Webhooks (Dropbox Business API)

[Bhavana Reddy Vanga]

When file or folder changes in the account, Dropbox webhook sends notification to the app in the form of - 

{"list_folder": {"teams": {"dbtid:AADClDNgkem9dWq1M3thVc3K4-93Cl3zWx0": ["dbmid:AADP2xgTpjhFFOMURG5yAZTOVv2T3wkrkyY", "dbmid:AAAwp8MhW85Op96vIjatg9vPYizLr8B8O68"]}}, "delta": {"teams": {"dbtid:AADClDNgkem9dWq1M3thVc3K4-93Cl3zWx0": ["dbmid:AADP2xgTpjhFFOMURG5yAZTOVv2T3wkrkyY", "dbmid:AAAwp8MhW85Op96vIjatg9vPYizLr8B8O68"]}}}

Does "teams" in the JSON body indicate that webhook notification can come from two different teams at a time or the JSON body always contains only one team ID as key?

I even tried using multi-admin feature, so that admin can do changes in both the teams, but didn't get two team ids in the notification from webhook.

Thanks.

[Greg-DB]

Yes, the webhooks format is designed to support multiple teams per webhook notification, so please make sure your implementation is written to handle that possibility. 

[Bhavana Reddy Vanga]

Ok. Can I know in what scenario we would get multiple team ids in webhook notification?

If multiple team IDs are supported in one notification then how can we authenticate the request body, I mean what app secret should be used as signing key?

And how does this work, from what I understood till now a member can't be part of two teams at a time and even if we use multi-admin fetaure, admin of trusted team can just access admin console of team and can't do major changes of files or folders in team's content.

[Greg-DB · Accepted solution]

I don't believe we have any documentation or guarantee on when you might expect to see more than one team per notification unfortunately.

If/when that happens though, it would still just be signed with the same app secret for your app. A single app can be used to connect to multiple different teams. The app key/secret wouldn't change, as they're specific to the app itself, not the team. (Separately, it's the access token that identifies the particular team.)

If you do have and are using multiple different apps registered for whatever reason, and have them connected to different teams and both registered for webhook notifications, those webhook notifications would not be grouped together, and each would use the app secret for the corresponding app.

And that's correct, each team member can only be a member of one team. Each team listed in the webhook notification includes a list of member IDs that have changes in that particular team. You wouldn't see the same member ID across different teams. (Apologies the documentation is a little misleading in that regard; it's just using "member_id1", etc. as a placeholder.)

[Bhavana Reddy Vanga]

Thank you.

It does answer my question but I am confused how can we connect a single app to multiple different teams. In some earlier post I have read that Development Teams for an App indicates - how many times OAuth flow was executed for that app.
As multiple different teams do you mean multiple 'Business Teams' ?

Since user can be a part of only one team at a time, how can he/she connect app in their console to multiple different business teams?

[Greg-DB]

Yes, when I refer to "teams", I mean Dropbox "Business teams".

The "Development Teams" number listed for your app on the ap's page on the App Console is not exactly the number of times the OAuth flow was executed for the app, but rather how many distinct teams have been connected to the app.

While any particular user account can only be a member of one team, the same app can be connected to and used by multiple different teams. The developer of the app can implement the OAuth flow to allow multiple different team admins from different teams to each connect the app to their team. The result would be multiple different teams all connected to the app, with the app receiving a different access token for each one.