Team-level sharing with Dropbox Business

Dropbox Business accounts open up team-scoped sharing workflows that go beyond what’s possible with individual accounts. Using two different application permission types — team member management and team member file access — you can automate group administration, grant folder access in bulk, and control how shared links behave inside your team.

Setting up a team member management app

The first step is creating an app with the right Business access type. From the App console:

  1. Create a new app and select Dropbox Business API.
  2. Choose Team member management as the access type.
  3. Name the app and create it.
  4. Generate an access token and store it in your application.
team_member_token = 'your_team_member_management_token'
dbx_team_members = dropbox.DropboxTeam(team_member_token)

This permission lets you manage team members and groups via the API, which is useful when you need to onboard people and organize them into shared access groups programmatically.

Adding members and building groups

Inviting new members to the team is straightforward with the /team/members/add endpoint:

students = [('Amy', 'Smith', '[email protected]'), ('Bill', 'Jones', '[email protected]', 'Varna', 'Patel', '[email protected]')]
students_to_add = []
for first_name, last_name, email in students:
    member = dropbox.team.MemberAddArg(
        member_email=email, 
        member_given_name=first_name,  
        member_surname=last_name, 
        send_welcome_email=True
    )
    students_to_add.append(member)
team_add_request = dbx_team_members.team_members_add(students_to_add)
print(team_add_request)

Once members are on the team, you can sort them into Dropbox groups. Groups give you a single reference — a group_id — that you can use when granting access, instead of iterating over individual members.

Creating a group with your own external identifier is the first step:

create_request = dbx_team_members.team_groups_create(
    group_name='Field Research Group', 
    group_external_id='field_research_group_fall_2019'
)
print(create_request)

Groups can have a designated owner who manages membership. For example, you might assign a teaching assistant as the owner of a group so they can move students between groups as needed:

selected_group = dropbox.team.GroupSelector.group_external_id('field_research_group_fall_2019')
selected_user = dropbox.team.UserSelectorArg.email('[email protected]')
# access_type defaults to viewer if left blank
selected_access_type = dropbox.team.GroupAccessType.owner
member_access = dropbox.team.MemberAccess(
    user=selected_user,
    access_type=selected_access_type
)
owner_add_request = dbx_team_members.team_groups_members_add(
    group=selected_group,
    members=[member_access]
)
print(owner_add_request)

With the group and its owner in place, you can add members in bulk:

field_research_group = ['[email protected]', '[email protected]']
new_group_members = []
selected_group = dropbox.team.GroupSelector.group_external_id('field_research_group_fall_2019')
for member_email in field_research_group:
    selected_user = dropbox.team.UserSelectorArg.email(member_email)
    selected_access_type = dropbox.team.GroupAccessType.member
    member_access = dropbox.team.MemberAccess(
        user=selected_user,
        access_type=selected_access_type
    )
    new_group_members.append(member_access)
     
group_add_request = dbx_team_members.team_groups_members_add(
    group=selected_group,
    members=new_group_members
)
print(group_add_request)

Note that write operations like member and group management require team member management permission. Read-only operations via /teams/members/list and /teams/groups/list only need team information permission. Many teams manage their directory outside the API — in the Admin Console, via an identity management tool, or through a directory connector — and only need to read this data from Dropbox.

Acting on behalf of team members

Team administrators can also work with member content directly, provided the app has the Member file access permission. This is a separate app with a different access type:

  1. Create a second app from the App console.
  2. Select Dropbox Business API.
  3. Choose Team member file access.
  4. Name the app and create it, then generate an access token.
team_file_token = 'your_team_file_access_token

Because this is a team-linked app, calls to Dropbox User Endpoints must include the Dropbox-API-Select-User header to act as a specific user. First, resolve the team_member_id:

user = dropbox.team.UserSelectorArg.email('[email protected]')
member = dbx_team_members.team_members_get_info([user])
if member[0].is_member_info():
    member_info = member[0].get_member_info()
    team_member_id = member_info.profile.team_member_id
print(f'You grabbed {member_info.profile.name}s team member id:{team_member_id}')

Then instantiate the SDK to operate as that user:

dbx_as_user = dropbox.DropboxTeam(team_file_token).as_user(team_member_id)
# a quick test call to verify our assume user calls work:
print(dbx_as_user.sharing_list_folders())

Once you can act as a user, you're ready to administer sharing on their behalf. The examples below assume you have an dbx_as_user client created this way.

Sharing a folder with a group

Group-based sharing means you can grant folder access to everyone in a group at once, and that access persists automatically when members join or leave the group. You need two identifiers to make the call:

  • group_id — identifies the Dropbox group
  • shared_folder_id — identifies the shared folder

These come from different endpoints, and each requires the appropriate access token. To look up the group:

selected_group = dropbox.team.GroupsSelector.group_external_ids(['field_research_group_fall_2019'])
groups = dbx_team_members.team_groups_get_info(selected_group)
if groups[0].is_group_info():
    group = groups[0].get_group_info()
    target_group_id = group.group_id
print(f'grabbed {group.group_name} with group id {target_group_id}')

To find an existing shared folder's ID:

shared_folders = dbx_as_user.sharing_list_folders()
for folder in shared_folders.entries:
    # filter out your target folder by name
    if folder.name == "field_research_team_folder":
        target_shared_folder_id = folder.shared_folder_id
        print(f'grabbed {folder.name}, shared folder id: {target_shared_folder_id}')

This snippet only works when the folder is already shared. To create a new shared folder, use /sharing/share_folder instead.

With both IDs, you can grant the entire group access to the folder and everything in it — no member-by-member enumeration needed:

selected_group = dropbox.sharing.MemberSelector.dropbox_id(target_group_id)
# leaving out access level defaults to viewer
target_access_level = dropbox.sharing.AccessLevel.editor
add_group_member = dropbox.sharing.AddMember(
    member=selected_group,
    access_level=target_access_level
)
dbx_as_user.sharing_add_folder_member(
    shared_folder_id=target_shared_folder_id,
    members=[add_group_member]
)
print("successfully shared to group")

Using groups for shares has two operational advantages:

  • Groups can be applied to multiple folders with different access levels, giving you bulk control over permissions.
  • Membership changes automatically propagate to existing shares — when someone joins or leaves the team, their access is added or revoked without extra API calls.

Shared folders aren't the only way collaborators exchange files. Shared links are useful for quick distribution, but in a team context you'll want to control how far those links reach.

Creating team-only links

If a file should be accessible only to people on your team, you can create a shared link with scope restricted to the team. Call /sharing/create_shared_link_with_settings and pass the appropriate setting:

team_audience = dropbox.sharing.LinkAudience.team
link_settings = dropbox.sharing.SharedLinkSettings(audience=team_audience)
file_path = '/field_research_team_folder/field_data.xls'
link = dbx_as_user.sharing_create_shared_link_with_settings(
    file_path=path,
    settings=link_settings
)
print(link)

Locking down folder link policies

Individual users might create links that are broader than you intend, and tracking every unique link is impractical since links are per-user and per-content. Instead of relying on users to set the right scope each time, you can enforce a policy on the shared folder itself.

Note that who can change the policy depends on ownership. A member-owned shared folder can have its settings updated by the owner via API. A team-owned folder's settings must be changed in the Admin Console.

To update a folder owned by a specific team member — say, a teaching assistant — you act as that user with the appropriate header. The team_member_id and target_shared_folder_id come from the earlier lookup snippets:

dbx_as_user = dropbox.DropboxTeam(team_file_token).as_user('pauls_team_member_id')

You then update the folder's link policy, restricting new shared links so they're only accessible to members of that shared folder:

new_link_policy = dropbox.sharing.SharedLinkPolicy.members
policy_update_request = dbx_as_user.sharing_update_folder_policy(
    shared_folder_id=target_shared_folder_id, 
    shared_link_policy=new_link_policy
)
print(policy_update_request)

With this policy in place, any shared link created by members of the group will be constrained to their folder's members, and the consistent behavior makes those links easier to discover from your app — you know exactly where to look and what scope to expect.

Team Folders and Team Space

Dropbox Business accounts can organize content using team folders or team space. In both models, an administrator creates top-level folders and shares them with groups. Nested shares can then be created inside those folders to grant or restrict access for additional users. When someone joins a group, they automatically inherit access to that group's existing shares.

A folder tree such as /Field_Research/Lab Reports Spring 2020 can have different policies at each level. For instance, the Field_Research folder might be read-only for students viewing assignments, while the nested Lab Reports Spring 2020 folder is read-write so students can submit their work. The Dropbox Business APIs let you manage team shares with the same sharing endpoints used for standard user shares.

The two patterns—Team Folders and Team Space—depend on your account type. You can identify which one you're on visually: a purple folder in the home directory indicates Team Space.

Your name will appear under a purple folder like this inside a team space

You can also check programmatically using the API:

team_features = dropbox.team.Feature.has_team_shared_dropbox
is_team_space = dbx_team_members.team_features_get_values([team_features])
print(is_team_space)

If has_team_shared_dropbox resolves to True, your team uses Dropbox Team Space.

How the two team models differ

  • Team Folders: Created with /team/team_folder/create and managed via the standard sharing endpoints. These folders automatically show up inside each member's home directory.
  • Team Space: Managed shares are created in the team's root namespace using /sharing/add_folder_member/. Each member's home directory is mounted inside the shared team space. API callers must set the Dropbox-API-Path-Root header to read from and write to the team root.

Both patterns share two core behaviors. First, top-level folders are owned by the team rather than an individual member. Managing their creation, membership, or policies requires the Dropbox-API-Select-Admin header. Second, members can create shares nested inside team shares. Permissions are inherited by default but this inheritance can be disabled, enabling restrictive access control lists (rACLs) as a future topic.

Updating folder policy in a Team Space

Working in a Team Space adds a couple of API steps when you want to change the policy of a folder like Lab Reports Spring 2020. First, you must act as an admin by supplying the Dropbox-API-Select-Admin header with an admin account_id.

team_list = dbx_team_members.team_members_list()
for member in team_list.members:
    if member.role.is_team_admin():
        selected_admin = member.profile.account_id
        break

Note: the snippet above selects the first admin from the team member list. A production app might instead select an admin by email or team_member_id.

Second, set the root directory to the shared team space with the Dropbox-API-Path-Root header. You'll need the root_namespace_id of the shared space, which you can obtain by selecting a user and calling users/get_current_account.

account_info = dbx_as_user.users_get_current_account()
root_namespace_id = account_info.root_info.root_namespace_id
team_root_namespace = dropbox.common.PathRoot.namespace_id(root_namespace_id)

With the admin and namespace variables set, instantiate the Dropbox SDK as an admin with the specific root folder:

dbx_as_admin_team_root = dropbox.DropboxTeam(team_file_token).with_path_root(team_root_namespace).as_admin(selected_admin)

You can now update the folder's sharing policy:

# Note: we're using the Dropbox-API-Select-User header to list folders
shared_folders = dbx_as_user.sharing_list_folders()
for folder in shared_folders.entries:
    if folder.name == "Lab Reports Spring 2020":
        student_reports_folder = folder.shared_folder_id 
 
new_link_policy = dropbox.sharing.SharedLinkPolicy.anyone
# Note: now we're using the Select-Admin and Path-Root header to update the policy
policy_update_request = dbx_as_admin_team_root.sharing_update_folder_policy(
    shared_folder_id=student_reports_folder, 
    shared_link_policy=new_link_policy
)
print(policy_update_request)

The shared link policy for /Field_Research/Lab Reports Spring 2020 is now updated.

For more detail, consult the Namespace Guide, Content Access Guide, and Business API Documentation. The next sharing post will cover rACLs and inherited permissions in depth.