Agentic Fabriq
Dropbox
DOCS & KNOWLEDGE · FILES & DOCS
Files, folders, sharing, and Paper docs in that person’s own Dropbox.
Connecting Dropbox in practice
An app in development can link 500 users, but "once your app links 50 Dropbox users, you will have two weeks to apply for and receive production status approval before your app's ability to link additional Dropbox users will be frozen" — and it will not be reviewed before it reaches 50. Writes take a lock on the namespace, so parallel uploads into one folder return 429 too_many_write_operations rather than queueing.
Scopes that draw scrutiny
Team Data (Business API scope category)Dropbox groups scopes into categories on its docs site rather than publishing tokens. "An app that uses these endpoints will need to be authorized by a team administrator", and the resulting token "is associated with the team (rather than the administrator who authorized it)".Membership (Business API scope category)Creates, suspends and removes team members, which is identity administration for the whole team rather than file access.The Event log (Business API scope category)Reads the team’s activity log, so a token holding it can see every member’s actions.Sessions (Business API scope category)Manages members’ sessions and linked devices, so it can sign other people out or unlink their machines.Full Dropbox accessThe docs steer away from it: "Your app should use the least privileged permission it can", naming the Chooser (no permissions at all) and App Folder first, and warning against "Requesting Full Dropbox access to pick a file when you could use the Chooser."
Rate limits
- Limits are enforced "on a per-authorization basis" — per user for user-linked apps and per team for team-linked apps.
- A 429 with reason too_many_requests "always include a Retry-After header that provides the limit in seconds"; a 429 with too_many_write_operations signals namespace lock contention and can return a Retry-After of zero.
- Rate-limited requests themselves also count towards rate limits.
- Upload sessions: a batch can contain up to 1,000 entries; single-file uploads must be under 150 MB; chunk sizes should be multiples of 4 MB.
Worth knowing
- Production approval is a treadmill rather than a gate: no review before 50 linked users, two weeks to be approved after that, and a hard ceiling of 500 linked users while in development.
- Every write acquires a lock on the namespace and holds it until the operation completes, so parallel writes to one folder produce 429 too_many_write_operations; the documented fix is "session_type": "concurrent" upload sessions, not more workers.
- "rate limited requests themselves also count towards rate limits", so retrying before Retry-After extends the throttle instead of shortening it.
- Team endpoints need authorization by a team administrator and Dropbox documents tiered admin roles (team admins, user management admins, support admins), so which endpoints a team token can reach depends on the tier of the admin who granted it.
Checked against Dropbox performance and rate limits (2026-09-29), Dropbox OAuth guide (2026-09-29), Dropbox team administration (2026-09-29), DBX Platform developer guide (2026-09-29)
What an agent can do
Each action is granted on its own. An agent allowed to read is not thereby allowed to write, and the scope beside each row is what the acting user must have connected for it to run at all.
Often connected alongside
Put Dropbox behind one governed endpoint.
Same permissions, same audit trail, whatever else you connect next.