROUP_EDITED, GROUP_REMOVE_ITEM, GROUP_REMOVE_USER, ILLEGAL_ITEM_OWNERSHIP_TRANSFER_BY_USER, ITEM_ASSOCIATION_CREATED, ITEM_ASSOCIATION_DELETED, ITEM_ASSOCIATION_UPDATED, ITEM_COPY, ITEM_CREATE, ITEM_DOWNLOAD, ITEM_EMAIL_SEND, ITEM_MAKE_CURRENT_VERSION, ITEM_MODIFY, ITEM_MOVE, ITEM_OPEN, ITEM_PREVIEW, ITEM_RENAME, ITEM_SHARED, ITEM_SHARED_CREATE, ITEM_SHARED_UNSHARE, ITEM_SHARED_UPDATE, ITEM_SYNC, ITEM_TRASH, ITEM_UNDELETE_VIA_TRASH, ITEM_UNSYNC, ITEM_UPLOAD, LEGAL_HOLD_ASSIGNMENT_CREATE, LEGAL_HOLD_ASSIGNMENT_DELETE, LEGAL_HOLD_POLICY_CREATE, LEGAL_HOLD_POLICY_DELETE, LEGAL_HOLD_POLICY_UPDATE, LOCK, LOCK_CREATE, LOCK_DESTROY, LOGIN, MASTER_INVITE_ACCEPT, MASTER_INVITE_REJECT, METADATA_CASCADE_POLICY_APPLY, METADATA_CASCADE_POLICY_CREATE, METADATA_INSTANCE_COPY, METADATA_INSTANCE_CREATE, METADATA_INSTANCE_DELETE, METADATA_INSTANCE_UPDATE, METADATA_TEMPLATE_CREATE, METADATA_TEMPLATE_DELETE, METADATA_TEMPLATE_UPDATE, MOVE, NEW_USER, OAUTH2_ACCESS_TOKEN_REVOKE, OAUTH2_REFRESH_TOKEN_REVOKE, PREVIEW, REMOVE_DEVICE_ASSOCIATION, REMOVE_LOGIN_ACTIVITY_DEVICE, RENAME, RETENTION_POLICY_ASSIGNMENT_ADD, SHARE, SHARED_LINK_REDIRECT_OUT_OF_SHARED_CONTEXT, SHARED_LINK_SEND, SHARE_EXPIRATION, SHIELD_ACCESS_POLICY_CREATED, SHIELD_ACCESS_POLICY_DELETED, SHIELD_ACCESS_POLICY_UPDATED, SHIELD_ALERT, SHIELD_DOWNLOAD_BLOCKED, SHIELD_EXTERNAL_COLLAB_ACCESS_BLOCKED, SHIELD_EXTERNAL_COLLAB_ACCESS_BLOCKED_MISSING_JUSTIFICATION, SHIELD_EXTERNAL_COLLAB_INVITE_BLOCKED, SHIELD_EXTERNAL_COLLAB_INVITE_BLOCKED_MISSING_JUSTIFICATION, SHIELD_EXTERNAL_COLLAB_INVITE_JUSTIFIED, SHIELD_INFORMATION_BARRIER_COLLAB_BLOCKED, SHIELD_INFORMATION_BARRIER_DISABLED, SHIELD_INFORMATION_BARRIER_ENABLED, SHIELD_INFORMATION_BARRIER_GROUP_ADD_USER_BLOCKED, SHIELD_INFORMATION_BARRIER_ITEM_COPY_BLOCKED, SHIELD_INFORMATION_BARRIER_ITEM_MOVE_BLOCKED, SHIELD_INFORMATION_BARRIER_ITEM_OWNER_TRANSFER_BLOCKED, SHIELD_INFORMATION_BARRIER_PENDING, SHIELD_INFORMATION_BARRIER_SHARED_ITEM_ACCESS_BLOCKED, SHIELD_JUSTIFICATION_APPROVAL, SHIELD_SHARED_LINK_ACCESS_BLOCKED, SHIELD_SHARED_LINK_STATUS_RESTRICTED_ON_CREATE, SHIELD_SHARED_LINK_STATUS_RESTRICTED_ON_UPDATE, SIGN_DOCUMENT_ASSIGNED, SIGN_DOCUMENT_CANCELLED, SIGN_DOCUMENT_COMPLETED, SIGN_DOCUMENT_CONVERTED, SIGN_DOCUMENT_CREATED, SIGN_DOCUMENT_DECLINED, SIGN_DOCUMENT_EXPIRED, SIGN_DOCUMENT_SIGNED, SIGN_DOCUMENT_VIEWED_BY_SIGNED, SIGN_DOCUMENT_VIEWED_BY_SIGNER, SIGNER_DOWNLOADED, SIGNER_FORWARDED, STORAGE_EXPIRATION, TAG_ITEM_CREATE, TASK_ASSIGNMENT_CREATE, TASK_ASSIGNMENT_DELETE, TASK_ASSIGNMENT_UPDATE, TASK_CREATE, TASK_UPDATE, TERMS_OF_SERVICE_ACCEPT, TERMS_OF_SERVICE_REJECT, UNDELETE, UNFAVORITE, UNLOCK, UNSHARE, UPDATE_COLLABORATION_EXPIRATION, UPDATE_SHARE_EXPIRATION, UPLOAD, USER_AUTHENTICATE_OAUTH2_ACCESS_TOKEN_CREATE, WATERMARK_LABEL_CREATE, WATERMARK_LABEL_DELETE, WORKFLOW_AUTOMATION_CREATE, WORKFLOW_AUTOMATION_DELETE, WORKFLOW_AUTOMATION_UPDATE.
session_idstringNoThe session of the user that performed the action. Not all events will populate this attribute.
sourceEvent source resourceNoThe resource that triggered this event. For more information, check out the guide on event triggers.
additional_detailsobjectNoThis object provides additional information about the event if available. This can include how a user performed an event as well as additional information to correlate an event to external KeySafe logs. Not all events have an additional_details object. This object is only available in the Enterprise Events.
Example
{
  "type": "event",
  "created_at": "2022-12-12T10:53:43-08:00",
  "recorded_at": "2022-12-12T10:54:43-08:00",
  "event_id": "f82c3ba03e41f7e8a7608363cc6c0390183c3f83",
  "created_by": {
    "id": "11446498",
    "type": "user",
    "name": "Aaron Levie",
    "login": "ceo@example.com"
  },
  "event_type": "FILE_MARKED_MALICIOUS",
  "session_id": "70090280850c8d2a1933c1",
  "source": {
    "id": "11446498",
    "type": "user",
    "name": "Aaron Levie",
    "login": "ceo@example.com",
    "created_at": "2012-12-12T10:53:43-08:00",
    "modified_at": "2012-12-12T10:53:43-08:00",
    "language": "en",
    "timezone": "Africa/Bujumbura",
    "space_amount": 11345156112,
    "space_used": 1237009912,
    "max_upload_size": 2147483648,
    "status": "active",
    "job_title": "CEO",
    "phone": "6509241374",
    "address": "900 Jefferson Ave, Redwood City, CA 94063",
    "avatar_url": "https://www.box.com/api/avatar/large/181216415",
    "notification_email": {
      "email": "notifications@example.com",
      "is_confirmed": true
    }
  },
  "additional_details": {
    "key": "value"
  }
}

​
Events

A list of event objects.
PropertyTypeRequiredDescription
chunk_sizeintegerNoThe number of events returned in this response.
next_stream_positionstringNoThe stream position of the start of the next page (chunk) of events.
entriesarray of EventNoA list of events.
Example
{
  "chunk_size": 2,
  "next_stream_position": "1152922976252290886",
  "entries": [
    {
      "type": "event",
      "created_at": "2022-12-12T10:53:43-08:00",
      "recorded_at": "2022-12-12T10:54:43-08:00",
      "event_id": "f82c3ba03e41f7e8a7608363cc6c0390183c3f83",
      "created_by": {
        "id": "11446498",
        "type": "user",
        "name": "Aaron Levie",
        "login": "ceo@example.com"
      },
      "event_type": "FILE_MARKED_MALICIOUS",
      "session_id": "70090280850c8d2a1933c1",
      "source": {
        "id": "11446498",
        "type": "user",
        "name": "Aaron Levie",
        "login": "ceo@example.com",
        "created_at": "2012-12-12T10:53:43-08:00",
        "modified_at": "2012-12-12T10:53:43-08:00",
        "language": "en",
        "timezone": "Africa/Bujumbura",
        "space_amount": 11345156112,
        "space_used": 1237009912,
        "max_upload_size": 2147483648,
        "status": "active",
        "job_title": "CEO",
        "phone": "6509241374",
        "address": "900 Jefferson Ave, Redwood City, CA 94063",
        "avatar_url": "https://www.box.com/api/avatar/large/181216415",
        "notification_email": {
          "email": "notifications@example.com",
          "is_confirmed": true
        }
      },
      "additional_details": {
        "key": "value"
      }
    }
  ]
}

​
Real-time servers

A list of real-time servers that can be used for long-polling.
PropertyTypeRequiredDescription
chunk_sizeintegerNoThe number of items in this response.
entriesarray of Real-time serverNoA list of real-time servers.
Example
{
  "chunk_size": 1,
  "entries": [
    {
      "type": "realtime_server",
      "url": "http://2.realtime.services.box.net/subscribe?channel=cc807c9c4869ffb1c81a&stream_type=all",
      "ttl": "10",
      "max_retries": "10",
      "retry_timeout": 610
    }
  ]
}
Last modified on July 9, 2026