---
title: "Update collaboration"
method: PUT
path: "/collaborations/{collaboration_id}"
tags: ["Collaborations"]
---

# Update collaboration

`PUT /collaborations/{collaboration_id}`

Updates a collaboration.
Can be used to change the owner of an item, or to
accept collaboration invites. In case of accepting collaboration invite, role is not required.

## Path parameters

- `collaboration_id` string, required

## Request body

- object
  - `role` 'editor' | 'viewer' | 'previewer' | 'uploader' | 'previewer uploader' | 'viewer uploader' | 'co-owner' | 'owner' — The level of access granted.
  - `status` 'pending' | 'accepted' | 'rejected' — Set the status of a `pending` collaboration invitation, effectively accepting, or rejecting the invite.
  - `expires_at` string, date-time — Update the expiration date for the collaboration. At this date, the collaboration will be automatically removed from the item. This feature will only work if the **Automatically remove invited collaborators: Allow folder owners to extend the expiry date** setting has been enabled in the **Enterprise Settings** of the **Admin Console**. When the setting is not enabled, collaborations can not have an expiry date and a value for this field will be result in an error. Additionally, a collaboration can only be given an expiration if it was created after the **Automatically remove invited collaborator** setting was enabled.
  - `can_view_path` boolean — Determines if the invited users can see the entire parent path to the associated folder. The user will not gain privileges in any parent folder and therefore can not see content the user is not collaborated on. Be aware that this meaningfully increases the time required to load the invitee's **All Files** page. We recommend you limit the number of collaborations with `can_view_path` enabled to 1,000 per user. Only an owner or co-owners can invite collaborators with a `can_view_path` of `true`. Only an owner can update `can_view_path` on existing collaborations. `can_view_path` can only be used for folder collaborations. When you delete a folder with `can_view_path=true`, collaborators may still see the parent path. For instructions on how to remove this, see [Even though a folder invited via can_view_path is deleted, the path remains displayed](https://support.box.com/hc/en-us/articles/37472814319891-Even-though-a-folder-invited-via-can-view-path-is-deleted-the-path-remains-displayed).

## Response `200`

Returns an updated collaboration object unless the owner has changed.

- Collaboration — Collaborations define access permissions for users and groups to files and folders, similar to access control lists. A collaboration object grants a user or group access to a file or folder with permissions defined by a specific role.
  - `id` string, required — The unique identifier for this collaboration.
  - `type` 'collaboration', required — The value will always be `collaboration`.
  - `item` union
    - object, nullable — The bare basic representation of a file, the minimal amount of fields returned when using the `fields` query parameter.
      - `id` string, required — The unique identifier that represent a file. The ID for any file can be determined by visiting a file in the web application and copying the ID from the URL. For example, for the URL `https://*.app.box.com/files/123` the `file_id` is `123`.
      - `etag` string, nullable — The HTTP `etag` of this file. This can be used within some API endpoints in the `If-Match` and `If-None-Match` headers to only perform changes on the file if (no) changes have happened.
      - `type` 'file', required — The value will always be `file`.
      - `sequence_id` string — A numeric identifier that represents the most recent user event that has been applied to this item. This can be used in combination with the `GET /events`-endpoint to filter out user events that would have occurred before this identifier was read. An example would be where a Box Drive-like application would fetch an item via the API, and then listen to incoming user events for changes to the item. The application would ignore any user events where the `sequence_id` in the event is smaller than or equal to the `sequence_id` in the originally fetched resource.
      - `name` string — The name of the file.
      - `sha1` string, digest — The SHA1 hash of the file. This can be used to compare the contents of a file on Box with a local file.
      - `file_version` object — The information about the current version of the file.
        - `id` string, required — The unique identifier that represent a file version.
        - `type` 'file_version', required — The value will always be `file_version`.
        - `sha1` string — The SHA1 hash of this version of the file.
      - `description` string — The optional description of this file. If the description exceeds 255 characters, the first 255 characters are set as a file description and the rest of it is ignored.
      - `size` integer — The file size in bytes. Be careful parsing this integer as it can get very large and cause an integer overflow.
      - `path_collection` object — The tree of folders that this file is contained in, starting at the root.
        - `total_count` integer, required — The number of folders in this list.
        - `entries` FolderMini[], required — The parent folders for this item.
          - `id` string, required — The unique identifier that represent a folder. The ID for any folder can be determined by visiting a folder in the web application and copying the ID from the URL. For example, for the URL `https://*.app.box.com/folders/123` the `folder_id` is `123`.
          - `etag` string, nullable — The HTTP `etag` of this folder. This can be used within some API endpoints in the `If-Match` and `If-None-Match` headers to only perform changes on the folder if (no) changes have happened.
          - `type` 'folder', required — The value will always be `folder`.
          - `sequence_id` string — A numeric identifier that represents the most recent user event that has been applied to this item. This can be used in combination with the `GET /events`-endpoint to filter out user events that would have occurred before this identifier was read. An example would be where a Box Drive-like application would fetch an item via the API, and then listen to incoming user events for changes to the item. The application would ignore any user events where the `sequence_id` in the event is smaller than or equal to the `sequence_id` in the originally fetched resource.
          - `name` string — The name of the folder.
      - `created_at` string, date-time — The date and time when the file was created on Box.
      - `modified_at` string, date-time — The date and time when the file was last updated on Box.
      - `trashed_at` string, date-time, nullable — The time at which this file was put in the trash.
      - `purged_at` string, date-time, nullable — The time at which this file is expected to be purged from the trash.
      - `content_created_at` string, date-time, nullable — The date and time at which this file was originally created, which might be before it was uploaded to Box.
      - `content_modified_at` string, date-time, nullable — The date and time at which this file was last updated, which might be before it was uploaded to Box.
      - `created_by` object — The user who created this file.
        - `id` string, required — The unique identifier for this user.
        - `type` 'user', required — The value will always be `user`.
        - `name` string — The display name of this user.
        - `login` string, email — The primary email address of this user.
      - `modified_by` object — The user who last modified this file.
        - `id` string, required — The unique identifier for this user.
        - `type` 'user', required — The value will always be `user`.
        - `name` string — The display name of this user.
        - `login` string, email — The primary email address of this user.
      - `owned_by` object — The user who owns this file.
        - `id` string, required — The unique identifier for this user.
        - `type` 'user', required — The value will always be `user`.
        - `name` string — The display name of this user.
        - `login` string, email — The primary email address of this user.
      - `shared_link` object, nullable — The shared link for this file. This value will be `null` if no shared link has been created for this file.
        - `url` string, url, required — The URL that can be used to access the item on Box. This URL will display the item in Box's preview UI where the file can be downloaded if allowed. This URL will continue to work even when a custom `vanity_url` has been set for this shared link.
        - `download_url` string, url, nullable — A URL that can be used to download the file. This URL can be used in a browser to download the file. This URL includes the file extension so that the file will be saved with the right file type. This property will be `null` for folders.
        - `vanity_url` string, url, nullable — The "Custom URL" that can also be used to preview the item on Box. Custom URLs can only be created or modified in the Box Web application.
        - `vanity_name` string, nullable — The custom name of a shared link, as used in the `vanity_url` field.
        - `access` 'open' | 'company' | 'collaborators' — The access level for this shared link. * `open` - provides access to this item to anyone with this link * `company` - only provides access to this item to people the same company * `collaborators` - only provides access to this item to people who are collaborators on this item If this field is omitted when creating the shared link, the access level will be set to the default access level specified by the enterprise admin.
        - `effective_access` 'open' | 'company' | 'collaborators', required — The effective access level for the shared link. This can be a more restrictive access level than the value in the `access` field when the enterprise settings restrict the allowed access levels.
        - `effective_permission` 'can_edit' | 'can_download' | 'can_preview' | 'no_access', required — The effective permissions for this shared link. These result in the more restrictive combination of the share link permissions and the item permissions set by the administrator, the owner, and any ancestor item such as a folder.
        - `unshared_at` string, date-time, nullable — The date and time when this link will be unshared. This field can only be set by users with paid accounts.
        - `is_password_enabled` boolean, required — Defines if the shared link requires a password to access the item.
        - `permissions` object — Defines if this link allows a user to preview, edit, and download an item. These permissions refer to the shared link only and do not supersede permissions applied to the item itself.
          - `can_download` boolean, required — Defines if the shared link allows for the item to be downloaded. For shared links on folders, this also applies to any items in the folder. This value can be set to `true` when the effective access level is set to `open` or `company`, not `collaborators`.
          - `can_preview` boolean, required — Defines if the shared link allows for the item to be previewed. This value is always `true`. For shared links on folders this also applies to any items in the folder.
          - `can_edit` boolean, required — Defines if the shared link allows for the item to be edited. This value can only be `true` if `can_download` is also `true` and if the item has a type of `file`.
        - `download_count` integer, required — The number of times this item has been downloaded.
        - `preview_count` integer, required — The number of times this item has been previewed.
      - `parent` object, nullable — The folder that this file is located within. This value may be `null` for some folders such as the root folder or the trash folder.
        - `id` string, required — The unique identifier that represent a folder. The ID for any folder can be determined by visiting a folder in the web application and copying the ID from the URL. For example, for the URL `https://*.app.box.com/folders/123` the `folder_id` is `123`.
        - `etag` string, nullable — The HTTP `etag` of this folder. This can be used within some API endpoints in the `If-Match` and `If-None-Match` headers to only perform changes on the folder if (no) changes have happened.
        - `type` 'folder', required — The value will always be `folder`.
        - `sequence_id` string — A numeric identifier that represents the most recent user event that has been applied to this item. This can be used in combination with the `GET /events`-endpoint to filter out user events that would have occurred before this identifier was read. An example would be where a Box Drive-like application would fetch an item via the API, and then listen to incoming user events for changes to the item. The application would ignore any user events where the `sequence_id` in the event is smaller than or equal to the `sequence_id` in the originally fetched resource.
        - `name` string — The name of the folder.
      - `item_status` 'active' | 'trashed' | 'deleted' — Defines if this item has been deleted or not. * `active` when the item has is not in the trash * `trashed` when the item has been moved to the trash but not deleted * `deleted` when the item has been permanently deleted.
    - object, nullable — The bare basic representation of a folder, the minimal amount of fields returned when using the `fields` query parameter.
      - `id` string, required — The unique identifier that represent a folder. The ID for any folder can be determined by visiting a folder in the web application and copying the ID from the URL. For example, for the URL `https://*.app.box.com/folders/123` the `folder_id` is `123`.
      - `etag` string, nullable — The HTTP `etag` of this folder. This can be used within some API endpoints in the `If-Match` and `If-None-Match` headers to only perform changes on the folder if (no) changes have happened.
      - `type` 'folder', required — The value will always be `folder`.
      - `sequence_id` string — A numeric identifier that represents the most recent user event that has been applied to this item. This can be used in combination with the `GET /events`-endpoint to filter out user events that would have occurred before this identifier was read. An example would be where a Box Drive-like application would fetch an item via the API, and then listen to incoming user events for changes to the item. The application would ignore any user events where the `sequence_id` in the event is smaller than or equal to the `sequence_id` in the originally fetched resource.
      - `name` string — The name of the folder.
      - `created_at` string, date-time, nullable — The date and time when the folder was created. This value may be `null` for some folders such as the root folder or the trash folder.
      - `modified_at` string, date-time, nullable — The date and time when the folder was last updated. This value may be `null` for some folders such as the root folder or the trash folder.
      - `description` string — The optional description of this folder.
      - `size` integer — The folder size in bytes. Be careful parsing this integer as its value can get very large.
      - `path_collection` object — The tree of folders that this folder is contained in, starting at the root.
        - `total_count` integer, required — The number of folders in this list.
        - `entries` FolderMini[], required — The parent folders for this item.
          - `id` string, required — The unique identifier that represent a folder. The ID for any folder can be determined by visiting a folder in the web application and copying the ID from the URL. For example, for the URL `https://*.app.box.com/folders/123` the `folder_id` is `123`.
          - `etag` string, nullable — The HTTP `etag` of this folder. This can be used within some API endpoints in the `If-Match` and `If-None-Match` headers to only perform changes on the folder if (no) changes have happened.
          - `type` 'folder', required — The value will always be `folder`.
          - `sequence_id` string — A numeric identifier that represents the most recent user event that has been applied to this item. This can be used in combination with the `GET /events`-endpoint to filter out user events that would have occurred before this identifier was read. An example would be where a Box Drive-like application would fetch an item via the API, and then listen to incoming user events for changes to the item. The application would ignore any user events where the `sequence_id` in the event is smaller than or equal to the `sequence_id` in the originally fetched resource.
          - `name` string — The name of the folder.
      - `created_by` object — The user who created this folder.
        - `id` string, required — The unique identifier for this user.
        - `type` 'user', required — The value will always be `user`.
        - `name` string — The display name of this user.
        - `login` string, email — The primary email address of this user.
      - `modified_by` object — The user who last modified this folder.
        - `id` string, required — The unique identifier for this user.
        - `type` 'user', required — The value will always be `user`.
        - `name` string — The display name of this user.
        - `login` string, email — The primary email address of this user.
      - `trashed_at` string, date-time, nullable — The time at which this folder was put in the trash.
      - `purged_at` string, date-time, nullable — The time at which this folder is expected to be purged from the trash.
      - `content_created_at` string, date-time, nullable — The date and time at which this folder was originally created.
      - `content_modified_at` string, date-time, nullable — The date and time at which this folder was last updated.
      - `owned_by` object — The user who owns this folder.
        - `id` string, required — The unique identifier for this user.
        - `type` 'user', required — The value will always be `user`.
        - `name` string — The display name of this user.
        - `login` string, email — The primary email address of this user.
      - `shared_link` object, nullable — The shared link for this folder. This will be `null` if no shared link has been created for this folder.
        - `url` string, url, required — The URL that can be used to access the item on Box. This URL will display the item in Box's preview UI where the file can be downloaded if allowed. This URL will continue to work even when a custom `vanity_url` has been set for this shared link.
        - `download_url` string, url, nullable — A URL that can be used to download the file. This URL can be used in a browser to download the file. This URL includes the file extension so that the file will be saved with the right file type. This property will be `null` for folders.
        - `vanity_url` string, url, nullable — The "Custom URL" that can also be used to preview the item on Box. Custom URLs can only be created or modified in the Box Web application.
        - `vanity_name` string, nullable — The custom name of a shared link, as used in the `vanity_url` field.
        - `access` 'open' | 'company' | 'collaborators' — The access level for this shared link. * `open` - provides access to this item to anyone with this link * `company` - only provides access to this item to people the same company * `collaborators` - only provides access to this item to people who are collaborators on this item If this field is omitted when creating the shared link, the access level will be set to the default access level specified by the enterprise admin.
        - `effective_access` 'open' | 'company' | 'collaborators', required — The effective access level for the shared link. This can be a more restrictive access level than the value in the `access` field when the enterprise settings restrict the allowed access levels.
        - `effective_permission` 'can_edit' | 'can_download' | 'can_preview' | 'no_access', required — The effective permissions for this shared link. These result in the more restrictive combination of the share link permissions and the item permissions set by the administrator, the owner, and any ancestor item such as a folder.
        - `unshared_at` string, date-time, nullable — The date and time when this link will be unshared. This field can only be set by users with paid accounts.
        - `is_password_enabled` boolean, required — Defines if the shared link requires a password to access the item.
        - `permissions` object — Defines if this link allows a user to preview, edit, and download an item. These permissions refer to the shared link only and do not supersede permissions applied to the item itself.
          - `can_download` boolean, required — Defines if the shared link allows for the item to be downloaded. For shared links on folders, this also applies to any items in the folder. This value can be set to `true` when the effective access level is set to `open` or `company`, not `collaborators`.
          - `can_preview` boolean, required — Defines if the shared link allows for the item to be previewed. This value is always `true`. For shared links on folders this also applies to any items in the folder.
          - `can_edit` boolean, required — Defines if the shared link allows for the item to be edited. This value can only be `true` if `can_download` is also `true` and if the item has a type of `file`.
        - `download_count` integer, required — The number of times this item has been downloaded.
        - `preview_count` integer, required — The number of times this item has been previewed.
      - `folder_upload_email` object, nullable — The `folder_upload_email` parameter is not `null` if one of the following options is **true**: * The **Allow uploads to this folder via email** and the **Only allow email uploads from collaborators in this folder** are [enabled for a folder in the Admin Console](https://support.box.com/hc/en-us/articles/360043697534-Upload-to-Box-Through-Email), and the user has at least **Upload** permissions granted. * The **Allow uploads to this folder via email** setting is enabled for a folder in the Admin Console, and the **Only allow email uploads from collaborators in this folder** setting is deactivated (unchecked). If the conditions are not met, the parameter will have the following value: `folder_upload_email: null`.
        - `access` 'open' | 'collaborators' — When this parameter has been set, users can email files to the email address that has been automatically created for this folder. To create an email address, set this property either when creating or updating the folder. When set to `collaborators`, only emails from registered email addresses for collaborators will be accepted. This includes any email aliases a user might have registered. When set to `open` it will accept emails from any email address.
        - `email` string, email — The optional upload email address for this folder.
      - `parent` object, nullable — The optional folder that this folder is located within. This value may be `null` for some folders such as the root folder or the trash folder.
        - `id` string, required — The unique identifier that represent a folder. The ID for any folder can be determined by visiting a folder in the web application and copying the ID from the URL. For example, for the URL `https://*.app.box.com/folders/123` the `folder_id` is `123`.
        - `etag` string, nullable — The HTTP `etag` of this folder. This can be used within some API endpoints in the `If-Match` and `If-None-Match` headers to only perform changes on the folder if (no) changes have happened.
        - `type` 'folder', required — The value will always be `folder`.
        - `sequence_id` string — A numeric identifier that represents the most recent user event that has been applied to this item. This can be used in combination with the `GET /events`-endpoint to filter out user events that would have occurred before this identifier was read. An example would be where a Box Drive-like application would fetch an item via the API, and then listen to incoming user events for changes to the item. The application would ignore any user events where the `sequence_id` in the event is smaller than or equal to the `sequence_id` in the originally fetched resource.
        - `name` string — The name of the folder.
      - `item_status` 'active' | 'trashed' | 'deleted' — Defines if this item has been deleted or not. * `active` when the item has is not in the trash * `trashed` when the item has been moved to the trash but not deleted * `deleted` when the item has been permanently deleted.
      - `item_collection` object — A page of the items that are in the folder. This field can only be requested when querying a folder's information, not when querying a folder's items.
        - `limit` integer — The limit that was used for these entries. This will be the same as the `limit` query parameter unless that value exceeded the maximum value allowed. The maximum value varies by API.
        - `next_marker` string, nullable — The marker for the start of the next page of results.
        - `prev_marker` string, nullable — The marker for the start of the previous page of results.
        - `total_count` integer — One greater than the offset of the last entry in the entire collection. The total number of entries in the collection may be less than `total_count`. This field is only returned for calls that use offset-based pagination. For marker-based paginated APIs, this field will be omitted.
        - `offset` integer — The 0-based offset of the first entry in this set. This will be the same as the `offset` query parameter. This field is only returned for calls that use offset-based pagination. For marker-based paginated APIs, this field will be omitted.
        - `order` object[] — The order by which items are returned. This field is only returned for calls that use offset-based pagination. For marker-based paginated APIs, this field will be omitted.
          - `by` string — The field to order by.
          - `direction` 'ASC' | 'DESC' — The direction to order by, either ascending or descending.
        - `entries` Item[] — The items in this collection.
          - union — An item represents a file, folder, or web link.
            - object, nullable — The bare basic representation of a file, the minimal amount of fields returned when using the `fields` query parameter.
              - …
            - object — The bare basic representation of a folder, the minimal amount of fields returned when using the `fields` query parameter.
              - …
            - object — Web links are objects that point to URLs. These objects are also known as bookmarks within the Box web application. Web link objects are treated similarly to file objects, they will also support most actions that apply to regular files.
              - …
    - object, nullable — Web links are objects that point to URLs. These objects are also known as bookmarks within the Box web application. Web link objects are treated similarly to file objects, they will also support most actions that apply to regular files.
      - `id` string, required — The unique identifier for this web link.
      - `type` 'web_link', required — The value will always be `web_link`.
      - `etag` string — The entity tag of this web link. Used with `If-Match` headers.
      - `url` string — The URL this web link points to.
      - `sequence_id` string — A numeric identifier that represents the most recent user event that has been applied to this item. This can be used in combination with the `GET /events`-endpoint to filter out user events that would have occurred before this identifier was read. An example would be where a Box Drive-like application would fetch an item via the API, and then listen to incoming user events for changes to the item. The application would ignore any user events where the `sequence_id` in the event is smaller than or equal to the `sequence_id` in the originally fetched resource.
      - `name` string — The name of the web link.
      - `parent` object — The parent object the web link belongs to.
        - `id` string, required — The unique identifier that represent a folder. The ID for any folder can be determined by visiting a folder in the web application and copying the ID from the URL. For example, for the URL `https://*.app.box.com/folders/123` the `folder_id` is `123`.
        - `etag` string, nullable — The HTTP `etag` of this folder. This can be used within some API endpoints in the `If-Match` and `If-None-Match` headers to only perform changes on the folder if (no) changes have happened.
        - `type` 'folder', required — The value will always be `folder`.
        - `sequence_id` string — A numeric identifier that represents the most recent user event that has been applied to this item. This can be used in combination with the `GET /events`-endpoint to filter out user events that would have occurred before this identifier was read. An example would be where a Box Drive-like application would fetch an item via the API, and then listen to incoming user events for changes to the item. The application would ignore any user events where the `sequence_id` in the event is smaller than or equal to the `sequence_id` in the originally fetched resource.
        - `name` string — The name of the folder.
      - `description` string — The description accompanying the web link. This is visible within the Box web application.
      - `path_collection` object — The tree of folders that this web link is contained in, starting at the root.
        - `total_count` integer, required — The number of folders in this list.
        - `entries` FolderMini[], required — The parent folders for this item.
          - `id` string, required — The unique identifier that represent a folder. The ID for any folder can be determined by visiting a folder in the web application and copying the ID from the URL. For example, for the URL `https://*.app.box.com/folders/123` the `folder_id` is `123`.
          - `etag` string, nullable — The HTTP `etag` of this folder. This can be used within some API endpoints in the `If-Match` and `If-None-Match` headers to only perform changes on the folder if (no) changes have happened.
          - `type` 'folder', required — The value will always be `folder`.
          - `sequence_id` string — A numeric identifier that represents the most recent user event that has been applied to this item. This can be used in combination with the `GET /events`-endpoint to filter out user events that would have occurred before this identifier was read. An example would be where a Box Drive-like application would fetch an item via the API, and then listen to incoming user events for changes to the item. The application would ignore any user events where the `sequence_id` in the event is smaller than or equal to the `sequence_id` in the originally fetched resource.
          - `name` string — The name of the folder.
      - `created_at` string, date-time — When this file was created on Box’s servers.
      - `modified_at` string, date-time — When this file was last updated on the Box servers.
      - `trashed_at` string, date-time, nullable — When this file was moved to the trash.
      - `purged_at` string, date-time, nullable — When this file will be permanently deleted.
      - `created_by` object — The user who created this web link.
        - `id` string, required — The unique identifier for this user.
        - `type` 'user', required — The value will always be `user`.
        - `name` string — The display name of this user.
        - `login` string, email — The primary email address of this user.
      - `modified_by` object — The user who last modified this web link.
        - `id` string, required — The unique identifier for this user.
        - `type` 'user', required — The value will always be `user`.
        - `name` string — The display name of this user.
        - `login` string, email — The primary email address of this user.
      - `owned_by` object — The user who owns this web link.
        - `id` string, required — The unique identifier for this user.
        - `type` 'user', required — The value will always be `user`.
        - `name` string — The display name of this user.
        - `login` string, email — The primary email address of this user.
      - `shared_link` object, nullable — The shared link object for this item. Will be `null` if no shared link has been created.
        - `url` string, url, required — The URL that can be used to access the item on Box. This URL will display the item in Box's preview UI where the file can be downloaded if allowed. This URL will continue to work even when a custom `vanity_url` has been set for this shared link.
        - `download_url` string, url, nullable — A URL that can be used to download the file. This URL can be used in a browser to download the file. This URL includes the file extension so that the file will be saved with the right file type. This property will be `null` for folders.
        - `vanity_url` string, url, nullable — The "Custom URL" that can also be used to preview the item on Box. Custom URLs can only be created or modified in the Box Web application.
        - `vanity_name` string, nullable — The custom name of a shared link, as used in the `vanity_url` field.
        - `access` 'open' | 'company' | 'collaborators' — The access level for this shared link. * `open` - provides access to this item to anyone with this link * `company` - only provides access to this item to people the same company * `collaborators` - only provides access to this item to people who are collaborators on this item If this field is omitted when creating the shared link, the access level will be set to the default access level specified by the enterprise admin.
        - `effective_access` 'open' | 'company' | 'collaborators', required — The effective access level for the shared link. This can be a more restrictive access level than the value in the `access` field when the enterprise settings restrict the allowed access levels.
        - `effective_permission` 'can_edit' | 'can_download' | 'can_preview' | 'no_access', required — The effective permissions for this shared link. These result in the more restrictive combination of the share link permissions and the item permissions set by the administrator, the owner, and any ancestor item such as a folder.
        - `unshared_at` string, date-time, nullable — The date and time when this link will be unshared. This field can only be set by users with paid accounts.
        - `is_password_enabled` boolean, required — Defines if the shared link requires a password to access the item.
        - `permissions` object — Defines if this link allows a user to preview, edit, and download an item. These permissions refer to the shared link only and do not supersede permissions applied to the item itself.
          - `can_download` boolean, required — Defines if the shared link allows for the item to be downloaded. For shared links on folders, this also applies to any items in the folder. This value can be set to `true` when the effective access level is set to `open` or `company`, not `collaborators`.
          - `can_preview` boolean, required — Defines if the shared link allows for the item to be previewed. This value is always `true`. For shared links on folders this also applies to any items in the folder.
          - `can_edit` boolean, required — Defines if the shared link allows for the item to be edited. This value can only be `true` if `can_download` is also `true` and if the item has a type of `file`.
        - `download_count` integer, required — The number of times this item has been downloaded.
        - `preview_count` integer, required — The number of times this item has been previewed.
      - `item_status` 'active' | 'trashed' | 'deleted' — Whether this item is deleted or not. Values include `active`, `trashed` if the file has been moved to the trash, and `deleted` if the file has been permanently deleted.
  - `app_item` object, nullable — An `app_item` to which access is granted. The field is `null` when the collaboration is created on an item (see `item` field), or the `app_item` is inaccessible. The role cascades to all items associated with the `app_item`.
    - `id` string, required — The unique identifier for this app item.
    - `type` 'app_item', required — The value will always be `app_item`.
    - `application_type` string, required — The type of the app that owns this app item.
  - `accessible_by` union — The user or group that is granted access.
    - object — A mini representation of a user, used when nested within another resource.
      - `id` string, required — The unique identifier for this user.
      - `type` 'user', required — The value will always be `user`.
      - `name` string — The display name of this user. If the collaboration status is `pending`, an empty string is returned.
      - `login` string, email — The primary email address of this user. If the collaboration status is `pending`, a login value is returned.
      - `is_active` boolean — If set to `false`, the user is either deactivated or deleted.
    - object — A base representation of a group.
      - `id` string, required — The unique identifier for this object.
      - `type` 'group', required — The value will always be `group`.
      - `name` string — The name of the group.
      - `group_type` 'managed_group' | 'all_users_group' — The type of the group.
  - `invite_email` string, nullable — The email address used to invite an unregistered collaborator, if they are not a registered user.
  - `role` 'editor' | 'viewer' | 'previewer' | 'uploader' | 'previewer uploader' | 'viewer uploader' | 'co-owner' | 'owner' — The level of access granted.
  - `expires_at` string, date-time, nullable — When the collaboration will expire, or `null` if no expiration date is set.
  - `is_access_only` boolean — If set to `true`, collaborators have access to shared items, but such items won't be visible in the All Files list. Additionally, collaborators won't see the path to the root folder for the shared item.
  - `status` 'accepted' | 'pending' | 'rejected' — The status of the collaboration invitation. If the status is `pending`, `name` returns an empty string.
  - `acknowledged_at` string, date-time — When the `status` of the collaboration object changed to `accepted` or `rejected`.
  - `created_by` object — The user who created the collaboration object.
    - `id` string, required — The unique identifier for this user.
    - `type` 'user', required — The value will always be `user`.
    - `name` string — The display name of this user. If the collaboration status is `pending`, an empty string is returned.
    - `login` string, email — The primary email address of this user. If the collaboration status is `pending`, a login value is returned.
    - `is_active` boolean — If set to `false`, the user is either deactivated or deleted.
  - `created_at` string, date-time — When the collaboration object was created.
  - `modified_at` string, date-time — When the collaboration object was last modified.
  - `acceptance_requirements_status` object
    - `terms_of_service_requirement` object
      - `is_accepted` boolean, nullable — Whether or not the terms of service have been accepted. The field is `null` when there is no terms of service required.
      - `terms_of_service` object — The terms of service that must be accepted before the collaboration can be accepted. The field is `null` when there is no terms of service required.
        - `id` string, required — The unique identifier for this terms of service.
        - `type` 'terms_of_service', required — The value will always be `terms_of_service`.
    - `strong_password_requirement` object
      - `enterprise_has_strong_password_required_for_external_users` boolean — Whether or not the enterprise that owns the content requires a strong password to collaborate on the content, or enforces an exposed password detection for the external collaborators.
      - `user_has_strong_password` boolean, nullable — Whether or not the user has a strong and not exposed password set for their account. The field is `null` when a strong password is not required.
    - `two_factor_authentication_requirement` object
      - `enterprise_has_two_factor_auth_enabled` boolean — Whether or not the enterprise that owns the content requires two-factor authentication to be enabled in order to collaborate on the content.
      - `user_has_two_factor_authentication_enabled` boolean, nullable — Whether or not the user has two-factor authentication enabled. The field is `null` when two-factor authentication is not required.

## Other responses

- `204` — If the role is changed to `owner`, the collaboration is deleted and a new collaboration is created. The previous `owner` of the old collaboration will be a `co-owner` on the new collaboration.
- `403` — Returns an error if the authenticated user does not have the right permissions to update the collaboration. Additionally, this error may occur when attempting to update the `expires_at` field for the collaboration without the **Automatically remove invited collaborators: Allow folder owners to extend the expiry date** setting enabled in the admin dashboard of the enterprise.
- `default` — An unexpected client error.

---

[API](https://skmtc.net/box/apis/platform-api.md) · [All operations](https://skmtc.net/box/apis/platform-api/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/box/platform-api/versions/ba8f087e1a4d/schema)