All notable changes to this project will be documented in this file. See standard-version for commit guidelines.
10.6.0 (2026-04-01)
- Correct search content type 'tags' to match API (box/box-openapi#591) (#1369)
- Add missing discriminators for schema types (box/box-codegen#931) (#1368) (fe0a3b8)
- Align
LegalHoldPolicyAssignedItemwith API (box/box-openapi#1554) (box/box-openapi#590) (#1365) (feb2010) - Correct search content type 'tags' to match API (box/box-openapi#591) (#1369) (39fbc7c)
- Add
include_referencetoAIandparent_idtoHubsItems(box/box-openapi#588) (#1360) (59c1d3c) - Support Hub Document API (box/box-codegen#930) (#1371) (720b948)
10.5.0 (2026-03-18)
- add
canPublicSharedLinkBeCreatedtoHubs(box/box-codegen#928) (#1356) (6af2956) - Add configurable timeouts for SDKs (box/box-codegen#924) (#1349) (6c556cc)
10.4.0 (2026-02-11)
- add confidence scores for structured extract (box/box-openapi#582) (#1311) (9db7a80)
- add signer language, cancel sign request reason (box/box-openapi#584) (#1331) (fcca2a4)
- Add watermarking permissions and sources information (box/box-openapi#579) (#1300) (7a2c7e3)
10.3.0 (2025-12-19)
- add taxonomy to Metadata Field (read) definition (box/box-openapi#572) (#1269) (7bb9bdc)
- fix
RetryAfterfunction when there's noRetry-Afterheader (box/box-codegen#903) (#1244) (d7cc019)
- add Metadata Taxonomies api (box/box-openapi#569) (#1252) (7850463)
- text input validation for Box Sign (box/box-openapi#568) (#1246) (f99512f)
- Treat
nullablefields as Optional (box/box-codegen#906) (#1256) (12c05dc)
10.2.0 (2025-12-10)
- Remove
confidence_scoreandinclude_confidence_scorefrom AI extract (box/box-openapi#567) (#1238) (66267ba) - Support new sign request metadata (box/box-openapi#565) (#1222) (6c3d332)
10.1.0 (2025-11-19)
- Support GET enterprise configuration API (box/box-openapi#559) (#1134) (1106d32)
- Support Archive API (box/box-openapi#563) (#1174) (d21ec4d)
10.0.1 (2025-10-06)
- Allow flexible key-value data in
AiExtractResponse.answerandEvent.additionalDetails(box/box-openapi#556) (#1084) (f63cffe) - Make
roleparameter of update collaboration optional (box/box-openapi#557) (#1093) (5c21907)
10.0.0 (2025-09-17)
Introducing Box SDK v10, a major release designed to elevate your developer experience and streamline integration with Box Content Cloud. Currently available as a separate sdk-gen branch, v10 will ultimately become the main branch.
- This SDK version is auto-generated and introduces a new interface for all methods. Extensive documentation is available here.
-
Full API Support — Complete coverage of the Box API ecosystem, giving you access to all the latest features and functionalities to build feature-rich applications.
-
Rapid API Updates — Our new auto-generation approach enables Box API additions within days, ensuring you can leverage the most up-to-date features without delay.
-
Embedded Documentation — All objects and parameters are documented directly in the SDK source code, keeping essential information in one place.
-
Enhanced Convenience Methods — New methods for authentication, chunk uploads, automatic retries, retry strategy, and more.
This version includes the Box Next Generation SDK artifact, previously developed in parallel to core Box SDKs. To facilitate migration and provide access to the newest features, we'll soon release an additional major version combining both artifacts. Migration to v10 includes breaking changes, please review the migration guide for details. For more information, see the SDK versioning strategy document. Follow developer changelog for future updates.
What’s New Compared to Python SDK Gen v1.17.0
-
Add External User Deletion API (box/box-openapi#550) (#941) (a80ad85)
-
Add missing webhook events (box/box-openapi#554) (#988) (575ce0b)
-
Change names of unions (box/box-codegen#789) (#939) (cf2b1d5)
-
Remove unused models from schemas (box/box-openapi#547) (#932) (6ef6d63), closes box/box-openapi#542 box/box-openapi#544 box/box-codegen#781 box/box-openapi#545
For more details check migration guide from box-python-sdk-gen v1 to box-python-sdk v10.
3.14.0 (2025-04-09)
3.13.0 (2024-08-22)
3.12.0 (2024-08-06)
- add create sign request function with different required parameters (#878) (d972f54)
- Support Box AI features (#877) (3026d2a)
3.11.0 (2024-06-07)
3.10.0 (2024-05-22)
- Change exception type for missing location header (#871) (8c5e0ec)
- fix annnotation of oauths access_token (#855) (804780e)
- Fix retention policy integration test (#867) (8e0d640)
- Remove delete classification (#861) (393cfef)
- Update exception file get download URL (#866) (94dcbcd)
3.9.2 (2023-10-18)
3.9.1 (2023-09-14)
3.9.0 (2023-09-06)
- adds get sign template and get sign templates methods on Client (#835) (fbc783d)
- Support create sign request with template ID (#834) (4f11d75)
3.8.1 (2023-08-01)
3.8.0 (2023-07-25)
3.7.3 (2023-07-07)
3.7.2 (2023-05-26)
3.7.1 (2023-04-18)
- Rename filter date parameters in legal hold creation according to the documentation (#810) (f52c66a)
3.7.0 (2023-03-08)
- Update
retention_policiesandretention_policy_assignments(#803) (8b72f7e) - Use multiple threading for chunked upload (#800) (506ce0d)
3.6.2 (2023-02-07)
3.6.1 (2023-01-09)
3.6.0 (2023-01-03)
- Fix index error when getting an empty list of user term of service statuses (#780) (23d763a)
- Specify which exceptions should be retried (#784) (833cd46)
3.5.1 (2022-11-30)
- Renew connection when Connection reset error occurs (#771) (bcaab27), closes #756 #757 #763 #765 #766 #770
- Retry JWT auth when got error: required unique
jticlaim. (#768) (878e958) - Update
pyjtwdependency to work with Python 3.10 (#772) (b13c5cd)
3.5.0 (2022-09-23)
- Add
redirect_urlanddeclined_redirect_urlfields to Sign Request (#752) (5d1f609) - Add support for modifiable retention policies & enable deleting retention policy assignment (#759) (847301b)
- Support file request APIs (#747) (71895e3)
- Do not log the content of downloaded file (#760) (5d26431)
- Fix closing file after chunked upload (#761) (b433692)
3.4.0 (2022-07-06)
- Add support for editable shared links for files (#737) (1396200)
- Support uploading and deleting user avatar (#743) (fe00a9e)
3.3.0 (2022-04-28)
- Add missing fields to metadata template field (#719) (9e574a3), closes #717
- Upload session commit return None on 202 (#718) (86a1856), closes #715
3.2.0 (2022-03-11)
- Add setting
disposition_atfield for files under retention (#710) (91b1373) - Add support for Client Credentials Grant authentication method (#705) (d33d16d)
3.1.0 (2022-02-16)
- Add support for Python 3.10 (#692) (d4aed82)
- Add support for Python 3.8, Python 3.9,
pypy-3.7andpypy-3.8. (#689) (0aa94cc) - Deprecate
use_indexparameter fromMDQof files/folders (#666) (2595720) - Replace external package
mockwith Python standard libraryunittest.mock(#697) (6fd6366) - Upgrade cryptography library to the most recent version. (#668) (9c94d08), closes #667
UploadSession.commitreturnsNonewhen retry limit was reached (#696) (9456fe0)- Add missing
api_calldecorator forcreate_upload_session(#686) (3510d3a) - Fix chunked upload (#673) (2605fd7), closes #671
- Move sphinx to test requirements (#662)
- Drop support for python 2.7 (#645)
- Add missing parameter
stream_positiontoget_admin_eventsmethod (#648) - Drop support for python 3.5 (#654)
- Remove deprecated code using insensitive language (#651)
- Enforcing usage of keyword-only arguments in some functions (#656)
- Add missing
api_calldecorators onmultiputcalls (#653) - Added
py.typedfile formypyto recognise type hints (#657)
- Add
admin_logs_streamingsupport for events stream (#623) - Add
vanity_nameparameter for creating shared link to a file or folder (#637) - Add getting files and file versions under retention for a retention policy assignment (#633)
- Support base item operations for WebLink class (#639)
- Limit cryptography to version <3.5.0 (#636)
- Avoid raising 404 when a thumbnail cannot be generated for a file (#642)
- Upgrade cryptography to version 3 (#620)
- Fix bug when thumbnail representations are not found (#597)
- Add metadata query functionality (#574)
- Add folder lock functionality (#581)
- Add search query support for the
include_recent_shared_linksfield (#582) - Update
get_groups()to use documented parameter to filter by name (#586)
- Deprecate and add method for getting a thumbnail (#572)
- Add support for
copyInstanceOnItemCopyfield for metadata templates (#546) - Allow creating tasks with the
actionandcompletion_ruleparameters (#544) - Add zip functionality (#539)
- Fix bug with updating a collaboration role to owner (#536)
- Allow ints to be passed in as item IDs (#530)
- Fix exception handling for OAuth
- Fix path parameter sanitization
- Added support for token exchange using shared links
- Added the ability to pass in a SHA1 value for file uploads
- Fixed bug in
_get_retry_request_callableintroduced in release 2.7.0 which caused chunked uploads to fail
- Fixed bug in
get_admin_eventsfunction which caused errors when the optionalevent_typesparameter was omitted. - Add marker based pagination for listing users.
- Added support for more attribute parameters when uploading new files and new versions of existing files.
- Combined preflight check and lookup of accelerator URL into a single request for uploads.
- Fixed JWT retry logic so a new JTI claim is generated on each retry.
- Fixed bug where JWT authentication requests returned incorrect error codes.
- Fixed retry logic so when a
Retry-Afterheader is passed back from the API, the SDK waits for the amount of time specified in the header before retrying.
- Added
api_calldecorator for copy method.
- Added a new get events function with created_before, created_after, and event_type parameters
- Allowed passing
Noneto clear configurable_permission field in the add_member() method.
- Patch release for issues with v2.4.0.
- Fixing an issue in v2.3.1 where package could not be installed.
- Fixing an issue in v2.3.0 where package could not be installed.
- Added the ability to set file description upon upload
- Added support for basic authenticated proxy and unauthenticated proxy
- Updated requests-toolbelt dependency restriction.
- Fixing an issue in v2.2.0 where package could not be installed.
- Added abilty for user to retrieve an avatar for a user.
- Changed retry strategy to use exponential backoff with randomized jitter.
- Added ability for user to chunk upload files and resume uploads for interrupted uploads.
- Added ability to verify webhook message.
- Added ability for user to add metadata classification to files and folders.
- Bugfix where calling
.response_object()method on an API object could throw.
-
Python 2.6 is no longer supported.
-
Python 3.3 is no longer supported.
-
client.search()now returns aSearchobject that exposes aquery()method to call the Search API. Useclient.search().query(**search_params)instead ofclient.search(**search_params). -
client.get_memberships(...)has a change in signature. The limit and offset parameters have swapped positions to keep consistency with the rest of the SDK. -
client.groups(...)has been changed toclient.get_groups. The limit and offset parameters have swapped positions. -
The
unshared_atparameter foritem.create_shared_link(...)andfile.get_shared_link_download_url(...)now takes an https://tools.ietf.org/html/rfc3339#section-5.8unicodestring instead of adatetime.date. Users migrating from v1.x can pass the value ofdate.isoformat()instead of thedateobject itself. -
Events.get_events(...)now returns a list ofEventinstances rather than a list ofdictrepresenting events.Eventinherits fromMappingbut will not have all the same capabilities asdict.- Your code is affected if you use
Events.get_events(...)and expect a list ofdictrather than a list ofMapping. For example, if you use__setitem__(event['key'] = value),update(),copy(), or if your code depends on thestrorreprof theEvent. Use of__getitem__(event['key']),get(), and otherMappingmethods is unaffected. See https://docs.python.org/2.7/library/collections.html#collections-abstract-base-classes for methods supported onMappinginstances. - Migration: If you still need to treat an
Eventas adict, you can get a deepcopy of the originaldictusing the new property onBaseAPIJSONObject,response_object.
- Your code is affected if you use
-
LoggingNetworkhas been removed. Logging calls are now made from theDefaultNetworkclass. In addition, the logging format strings in this class have changed in a way that will break logging for any applications that have overridden any of these strings. They now use keyword format placeholders instead of positional placeholders. All custom format strings will now have to use the same keyword format placeholders. Though this is a breaking change, the good news is that using keyword format placeholders means that any future changes will be automatically backwards-compatibile (as long as there aren't any changes to change/remove any of the keywords). -
File.update_contents()andFile.update_contents_with_stream()now correctly return aFileobject with the correct internal JSON structure. Previously it would return aFileobject where the file JSON is hidden insidefile['entries'][0]. This is a bugfix, but will be a breaking change for any clients that have already written code to handle the bug. -
Comparing two objects (e.g. a
Fileand aFolder) that have the same Box ID but different types with==will now correctly returnFalse. -
The following methods now return iterators over the entire collection of returned objects, rather than a single page:
client.users()client.groups()client.search().query()folder.get_items()
Since
folder.get_items()now returns an iterator,folder.get_items_limit_offset()andfolder.get_items_marker()have been removed. To use marker based paging withfolder.get_items(), pass theuse_marker=Trueparameter and optionally specify amarkerparameter to begin paging from that point in the collection.Additionally,
group.membership()has been renamed togroup.get_memberships(), and returns an iterator of membership objects. This method no longer provides the option to return tuples with paging information. -
The
Translatorclass has been reworked;translator.get(...)still returns the constructor for the object class corresponding to the passed in type, buttranslator.translate(...)now takes aSessionand response object directly and produces the translated object. This method will also translate any nested objects found.- This change obviates the need for
GroupMembershipto have a custom constructor; it now uses the defaultBaseObjectconstructor.
- This change obviates the need for
- All publicly documented API endpoints and parameters should now be supported by the SDK
- Added more flexibility to the object translation system:
- Can create non-global
Translatorinstances, which can extend or not-extend the global defaultTranslator. - Can initialize
BoxSessionwith a customTranslator. - Can register custom subclasses on the
Translatorwhich is associated with aBoxSessionor aClient. - All translation of API responses now use the
Translatorthat is referenced by theBoxSession, instead of directly using the global defaultTranslator. - Nested objects are now translated by
translator.translate()
- Can create non-global
- When the
auto_session_renewalisTruewhen calling any of the request methods onBoxSession, if there is no access token,BoxSessionwill renew the token before making the request. This saves an API call. - Auth objects can now be closed, which prevents them from being used
to request new tokens. This will also revoke any existing tokens
(though that feature can be disabled by passing
revoke=False). Also introduces aclosing()context manager method, which will auto-close the auth object on exit. - Various enhancements to the
JWTAuthbaseclass:- The
authenticate_app_user()method is renamed toauthenticate_user(), to reflect that it may now be used to authenticate managed users as well. See the method docstring for details.authenticate_app_user()is now an alias ofauthenticate_user(), in order to not introduce an unnecessary backwards-incompatibility. - The
userargument toauthenticate_user()may now be either a user ID string or aUserinstance. Before it had to be aUserinstance. - The constructor now accepts an optional
userkeyword argument, which may be a user ID string or aUserinstance. When this is passed,authenticate_user()and can be called without passing a value for theuserargument. More importantly, this means thatrefresh()can be called immediately after construction, with no need for a manual call toauthenticate_user(). Combined with the aforementioned improvement to theauto_session_renewalfunctionality ofBoxSession, this means that authentication forJWTAuthobjects can be done completely automatically, at the time of first API call. - The constructor now supports passing the RSA private key in two
different ways: by file system path (existing functionality), or
by passing the key data directly (new functionality). The
rsa_private_key_file_sys_pathparameter is now optional, but it is required to pass exactly one ofrsa_private_key_file_sys_pathorrsa_private_key_data. - Document that the
enterprise_idargument toJWTAuthis allowed to beNone. authenticate_instance()now accepts anenterpriseargument, which can be used to set and authenticate as the enterprise service account user, ifNonewas passed forenterprise_idat construction time.- Authentications that fail due to the expiration time not falling within the correct window of time are now automatically retried using the time given in the Date header of the Box API response. This can happen naturally when the system time of the machine running the Box SDK doesn't agree with the system time of the Box API servers.
- The
- Added an
Eventclass. - Moved
metadata()method toItemso it's now available forFolderas well asFile. - The
BaseAPIJSONObjectbaseclass (which is a superclass of all API response objects) now supports__contains__and__iter__. They behave the same as forMapping. That is,__contains__checks for JSON keys in the object, and__iter__yields all of the object's keys. - Added a
RecentItemclass. - Added
client.get_recent_items()to retrieve a user's recently accessed items on Box. - Added support for the
can_view_pathparameter when creating new collaborations. - Added
BoxObjectCollectionand subclassesLimitOffsetBasedObjectCollectionandMarkerBasedObjectCollectionto more easily manage paging of objects from an endpoint. These classes manage the logic of constructing requests to an endpoint and storing the results, then provide__next__to easily iterate over the results. The option to return results one by one or as aPageof results is also provided. - Added a
downscope_token()method to theClientclass. This generates a token that has its permissions reduced to the provided scopes and for the optionally providedFileorFolder. - Added methods for configuring
JWTAuthfrom config file:JWTAuth.from_settings_fileandJWTAuth.from_settings_dictionary. - Added
network_responseproperty toBoxOAuthException. - API Configuration can now be done per
BoxSessioninstance.
- Added extra information to
BoxAPIException. - Added
collaboration()method toClient. - Reworked the class hierarchy. Previously,
BaseEndpointwas the parent ofBaseObjectwhich was the parent of all smart objects. NowBaseObjectis a child of bothBaseEndpointandBaseAPIJSONObject.BaseObjectis the parent of all objects that are a part of the REST API. Another subclass ofBaseAPIJSONObject,APIJSONObject, was created to represent pseudo-smart objects such asEventthat are not directly accessible through an API endpoint. - Added
network_response_constructoras an optional property on theNetworkinterface. Implementations are encouraged to override this property, and use it to constructNetworkResponseinstances. That way, subclass implementations can easily extend the functionality of theNetworkResponse, by re-overriding this property. This property is defined and used in theDefaultNetworkimplementation. - Move response logging to a new
LoggingNetworkResponseclass (which is made possible by the aforementionednetwork_response_constructorproperty). Now the SDK decides whether to log the response body, based on whether the caller reads or streams the content. - Add more information to the request/response logs from
LoggingNetwork. - Add logging for request exceptions in
LoggingNetwork. - Bugfix so that the return value of
JWTAuth.refresh()correctly matches that of the auth interface (by returning a tuple of ((access token), (refresh token or None)), instead of just the access token). In particular, this fixes an exception inBoxSessionthat always occurred when it tried to refresh anyJWTAuthobject. - Fixed an exception that was being raised from
ExtendableEnumMeta.__dir__(). - CPython 3.6 support.
- Increased required minimum version of six to 1.9.0.
- Bugfix so that
JWTAuthopens the PEM private key file in'rb'mode.
- Bugfix so that
OAuth2always has the correct tokens after a call torefresh().
- Added a
revoke()method to theOAuth2class. Calling it will revoke the current access/refresh token pair.
- Added a new class,
LoggingClient. It's aClientthat uses theLoggingNetworkclass so that requests to the Box API and its responses are logged. - Added a new class,
DevelopmentClientthat combinesLoggingClientwith the existingDeveloperTokenClient. This client is ideal for exploring the Box API or for use when developing your application. - Made the
oauthparameter toClientoptional. The constructor now accepts new parameters that it will use to construct theOAuth2instance it needs to auth with the Box API. - Changed the default User Agent string sent with requests to the Box API. It is now 'box-python-sdk-<version>'.
- Box objects have an improved
__repr__, making them easier to identify during debugging sessions. - Box objects now implement
__dir__, making them easier to explore. When created with a Box API response, these objects will now include the API response fields as attributes.
-
Make sure that
__all__is only defined once, as a list ofstr. Some programs (e.g. PyInstaller) naively parse __init__.py files, and if__all__is defined twice, the second one will be ignored. This can cause__all__to appear as a list ofunicodeon Python 2. -
Create wheel with correct conditional dependencies and license file.
-
Change the
licensemeta-data from the full license text, to just a short string, as specified in [1][2].[1] <https://docs.python.org/3.5/distutils/setupscript.html#additional-meta-data>
-
Include entire test/ directory in source distribution. test/__init__.py was previously missing.
-
Update documentation.
- Files now support getting a direct download url.
- Added key id parameter to JWT Auth.
- Fixed import error for installations that don't have redis installed.
- Fixed use of
raw_inputin the developer token auth for py3 compatibility.
- Added a new class,
DeveloperTokenClientthat makes it easy to get started using the SDK with a Box developer token. It uses another new class,DeveloperTokenAuthfor auth.
- Added limit, offset, and filter_term parameters to
client.users()to match up with the Box API.
- Fix
boxsdk.util.log.setup_logging()on Python 3.
- Add requests-toolbelt to setup.py (it was accidentally missing from 1.3.0).
- CPython 3.5 support.
- Support for cryptography>=1.0 on PyPy 2.6.
- Travis CI testing for CPython 3.5 and PyPy 2.6.0.
- Added a logging network class that logs requests and responses.
- Added new options for auth classes, including storing tokens in Redis and storing them on a remote server.
- Stream uploads of files from disk.
- The SDK now supports setting a password when creating a shared link.
- Fixed an ImportError for installs that didn't install the [jwt] extras.
- Added support for Box Developer Edition. This includes JWT auth
(auth as enterprise or as app user), and
create_userfunctionality. - Added support for setting shared link expiration dates.
- Added support for setting shared link permissions.
- Added support for 'As-User' requests. See https://developer.box.com/en/guides/authentication/oauth2/as-user/
- Improved support for accessing shared items. Items returned from the
client.get_shared_itemmethod will remember the shared link (and the optionally provided shared link password) so methods called on the returned items will be properly authorized.
- Add context_info from failed requests to BoxAPIException instances.
Item.remove_shared_link()was trying to return an incorrect (according to its own documentation) value, and was also attempting to calculate that value in a way that made an incorrect assumption about the API response. The latter problem caused invocations of the method to raise TypeError. The method now handles the response correctly, and correctly returns typebool.
- Added support for the Box accelerator API for premium accounts.
- Added support for preflight check during file uploads and updates.
- Added support to the search endpoint for metadata filters.
- Added support to the search endpoint for filtering based on result type and content types.
- Added support for the /shared_items endpoint.
client.get_shared_itemcan be used to get information about a shared link. See https://developers.box.com/docs/#shared-items
- Certain endpoints (e.g. search, get folder items) no longer raise an exception when the response contains items that are neither files nor folders.
- A minor change to namespacing. The
OAuth2class can now be imported directly fromboxsdk. Demo code has been updated to reflect the change.
- The SDK now supports Box metadata. See the metadata docs for more information.
- The object paging API has been improved. SDK extensions that need fine-grained control over when the next "page" of API results will be fetched can now do that.
- The example code has been improved to be more robust and to work with all Python versions supported by the SDK (CPython 2.6-2.7, CPython 3.3-3.4, and PyPy).
- The example code has an example on how to use the new metadata feature.
- The README has improved code examples.
- Oauth2 redirect URIs containing non-ASCII characters are now supported.