Improving your User Lifecycle Management with the Dropbox API

Keeping Team Access Current as People Change

Managing who can reach your company’s Dropbox files is a constant task. New hires need access on day one, and departing employees need their access revoked quickly to protect sensitive data. Doing this by hand—typing emails, clicking through admin panels—is slow and prone to mistakes, especially as your team scales. Automating this "user provisioning" workflow with the Dropbox Business API removes the guesswork and keeps your data secure and compliant with regulations like GDPR and LGPD.

Below are examples in Python using the official Dropbox SDK. You'll need a team member management access token from your app in the App Console to follow along. Start by importing the library and establishing a connection with that token:

import dropbox
token = '<your_team_member_management_access_token>'
dbx_team = dropbox.DropboxTeam(token)

Adding New Members

To bring a new employee onto your Dropbox Business team, you define their profile with dropbox.team.MemberAddArg() and pass it to team_members_add(). For example, adding a new hire named Amy Smith:

email = '[email protected]'
first_name = 'Amy'
last_name = 'Smith'
member = dropbox.team.MemberAddArg(
        member_email=email, 
        member_given_name=first_name,  
        member_surname=last_name, 
        send_welcome_email=True)
dbx_team.team_members_add([member])

If Amy doesn't already have a Dropbox account, she'll receive an email invitation to create one. The example sets send_welcome_email=True, which is the default; set it to False for "silent invitations," often used with Single Sign-On (SSO) where you'd rather instruct employees on joining through your own authentication flow. If she does have an existing personal account, she'll be prompted to either join the team (moving her personal files into a private folder) or decline the invitation.

To add many employees at once, loop through your employee data—for instance, a list of contacts:

Accounts
>>>
[['Amy', 'Smith', '[email protected]'],
 ['Bob', 'Johnson', '[email protected]']]

and pass each one to the API in a for loop:

for account in Accounts:
    email = Accounts[account][2]
    first_name = Accounts[account][0]
    last_name = Accounts[account][1]
    member = dropbox.team.MemberAddArg(
            member_email=email, 
            member_given_name=first_name,  
            member_surname=last_name, 
            send_welcome_email=True
        )
    dbx_team.team_members_add([member])

This pattern works regardless of where your employee list lives—an HR system, a spreadsheet export, or any other master source—so you can tailor it to your own workflow and avoid manual email typos entirely.

Removing or Suspending Departing Employees

When someone leaves permanently, you need to remove them from the team. Select the user with dropbox.team.UserSelectorArg() using their email, Team Member ID, or external ID (the latter is common for identity management systems), then call team_members_remove():

dbx_team.team_members_remove(user, 
    wipe_data=True, 
    transfer_dest_id=None, 
    transfer_admin_id=None, 
    keep_account=False) 

This call requires three key decisions that affect your parameters:

• Delete or downgrade? Set keep_account to True to convert their team account to a free Basic account (useful for temporary contractors who brought their own account). Otherwise, the account is deleted.
• Transfer files? If team files need to remain accessible, specify another user with transfer_dest_id and an admin to handle errors via transfer_admin_id. If you skip this, files stay in the team until you use the /members/move_former_member_files endpoint.
• Wipe devices? Set wipe_data to True to erase the account's files from all linked devices. Note that you can't wipe data if you downgrade the account (keep_account=True).

A typical removal—deleting the account, wiping device data, and not transferring files—looks like this:

user = dropbox.team.UserSelectorArg.email('[email protected]')
dbx_team.team_members_remove(user, wipe_data=True, transfer_dest_id=None, transfer_admin_id=None, keep_account=False)

Mistaken removals aren't permanent: you have seven days to recover a deleted team member via team_members_recover():

user = dropbox.team.UserSelectorArg.email('[email protected]')
dbx_team.team_members_recover(user)

Caveat: you can't recover someone who was downgraded to a Basic account—you'd need to re-invite them as a new member. Because of this seven-day window, deletion isn't suitable for temporary departures like parental leave. Instead, suspend the account. Most Identity and Access Management partner tools integrate with Dropbox use this approach by default.

Suspension works similarly, but with team_members_suspend():

user = dropbox.team.UserSelectorArg.email('[email protected]')
dbx_team.team_members_suspend(user, wipe_data=True)

The wipe_data option here is useful if an employee lost a device containing sensitive files. When they return, reactivate them with team_members_unsuspend():

box.team.UserSelectorArg.email('[email protected]')
dbx_team.team_members_unsuspend(user)

With suspend and remove calls at your disposal (and the ability to batch them in loops like the add example), you have complete control over who's on your team—and who's not—at every stage of the employee lifecycle.

Beyond Member Add and Remove: More Dropbox API Automation

The Dropbox Business API plus a few Python scripts can take user lifecycle management well past the basics. Member provisioning and deprovisioning — adding, removing, and suspending team members — is only one slice of what the API exposes. The same endpoint family also covers group management, admin permission grants, secondary email configuration, and per-member space limits.

Automating these tasks cuts down the time IT spends on manual access requests and reduces the security gaps that appear when accounts linger after an employee leaves. A script can provision access before a new hire's first day, so they are productive from the moment they log in.

What Else the Business API Handles

The Dropbox Business API documentation lists operations that go beyond the core member lifecycle:

• Group management — create and maintain groups so permissions are applied consistently.
• Administrative permissions — grant or revoke admin roles as responsibilities change.
• Secondary email addresses — attach an alternate email to a member account.
• Member space limits — set or update storage caps per user.

Each of these pairs naturally with the account provisioning and deprovisioning flows, letting a single orchestration script handle the full arc from onboarding to offboarding. Reviewing the Dropbox Business API documentation will surface the full catalog of automatable team operations.

Getting Help and Building

For questions about user lifecycle management or general help building with the Dropbox API, you can reach the team through the developer contact page or post on the developer forum. Start building at www.dropbox.com/developers.