Dropbox setup

ConfigView reads your Dropbox team through Dropbox’s Business (team) API, using a small Dropbox app that your own team admin creates in the Dropbox App Console and authorises once for the team. ConfigView is not a published Dropbox app; nothing is installed from a marketplace. You will end up with 3 secrets in ConfigView (DROPBOX_APP_KEY, DROPBOX_APP_SECRET and DROPBOX_REFRESH_TOKEN) when setup is complete.

Scope of this integration today. ConfigView reads who is on your Dropbox team and with which admin role, your groups, the third-party apps each person has connected to their Dropbox, every computer, phone and browser signed in to each account, your team’s sharing and link policies, and Dropbox’s audit log: sign-ins, sharing with people outside the company, app links, device links, member and admin changes, two-step verification and policy changes. ConfigView only reads. It never opens, lists or downloads files, and it never reads file or folder names.

Plan: any Dropbox team plan (Standard, Advanced, Business, Business Plus, Enterprise). Personal plans (Basic, Plus, Essentials, Family) have no team API.

Step 1: Open the Dropbox page in ConfigView

Open ConfigView in a second browser tab and leave it open: https://{companyname}.configview.com/admin/integrations/dropbox

Step 2: Create the Dropbox app

You need to be a Team admin in Dropbox. The app is created under your own Dropbox account and stays in Dropbox’s development status, which is all a single team needs: there is nothing to submit to Dropbox for review.

Go to dropbox.com/developers/apps while signed in as the team admin and click Create app
Choose an API: Scoped access
Choose the type of access you need: Full Dropbox. Dropbox only offers team permissions to Full Dropbox apps. ConfigView does not use any file permission
Name your app: something unique, e.g. ConfigView - {Company}. Click Create app
Open the Permissions tab. Under Team scopes, tick exactly these:

Scope	What ConfigView reads with it
`team_info.read`	Licence counts, sharing and link policies, which admin authorised the app
`members.read`	Team members, their roles and status
`groups.read`	Groups and who is in them
`sessions.list`	Linked third-party apps, and signed-in devices and browsers
`events.read`	The audit log

account_info.read is always ticked by Dropbox and cannot be removed; leave it. Do not tick any files.*, sharing.*, team_data.* or *.write scope. If Dropbox ticks a scope automatically because another one depends on it, leave it ticked. 6. Click Submit at the bottom of the Permissions tab 7. Open the Settings tab. Copy the App key into DROPBOX_APP_KEY in ConfigView, then click Show beside App secret and copy it into DROPBOX_APP_SECRET. Click the save icon

Step 3: Authorise the app for your team and get a refresh token

This is a one-time step. Still signed in to Dropbox as the team admin:

Paste this address into your browser, replacing APP_KEY with your app key: https://www.dropbox.com/oauth2/authorize?client_id=APP_KEY&response_type=code&token_access_type=offline
Dropbox shows the permissions the app asks for, on behalf of your team. Click Continue, then Allow
Dropbox shows an access code. Copy it. The code works once and only for a few minutes, so do the next step straight away

Exchange the code for a refresh token. In a terminal (macOS, Linux, or Windows 10+ Command Prompt), replacing the three values:

curl https://api.dropboxapi.com/oauth2/token \
  -d code=ACCESS_CODE \
  -d grant_type=authorization_code \
  -u APP_KEY:APP_SECRET

or in Windows PowerShell:

Invoke-RestMethod -Method Post -Uri https://api.dropboxapi.com/oauth2/token `
  -Body @{code='ACCESS_CODE'; grant_type='authorization_code'; client_id='APP_KEY'; client_secret='APP_SECRET'}

The answer is a short block of JSON. Copy the value of refresh_token (not access_token, which starts with sl. and expires in four hours) into DROPBOX_REFRESH_TOKEN in ConfigView and click the save icon. The answer should also contain a team_id; if it does not, the person who clicked Allow was not a team admin. Start step 3 again as a team admin

The refresh token does not expire. ConfigView trades it for a short-lived access token on each run. If you change the ticked scopes later, click Submit again and repeat this step: a refresh token keeps the permissions it was issued with. To revoke ConfigView’s access, delete the app in the App Console; every token it issued stops working.

Step 4: Connect and verify

Back on https://{companyname}.configview.com/admin/integrations/dropbox, confirm the three credentials show as saved
Click Connect. ConfigView creates its tables and schedules every collector at your default run time. Stop any you don’t want under Collectors:

Script	Notes
Team & Sharing Policies	The team’s licence count and its sharing rules: who can see shared links by default, whether outsiders can join shared folders, link passwords and expiry, who can create groups, and which admin authorised ConfigView.
Members	Every Dropbox team member, including suspended, invited and removed ones: name, email, admin role, status, licence type, groups, and when they were invited, joined or suspended.
Groups	The team’s Dropbox groups: name, how many members, and whether admins, members or Dropbox manage them.
Group Members	Who is in each Dropbox group, and who manages it. Runs after Groups.
Linked Apps	Every third-party app each member has connected to their Dropbox, when it was connected, who publishes it, and whether it can see the whole Dropbox or only its own folder. Runs after Members.
Devices & Sessions	Every web session, desktop app and mobile app signed in to each member’s Dropbox: device name, client and version, operating system, IP address and country of last activity, and when it was first and last used. Runs after Members.
Team Events (Audit Log)	Dropbox’s audit log, kept as a growing history: sign-ins and failed sign-ins, sharing with people outside the company, apps linked and unlinked, devices, member and admin-role changes, two-step verification and policy changes. File activity is not collected, and file names and links are removed.

Click Verify now. The health check confirms the three secrets, trades the refresh token for an access token, shows which admin authorised it, then makes one small read with each of the five scopes.

If a check fails:

“Dropbox refused the refresh token”. The token was revoked, the app was deleted, or DROPBOX_APP_KEY / DROPBOX_APP_SECRET belong to a different app. Check the key and secret on the app’s Settings tab, then repeat step 3.
“needs the ’…’ scope”. That scope was not ticked when the refresh token was made. Tick it, click Submit, and repeat step 3.
“this is a user token, not a team token”. Whoever clicked Allow was not a team admin, or no team scope was ticked. Repeat step 3 as a team admin.
Audit log shows skip. Your plan or settings do not let the API read the audit log. Everything else still works; the audit table stays empty.

Data Tables

Once the scripts run, these tables are created in your database. Each includes a run_at column. Every table keeps only the newest run, except the audit log, which keeps everything it has ever collected.

Table	Source	Key Columns
`dropbox_team`	`team/get_info`, `team/features/get_values`, `team/token/get_authenticated_admin`	team_id, name, num_licensed_users, num_provisioned_users, num_used_licenses, shared_folder_member_policy, shared_folder_join_policy, shared_link_create_policy, shared_folder_link_restriction_policy, enforce_link_password_policy, default_link_expiration_days_policy, shared_link_default_permissions_policy, group_creation_policy, emm_state, office_addin_policy, suggest_members_policy, top_level_content_policy, has_team_shared_dropbox, has_team_file_events, has_team_selective_sync, authorized_by_email, authorized_by_team_member_id, policies_json
`dropbox_members`	`team/members/list_v2`	team_member_id, account_id, external_id, persistent_id, email, email_verified, secondary_emails, display_name, given_name, surname, status, removed_recoverable, membership_type, invited_on, joined_on, suspended_on, is_directory_restricted, roles, role_ids, is_admin, group_ids, group_count
`dropbox_groups`	`team/groups/list`	group_id, group_name, group_external_id, member_count, group_management_type
`dropbox_group_members`	`team/groups/members/list`	group_id, group_name, team_member_id, member_email, member_status, access_type
`dropbox_linked_apps`	`team/linked_apps/list_members_linked_apps`	team_member_id, member_email, member_status, app_id, app_name, publisher, publisher_host, linked, is_app_folder
`dropbox_devices`	`team/devices/list_members_devices`	team_member_id, member_email, member_status, session_type, session_id, device_name, client_type, client_version, platform, os_version, browser, ip_address, country, created, updated, expires, is_delete_on_unlink_supported
`dropbox_team_events`	`team_log/get_events`	event_hash, event_time, event_category, event_type, event_type_description, actor_type, actor_kind, actor_email, actor_name, actor_team_member_id, context_type, context_email, context_team_member_id, involve_non_team_member, participant_emails, participant_groups, external_recipient_emails, app_id, app_name, access_method, ip_address, city, region, country, asset_count, asset_types, details
`dropbox_team_event_sync`	(ConfigView)	category, complete_through, last_run_at, last_status, last_rows, last_calls, message

status is active, invited, suspended or removed. Suspended members can be restored with everything they had, including admin roles. roles lists admin roles by name (Team admin, User management admin, Support admin, Billing admin, …); is_admin is 1 when someone holds any of them. is_app_folder is 1 when a linked app can only see its own folder in that person’s Dropbox, and 0 when it can read and write everything they can. session_type is web (a browser session), desktop (the Dropbox desktop app; device_name is the computer’s name) or mobile (the phone or tablet app). event_category and event_type are Dropbox’s own names, e.g. logins / login_success, sharing / shared_content_add_invitees, apps / app_link_team, tfa / tfa_change_status. external_recipient_emails lists outside addresses something was shared with. details holds the rest of the event as JSON, with Dropbox’s {".tag": …} values kept as they are.

Things worth knowing

Apps linked to the whole team are not in dropbox_linked_apps. Dropbox lists those separately from the apps people link to their own accounts. ConfigView reads them from the audit log (app_link_team / app_unlink_team events); the ConfigView app itself is one of them. There is no “has two-step verification” field. Dropbox’s API does not report each member’s current two-step setting. ConfigView reads the history of two-step changes from the audit log instead, the full history Dropbox still holds on the first run. Someone who turned it on before that history begins shows as “no record”; check them in the Admin console. The first audit-log run is a backfill. It reads every two-step verification, policy and app event Dropbox still holds, and the last 90 days of the other categories, a week at a time. It stops starting new pages after 25 minutes and the next run carries on from where it got to (dropbox_team_event_sync.complete_through). Dropbox gives audit events no id. ConfigView builds one (event_hash) from the whole event, so re-reading the same hour never creates duplicates. If the admin who authorised the app leaves. The token belongs to the team, but authorized_by_email in dropbox_team shows whose consent it rests on. If that person is removed or loses the Team admin role, repeat step 3 as another team admin. Rate limits. Dropbox publishes no numeric API limit. ConfigView paces itself (one call a second; two for the audit log) and waits as long as Dropbox asks when it answers 429.

What isn’t collected

Files, folders and Paper documents: no contents, no names, no paths. ConfigView holds no file permission
File operations, Paper, comments, file requests, Showcase and Dropbox Sign events from the audit log
Shared-link URLs, file and folder names, and paths inside audit events. Keys that hold them are removed from details before it is stored; the files an event touched are kept only as a count and a kind (asset_count, asset_types)
Profile photo URLs, browser user-agent strings and mobile carriers
The app secret and tokens never leave Secret Manager; they are not written to any table

Platform

Integrations

Step 1: Open the Dropbox page in ConfigView

Step 2: Create the Dropbox app

Step 3: Authorise the app for your team and get a refresh token

Step 4: Connect and verify

Data Tables

Things worth knowing

What isn’t collected

​Step 1: Open the Dropbox page in ConfigView

​Step 2: Create the Dropbox app

​Step 3: Authorise the app for your team and get a refresh token

​Step 4: Connect and verify

​Data Tables

​Things worth knowing

​What isn’t collected

Step 1: Open the Dropbox page in ConfigView

Step 2: Create the Dropbox app

Step 3: Authorise the app for your team and get a refresh token

Step 4: Connect and verify

Data Tables

Things worth knowing

What isn’t collected