How Do You Upload Files Through the SharePoint, OneDrive, Box and Salesforce APIs?

A customer asks whether they can attach the contract that's already in their SharePoint, and whether your app can save the signed copy back to their Box. Those are two different jobs, and each platform has its own API for the second one.

Each platform takes a small file in one call. Microsoft Graph and Box take large files through an upload session, and Salesforce takes them as one multipart request:

Bringing files from these platforms into your app is a different job. That direction is a file picker API with a list of sources, not an integration per platform.

Filestack, our API for uploading, processing and delivering files, covers that direction. Its file picker lists OneDrive, OneDrive for Business and Box next to the user's device, signs the user in to each, and stores the file they pick. We wrote a short page for this post that opens the picker with those three sources.

Key takeaways

• Writing a file into SharePoint, OneDrive, Box or Salesforce goes through each platform's own upload API and its own OAuth flow.
• Microsoft Graph and Box both switch to an upload session for large files, and both sessions can resume after a dropped connection.
• Salesforce takes files as ContentVersion records, and the size limit depends on whether the request is JSON or multipart.
• Letting users bring files from these platforms into your app is one picker with a fromSources list.
• The picker returns a handle for each stored file, and the file is served from our CDN.

How does each platform's upload API work?

Each platform takes the file's bytes in the request body and returns a record for the stored file. What differs is the URL, the size limit and what counts as a file.

SharePoint and OneDrive. Both sit behind Microsoft Graph, and the call is the same for a user's OneDrive and a SharePoint document library. A new file goes to PUT /drives/{drive-id}/items/{parent-id}:/{filename}:/content with the bytes as the body, and the response is the new driveItem. Microsoft documents the Graph simple upload for files up to 250 MB.

Box. Uploads go to the upload.box.com domain rather than the main API domain, as a multipart form with the file and its parent folder ID. Box recommends chunked uploads above 50 MB. Account limits run from 250 MB on a free personal account upward, as listed in the guide to Box direct uploads.

Salesforce. A file is a ContentVersion record. You insert it at /services/data/vXX.X/sobjects/ContentVersion with fields such as Title and PathOnClient, and the file data in VersionData. Salesforce's guide to inserting blob data sets the limits: 37.5 MB of base64 in a JSON request, and up to 2 GB for ContentVersion in a multipart request.

When do you switch to an upload session?

Switch to an upload session when a file passes the simple call's limit, and earlier when the connection is unreliable. A session sends the file in pieces, and a dropped piece is sent again instead of the whole file.

• Microsoft Graph. createUploadSession returns an uploadUrl, and you PUT byte ranges to it in order. Each range is a multiple of 320 KiB and under 60 MiB, and Microsoft recommends sessions for anything over 10 MiB. After a dropped connection, a GET on the uploadUrl returns nextExpectedRanges from the Graph upload sessions API, and you resume from there.
• Box. A Box chunked upload creates a session, uploads parts, then commits them. It takes files of 20 MB and above, a failed part is retried on its own, and a session lasts 7 days.
• Salesforce. There's no session. Large files go as one multipart request, up to 2 GB.

Uploads into your own app follow the same reasoning, and our uploader splits, retries and resumes a large file upload from the browser.

What auth does each platform need?

Every platform needs an OAuth access token for the user or the workspace you're writing to.

PlatformToken fromPermission to write filesSharePoint and OneDriveMicrosoft Entra IDFiles.ReadWrite for the signed-in user, Sites.ReadWrite.All for an app writing to SharePointBoxBox OAuth 2.0, JWT or client credentialsWrite access to the target folderSalesforceA Salesforce connected appCreate access on ContentVersion

Your app stores and refreshes each token. Each platform also has its own consent screen and admin approval rules. For OneDrive for Business, the setup starts with an app registration in Microsoft Entra ID and its file permissions, as in our OneDrive OAuth setup tutorial.

How do users bring these files into your app?

Let users bring files in through a file picker that lists each platform as a source. The user signs in to their own account inside the picker, browses their files, and picks one, and your app gets back a stored file.

This page opens the Filestack picker with three sources and logs the stored file's handle and CDN URL when the user finishes:

<!doctype html>
<html>
<head>
  <meta charset="utf-8">
  <script src="https://static.filestackapi.com/filestack-js/4.x.x/filestack.min.js"></script>
</head>
<body>
  <script>
    const client = filestack.init('YOUR_API_KEY');client.picker({
      fromSources: ['onedrive', 'onedriveforbusiness', 'box'],
      onUploadDone: (result) => {
        const file = result.filesUploaded[0];
        console.log(file.handle, `https://cdn.filestackcontent.com/${file.handle}`);
      },
    }).open();
  </script>
</body>
</html>

<!doctype html>
<html>
<head>
  <meta charset="utf-8">
  <script src="https://static.filestackapi.com/filestack-js/4.x.x/filestack.min.js"></script>
</head>
<body>
  <script>
    const client = filestack.init('YOUR_API_KEY');client.picker({
      fromSources: ['onedrive', 'onedriveforbusiness', 'box'],
      onUploadDone: (result) => {
        const file = result.filesUploaded[0];
        console.log(file.handle, `https://cdn.filestackcontent.com/${file.handle}`);
      },
    }).open();
  </script>
</body>
</html>

Replace YOUR_API_KEY with your API key and open the page in a browser. The picker opens on the first source and asks the user to connect it:

After the user connects and picks a file, the picker stores it, and onUploadDone receives filesUploaded with one entry per file. The handle in each entry is what your app saves, and https://cdn.filestackcontent.com/HANDLE serves the file. filesFailed lists any file that didn't store.

The same fromSources list takes googledrive for Google Drive. Writing a file back to a user's Drive goes through the Drive upload API, as in our Google Drive API upload example.

What are the options for connecting cloud storage platforms?

There are three common ways to connect your app to the platforms your customers keep files in:

OptionWhat you buildThe catchEach platform's API directlyAn OAuth app, token storage and an upload client per platformA consent screen, a token lifecycle and a set of limits per platform to keep currentA unified file storage API serviceOne API that wraps several platforms' file APIsAnother vendor between you and each platform, usually for both directionsThe Filestack picker for files coming inOne fromSources list, with sign-in and storage handledWriting files back out still goes through each platform's API

We built the picker for the direction most apps need first: a user bringing a file they already have. The file uploader then stores it, scans it in a workflow if you add one, and serves it from our CDN. Writing to a customer's SharePoint or Box stays a direct API call, because it's your app acting in their workspace.

Questions people ask

Can you upload to SharePoint with the REST API?

You can upload a file to SharePoint with the Microsoft Graph REST API. PUT the bytes to /sites/{site-id}/drive/items/{parent-id}:/{filename}:/content for files up to 250 MB, or create an upload session for larger files.

How do you upload a large file to Box?

Upload a large file to Box with a chunked upload session. Create the session, upload the parts, then commit them. Chunked uploads take files of 20 MB and above, and Box recommends them above 50 MB.

How do you upload a file to Salesforce via REST?

Upload a file to Salesforce by inserting a ContentVersion record with the file in VersionData. A JSON request takes up to 37.5 MB of base64 data, and a multipart request takes up to 2 GB.

How do OneDrive and OneDrive for Business differ?

OneDrive is a personal Microsoft account, and OneDrive for Business is a work or school account in Microsoft 365. They sign in through different Microsoft accounts, so the Filestack picker lists them as two sources, onedrive and onedriveforbusiness.

Try it

The picker page in this post runs on any plan, including the free one. Create a free account for an API key, open the page, and connect one of the three sources to pick a file.

This article was published on the Filestack blog.