Dropbox

Twin of the Dropbox API v2.


Covers	`api.dropboxapi.com`, `content.dropboxapi.com`, `notify.dropboxapi.com`, `api.dropbox.com`, `www.dropbox.com`, `mcp.dropbox.com`
Auth	OAuth access tokens, app key and secret
Webhooks	No
MCP tools	25
Operations	59

Coverage

Accounts and space usage, file and folder metadata, sync cursors and search, content download and upload including chunked sessions, revisions and restore, batch copy, move and delete jobs, and shared links, plus the Dropbox OAuth flows. Dropbox splits its API across several hosts and they all answer on one origin here, so your API, content and notify base URLs point at the same place. The hosted MCP server answers on /mcp.

Credentials

Any well-formed bearer token authenticates by default, so your existing sl.… token needs no change. Set auth.mode to enforced to accept only tokens the world knows. See Credentials.

Scopes ride the access token, and a token without the scope a route needs gets Dropbox’s missing_scope refusal naming the required_scope. The token endpoint takes client_id and client_secret in the form body rather than HTTP Basic, and accepts only application/x-www-form-urlencoded.

Vendor specific details

Everything is a POST, including reads. A GET gets 400 with a plain-text Use HTTP POST requests to access Dropbox API, never a 405.
Content endpoints carry their JSON argument in the Dropbox-API-Arg header and raw bytes in the body. Download metadata comes back in Dropbox-API-Result, and sending the argument in both places is a 400.
Business errors are 409 with an error_summary string whose trailing dots vary by operation. The same missing path is path/not_found/ on one route and path/not_found/.. on another, so match on prefix and never on equality.
A trailing slash is not forgiven and the status is not even consistent: most /2 paths answer 401, five upload and longpoll paths answer 404, both with an HTML body.
copy_batch_v2 and move_batch_v2 always hand back an async_job_id and report in_progress on the first poll, but the files have already moved. The job status lags the state it describes.

The long-poll endpoint refuses an Authorization header with a 400. The cursor is the credential there, so strip the bearer your HTTP client adds by default.

Its own notes

Once a sandbox is running, this twin serves its own operating notes at {control_url}/veris/manual: the credentials it accepts, the API versions it serves, and the fault statuses you can arm against it. They are generated from the same source as its behaviour, so they cannot drift.