Box API + MCP vs OneDrive and SharePoint files (Microsoft Graph)

Box API + MCP

Public OpenAPI 3.0 spec with 297 operations, year-based API versions and an llms.txt of Markdown pages. 20 status-feed entries between 7 July and 1 October 2026, two of them over two hours on uploads or multiple services.

OneDrive and SharePoint files (Microsoft Graph)

One REST surface covers personal OneDrive, work OneDrive and SharePoint libraries, with resumable uploads, sharing links that take an expiry date and per-file Selected permissions. The status page needs JavaScript, an app must be registered and consented to by a person, and the JavaScript client on npm lacks a token-leak fix merged in June 2026.

Box API + MCP

1. Call who_am_i first; the tool list depends on the plan, the admin's toggles and the scopes granted
2. Expect download and upload URL, move and shared-link tools to be missing unless an admin has enabled them
3. Pass fields= to trim responses and page folder listings with limit and marker
4. Send a box-version header to pin an API version, and watch responses for a Deprecation header
5. For a link that expires, set shared_link.unshared_at on a paid account; the free plan can't

OneDrive and SharePoint files (Microsoft Graph)

1. Use PUT /content only up to 250 MB. Above 10 MiB Microsoft advises createUploadSession, with fragments in multiples of 320 KiB and under 60 MiB each
2. Send the bearer token on the createUploadSession POST only. The PUT calls to uploadUrl can return 401 if an Authorization header is included
3. Set expirationDateTime and scope on createLink. Without a scope the tenant's default link type is created, which may be wider than intended
4. Follow the 302 from GET /content straight away. Pre-authenticated download URLs can expire within minutes and need no Authorization header
5. Wait for Retry-After on 429 and 503. Throttled requests still count against the limits, and continued overuse can get the app blocked