Examples / Documents and e-signature / Box

Box webhooks

File uploads, downloads, previews, comments, shares and collaboration changes.

Events

FILE.UPLOADED
FILE.DOWNLOADED
COMMENT.CREATED
COLLABORATION.CREATED

Signature

Headers BOX-SIGNATURE-PRIMARY and -SECONDARY with BOX-DELIVERY-TIMESTAMP. HMAC-SHA256 of '<raw body><timestamp>' with the primary or secondary key, base64 encoded.

✓ A bin checks Box signatures: add the primary key under Signature verification (Box).

Retries

Box retries with increasing gaps for several hours when the endpoint fails.

See a retry schedule in the calculator.

Docs

developer.box.com/guides/webhooks/

Checked 2026-10-08. Report a change.

Sample request from Boxillustrative, shortened

Content-Typeapplication/jsonBOX-DELIVERY-IDf96bb54b-ee16-4fc5-aa65-8c2d9e5b546fBOX-DELIVERY-TIMESTAMP2026-10-08T06:34:00-00:00BOX-SIGNATURE-PRIMARYXWmrwMey6OsLMeiZKwP4Fpp…

{
  "type": "webhook_event",
  "id": "f96bb54b-ee16-4fc5-aa65-8c2d9e5b546f",
  "created_at": "2026-10-08T06:34:00-00:00",
  "trigger": "FILE.UPLOADED",
  "webhook": { "id": "53", "type": "webhook" },
  "created_by": { "type": "user", "id": "226067247", "login": "ravi@example.com" },
  "source": { "id": "73835521473", "type": "file", "name": "statement-2026-10.pdf", "size": 84210 }
}

Receive Box webhooks with webhooks.xyz

Create a bin. Paste its URL into Box. Each request shows at once with its headers and body. Add your server as a destination, and deliveries retry when it is down. Request an invite.

More in documents and e-signature: DocuSign Connect, Dropbox.