Skip to main content

​
Archive is not delete

A delete request returns 202 Accepted with an operation. The Box or snapshot disappears from normal reads immediately; poll the operation until its status is completed. Everything on this page is available on all four surfaces:
Deletion operations cannot be canceled. Disabling ZDR only changes future archives; it does not stop operations already accepted.

​
Delete a Box

Every Box or snapshot delete requires X-Ascii-Confirm-Delete to exactly equal the target id. The CLI and the dashboard fill that header in for you.
In the dashboard, use the ⋯ menu on the Box’s row in Boxes and choose Delete.

​
Poll the operation

A delete returns an operation id (bdop_…). Poll it until status is completed.
box delete already polls for you and prints the operation as it finishes, so box deletion status is for checking back later on an operation you started elsewhere.

​
Delete one snapshot

DELETE /snapshots/{snapshotId} takes the snapshot id in the same confirmation header. It returns 409 while another incremental snapshot or an active restore still depends on that snapshot. Named snapshots are removed by name instead, and do not use the header.
Both are also on the Snapshots tab of the dashboard. Deletion and retention responses use Cache-Control: no-store.

​
Shared and named snapshots

Deleting a Box does not delete a named snapshot that you saved from it. Named snapshots are independent shared artifacts and may also share deduplicated storage with other snapshots. Physical objects are removed only after no retained artifact references them. Removing a named snapshot makes it unavailable immediately, but its backing data is scheduled no earlier than six hours later. Snapshot upload URLs are signed for six hours; this fence prevents an already-issued upload from recreating data after deletion. Enabling ZDR removes named snapshots and queues their backing data for deletion. You cannot create a named snapshot while ZDR is enabled.

​
Enable zero data retention

Read the setting from anywhere, including with an API key:
It is also in the zeroDataRetention fields returned by GET /me.
Changing the setting requires an interactive browser session, not an API key. Run box login without a key first, or use the dashboard. An SDK client configured with BOX_API_KEY gets 403 session_required, by design: turning this on queues every archived Box for deletion, so it should never be reachable from a leaked service credential.
Enabling also requires the exact phrase delete archived box data:
In the dashboard, the toggle is under Privacy on the Account tab. When enabled:
  • Existing archived Boxes are queued for deletion.
  • Future Boxes discard data when they archive.
  • Named snapshots are removed and queued for deletion.
  • Accepted deletion continues in the background until verified complete.

​
Close your account

Closing takes the whole account with it, not one Box. It happens on the Account tab and nowhere else: it needs a dashboard sign-in session, and is refused to an API key and to the CLI. Closing does all of this at once:
  • Cancels your subscription immediately, not at the end of the period. Remaining plan time and unused credits are forfeited, so close after a renewal only if you mean to.
  • Archives every running Box, with a snapshot.
  • Revokes every API key and every other session. The one you closed from stays alive so you can still read your invoices.
  • Emails you a confirmation with the date your data is purged.
You then have 30 days. During that window the account is closed but recoverable: Reopen on the same tab brings it back, subscription aside. After 30 days the Box data is purged for good, and reopening after that returns a working but empty account.
The same screen offers permanent erasure instead, for GDPR requests. It skips the 30 days, scrubs the data and your identity as soon as the Boxes finish archiving, and cannot be cancelled or reopened. Ordinary closing is what you want unless you specifically need erasure.

​
Records retained after content deletion

Ascii retains only records needed for security, abuse prevention, compliance, and billing. This includes machine-assignment history (internally MachineAssignmentLog), network attribution such as assigned IP/MAC records, security audit events, and billing/usage records. These records identify who controlled infrastructure and when; they do not retain your Box filesystem, prompts, messages, secrets, or generated artifacts.