Boxbox.com
Box's API program shows strong overall quality across design, usability, and documentation — a solid foundation for partner and agent integrations. No critical gaps were detected across any evaluated area, meaning partners can generally discover, understand, and integrate with Box APIs without major friction.
API DesignA clean, typed, well-governed API contract agents can reason about4 pass1 warn0 fail97A+
| Signal | Points | Findings | Rationale | |
|---|---|---|---|---|
| pass | Schema coverage & depthvia sdk | 25/25 | 310/310 (100%) public params are fully typed (no any/**kwargs). Analyzer confirms all methods have a derivable input schema. Investigated: sdk 100%, spec 63%. | Typed, complete request/response schemas are what make agent function-calling possible. |
| pass | Auth declared & discoverablevia docs | 25/25 | Authentication is required across the API (declared globally or on every operation), so an agent knows credentials are needed. Investigated: docs 100%, wellknown 100%, spec 67%, cli 50%. | Agents can only call an API when they can determine its auth posture — a declared scheme, or an explicit statement that none is required. |
| warn | Machine-readable, versioned contractvia spec | 21.3/25 | The API sets a version ("1.0.0") but exposes no versioning scheme in the URL, a header, or the media type, so an agent can't pin to a specific version. Investigated: spec 85%, cli 75%, docs 70%. Fix: Pick a versioning scheme (URL path /v1/, Accept: application/vnd.x+json, or a version header) and apply it consistently. | A current OpenAPI version with a declared versioning scheme lets agents reason about the contract. |
| pass | Security & governance hygienevia spec | 15/15 | No credential-shaped strings detected in spec. Investigated: spec 100%, sdk 100%, wellknown 0%. | No leaked secrets, no critical lint violations, no OWASP API Top-10 spec smells, and a published vulnerability-disclosure channel. |
| pass | Example coveragevia spec | 10/10 | Only 37% of parameters and responses (586 of 1564) include example values, so an agent has little grounding in real payload shapes. Investigated: spec 100%, docs 100%, sdk 100%, cli 100%. | Examples carry shape semantics schemas under-specify — for humans and agents alike. |
Developer ExperienceThe context both developers and agents need to integrate fast — onboarding, code samples, complete descriptions and worked examples5 pass0 warn0 fail100A+
| Signal | Points | Findings | Rationale | |
|---|---|---|---|---|
| pass | Self-service developer portalvia docs | 29/29 | Signup page at https://account.box.com/signup/developer (client-rendered, so its contents couldn't be classified); free tier or sandbox is documented in pricing/docs. Investigated: docs 100%. | A first call without a human in the loop — self-serve credentials, a free tier, or an API that needs none. |
| pass | Quickstart presentvia docs | 25/25 | Quickstart at https://developer.box.com/guides/box-ai/ai-tutorials/prerequisites includes a runnable first-call code sample. Investigated: docs 100%. | A quickstart is the fastest path from landing page to first successful call. |
| pass | Code samples in docsvia docs | 18/18 | Docs show code samples in 8 language(s) (top: shell, javascript, python), and 3 of 20 sampled pages offer ≥ 2 languages side by side. Investigated: docs 100%. | Multi-language samples shorten time-to-first-call. |
| pass | Description completenessvia spec | 15/15 | Only 88% of operations and parameters have substantive descriptions (6 of 8 ops, 2 of 2 params; target 90%+). Investigated: spec 100%, sdk 99%. | Complete descriptions are the context humans and agents need to use endpoints. |
| pass | Changelog publishedvia spec | 13/13 | changelog is documented on the docs site at https://developer.box.com/changelog/2026, even though it isn't declared in the API spec. Investigated: spec 100%, docs 100%. | A published changelog lets partners track changes without surprise. |
Agent DiscoveryPartners and their agents can find your APIs — llms.txt, registries, crawlable and reachable docs4 pass0 warn0 fail100A+
| Signal | Points | Findings | Rationale | |
|---|---|---|---|---|
| pass | llms.txt present, valid & comprehensivevia docs | 30/30 | llms.txt found at https://developer.box.com/llms.txt. Investigated: docs 100%, sdk 0%. | A valid, comprehensive llms.txt is the machine-readable entry point for agents. |
| pass | Docs reachable, not hard auth-gatedvia docs | 30/30 | All 2 pages are publicly accessible. Investigated: docs 100%. | Agents can only index and fetch docs they can reach — past auth gates and over correct HTTP semantics. |
| pass | Registry & SDK presencevia docs | 28/28 | Indexed on Context7 (llmstxt/developer_box_llms-full_txt, 11013 snippets). Investigated: docs 100%, sdk 100%, cli 100%, mcp 0%, wellknown 0%. | Listing in MCP registries and publishing SDKs puts the API where agents and their tooling look. |
| pass | Crawlable / AEOvia wellknown | 12/12 | robots.txt lets all monitored AI crawlers reach the docs paths. Investigated: wellknown 100%. | Bots allowed plus a fresh sitemap make docs findable by agent crawlers. |
Agent UnderstandingAgents can correctly interpret your APIs — machine-readable errors, consistent descriptions, structured data, parseable docs4 pass2 warn0 fail90A+
| Signal | Points | Findings | Rationale | |
|---|---|---|---|---|
| pass | Machine-readable errors (RFC 9457)via docs | 28/28 | No error responses (4xx/5xx or a catch-all default) are documented anywhere in the spec, so an agent can't anticipate or handle failures. Investigated: docs 100%, sdk 100%, spec 50%, cli 0%. | RFC 9457 problem details and a documented error-code inventory let agents parse failures without burning tokens. |
| pass | Operation purpose clarityvia sdk | 25/25 | Surface uses a single dominant casing convention (camelCase). Investigated: sdk 100%, spec 70%. | Agents select the right endpoint from its summary + operationId; clear, named operations make tool-selection reliable — the strongest driver of correct tool choice. |
| pass | Agent-navigable, token-efficient docsvia docs | 22/22 | All 2 pages contain server-rendered content. Investigated: docs 100%. | Server-rendered, clean, small-footprint docs are what an agent can cheaply fetch and parse correctly. |
| pass | Docs structured datavia docs | 8/8 | Machine-readable JSON-LD Article markup on 20 of 20 assessed pages (100%), with dateModified present. Investigated: docs 100%. | Structured data (JSON-LD/schema.org) on docs pages gives agents an unambiguous parse target and is what answer engines cite. Detected on the JS-rendered head (Firecrawl) for a bounded page budget, so JS-injected JSON-LD is now caught; pages we can't render are excluded rather than failed. |
| warn | Agent instructions file (AGENTS.md)via sdk | 5/10 | No agents.md or skill.md context file found (nice-to-have for agent operation). Investigated: sdk 50%, cli 0%, wellknown 0%. Fix: Add an agents.md or skill.md describing how an agent should use this SDK (auth setup, key operations, gotchas). | An AGENTS.md gives coding agents explicit setup, auth, and usage instructions to interpret and operate the API — beyond llms.txt's link index. |
| warn | Description consistency across surfaces | 0.6/7 | Mean pairwise description similarity across 2 surfaces (spec, docs) is 3% (threshold 35% for full credit). Fix: Align the API description across spec, docs, and SDK so an agent reading any one surface gets the same story. | Every surface tells the same story about what the product is. |
Agent UsabilityAgents have the context to use your APIs reliably, not just find them4 pass1 warn0 fail87A
| Signal | Points | Findings | Rationale | |
|---|---|---|---|---|
| pass | Idempotency documentedvia sdk | 27/27 | Built-in retry machinery is present (grep-derived). Investigated: sdk 100%, spec 0%, docs 0%, cli 0%. | Documented idempotency lets agents retry safely. |
| pass | Pagination documented & consistentvia sdk | 22/22 | 7/7 list method(s) return an auto-paginating iterable. Investigated: sdk 100%, spec 50%, docs 50%. | Consistent, documented pagination lets agents traverse collections. |
| pass | Sandbox separationvia sdk | 20/20 | Sandbox environments are exposed (sandbox). Investigated: sdk 100%, spec 0%, docs 0%. | An isolated environment lets agents exercise destructive operations safely. |
| pass | Runnable collection with test scriptsvia sdk | 9/9 | README is present and includes a runnable quickstart. Investigated: sdk 100%, platform 50%. | A public, maintained collection with assertions is runnable truth agents validate against. |
| warn | Rate-limit signalingvia spec | 6.6/22 | No rate-limit response headers are documented, so an agent can't tell when it is approaching a limit and will get throttled. Investigated: spec 30%, docs 30%. Fix: Add x-ratelimit-* response headers and document retry-after semantics. | Machine-readable rate-limit headers let agents throttle adaptively. |
Resources Discovered
The public resources we found for Box — the evidence behind the score. All discovered from public sources; nothing here requires access to your systems.
| Agent hints | Context7 (11,013) |
|---|---|
| APIs analyzed | 5 — Box Platform API (JP), Box Platform API, Main API, Vendors API, Box AI (beta) |