Box Sign Signature Requests
When a contract already lives in Box, send it for signature without leaving it: create a Box Sign request from one or more Box files or a saved sign template, track each signer's status, nudge people who have not signed with a resend, and cancel a request that went out by mistake.
Connect this API to an AI agent Browse all specs
What you can do with Box Sign Signature Requests via MCP
Every endpoint below becomes a governed tool your AI agent (Claude, ChatGPT, or a customer-facing VX agent) can call — with scoped permissions, sandbox testing, and audit logs.
| Method | Path | Operation | Description |
|---|---|---|---|
| GET | /sign_requests |
listSignRequests | List signature requests you sent, newest first |
| POST | /sign_requests |
createSignRequest | Send Box files or a template out for signature |
| GET | /sign_requests/{sign_request_id} |
getSignRequest | Get a request's status and where each signer is |
| GET | /sign_templates |
listSignTemplates | List saved Box Sign templates |
| GET | /sign_templates/{template_id} |
getSignTemplate | Get a template's signer roles and fields |
| POST | /sign_requests/{sign_request_id}/resend |
resendSignRequest | Email a reminder to signers who have not signed yet |
| POST | /sign_requests/{sign_request_id}/cancel |
cancelSignRequest | Cancel a request that has not been completed |
Authentication
box_oauth
OAuth 2.0
Scopes: sign_requests.readwrite root_readwrite
Box OAuth 2.0 access token, sent as Authorization: Bearer <token>.
How to get a credential
- Open the Box Developer Console (https://app.box.com/developers/console) and click Create Platform App > Custom App.
- Choose User Authentication (OAuth 2.0), and add the VX Agents OAuth redirect URL shown on the credential form.
- Under Application Scopes, enable Read and write all files and folders stored in Box and Manage signature requests.
- Copy the Client ID and Client Secret into a VX Agents OAuth2 credential and sign in with the Box user who sends the documents. Box Sign must be enabled for that user's account.
Permissions used
| Scope | Operations |
|---|---|
sign_requests.readwrite |
listSignRequests, getSignRequest, createSignRequest, resendSignRequest, cancelSignRequest, listSignTemplates, getSignTemplate |
root_readwrite |
createSignRequest (reads the source files and writes the signed copy to the parent folder) |
Common errors
| Status | Meaning | Fix |
|---|---|---|
| 401 | Token expired or revoked | Reconnect the credential; Box access tokens last about an hour and refresh automatically. |
| 403 | Scope missing, Box Sign disabled, or no access to the file or folder | Enable the scopes above, ask the Box admin to enable Box Sign, and use files the user can edit. |
| 400 | Bad request | Check that source_files are file ids, parent_folder is a folder id, and each signer has an email. |
| 404 | Sign request or template not found | Use ids from listSignRequests / listSignTemplates. |
| 429 | Rate limit | Wait for the retry-after time and retry. |
Store it as a VX Agents OAuth2 credential.
Usage guide
Setup
- Connect a VX Agents OAuth2 credential for a Box Custom App (User Authentication, OAuth 2.0) with the scopes Read and write all files and folders and Manage signature requests. Requests are sent as the Box user who signs in, and Box Sign must be enabled for their account.
- Worth pinning:
parent_folderoncreateSignRequest(the Box folder id where signed copies should be saved, e.g.Contracts/Signed).
Send a document for signature
- Find the file id of the document in Box (the number at the end of its Box URL), or pick a template:
listSignTemplates, thengetSignTemplateto see its signer roles and whether emails are already set. - Draft the request and show it to the user: document(s), signer emails and order, subject and message. After they confirm,
createSignRequestwith:source_files:[{"type": "file", "id": "<file id>"}](up to 10 files), ortemplate_idfor a template;signers:[{"email": "[email protected]", "role": "signer", "order": 1}](rolecan also beapproverorfinal_copy_reader);parent_folder:{"type": "folder", "id": "<folder id>"};- optional
name,email_subject,email_message,days_valid(up to 730),are_reminders_enabled,external_id(your deal or contract number).
- Track it:
getSignRequestreturnsstatusand, per signer, whether they viewed, signed or declined.listSignRequestslists recent requests (page withmarker). - If someone is slow, confirm and
resendSignRequest(emails outstanding signers again). If the request was a mistake, confirm andcancelSignRequest.
Good to know
- Request
statusvalues: converting, created, sent, viewed, signed, cancelled, declined, expired, finalizing, plus error_converting / error_sending / error_finalizing. - With
are_reminders_enabled, Box reminds outstanding signers on days 3, 8, 13 and 18. - When everything is signed, Box saves the signed document and a signing log into
parent_folder(the root folder0cannot be used). is_document_preparation_needed: truereturns aprepare_urlso the sender can place signature fields in the Box UI before it is sent.- Every create, resend or cancel emails real people: always confirm first. Deleting sign requests is not part of this spec.
Source: Box Sign API reference (https://developer.box.com/reference/resources/sign-request/), checked 2026-10-20.
How to use this spec
- Create a free VX Agents account (sandbox tools included).
- Open the marketplace and connect “Box Sign Signature Requests” to an agent.
- Expose it as an MCP server for Claude/ChatGPT, or chat with it directly.