Document Sources — SharePoint, Box, Drive, NetDocuments, iManage

SharePoint (Microsoft 365)

What it is

Microsoft's enterprise document storage. Often used for contract repositories at customers that haven't adopted a dedicated CLM, or for legacy contracts pre-CLM.

How to integrate

Microsoft Graph API (https://graph.microsoft.com/v1.0/sites/...). Modern, well-documented.

import httpx

resp = httpx.get(
    "https://graph.microsoft.com/v1.0/sites/{site-id}/drives/{drive-id}/root:/Contracts:/children",
    headers={"Authorization": f"Bearer {access_token}"},
)
files = resp.json()["value"]

Auth

OAuth2 via Entra ID. Application permissions (app-only access) for service accounts; delegated permissions for user-context access. Most CI platforms use application permissions.

Gotchas

• Site / library structure varies. Customer's contracts folder might be in any of dozens of SharePoint sites. Discovery is real work.
• Permissions inheritance. Item-level permissions can deny access to specific files even when the service account has site-wide access.
• Throttling. Microsoft Graph throttles aggressively at scale. Retry with backoff.
• Versioning. SharePoint versions documents; old versions may exist. Decide whether to ingest only current or all versions.

Box

What it is

Enterprise cloud storage. Common at mid-market and enterprises that adopted Box for its security and compliance posture.

How to integrate

Box API (https://api.box.com/2.0/...). Well-documented; webhook support for real-time events.

Auth

OAuth2; JWT-based app authentication for server-to-server.

Gotchas

• Folder hierarchy variability. Customer's contract folders are wherever they decided to put them. Map per customer.
• Box Skills / Box Shield: customer may have enabled these for compliance; check before assuming integration is straightforward.
• Metadata templates: Box supports custom metadata on files; sometimes that's where the customer's contract type / tagging lives.

Google Drive

What it is

Google Workspace storage. Common at smaller / younger companies; less common as the contract repository at large enterprises.

How to integrate

Drive API (https://www.googleapis.com/drive/v3/files). Modern; well-documented.

Auth

OAuth2; Google service accounts with domain-wide delegation for enterprise access.

Gotchas

• Drive vs Shared Drive. Personal Drives vs Shared Drives have different permission models.
• Google Docs aren't PDFs. Native Google Docs need to be exported to PDF for OCR. Export adds steps.

NetDocuments

What it is

Document management for legal teams. Common in law firms and corporate legal departments.

How to integrate

REST API with NetDocuments-specific endpoints.

Auth

OAuth2; API keys for service accounts.

Gotchas

• Cabinet structure. NetDocuments organizes documents in cabinets and workspaces; navigating their hierarchy is customer-specific.
• Ethical walls. Some customers use ethical-wall configurations that restrict cross-team document access; service accounts may not see everything.
• Matter-centric. Documents tied to legal matters; the matter metadata is often what you want to capture alongside the contract.

iManage

What it is

Another document management system common in legal / professional services. Strong at law firms; used in some corporate legal departments.

How to integrate

iManage Cloud API; legacy on-prem instances may use SOAP-based endpoints.

Auth

OAuth2 for iManage Cloud; service accounts for on-prem.

Gotchas

• Workspace organization mirrors how the legal team thinks about matters.
• On-prem still common: some customers run iManage on-premises; integration requires network connectivity into their data center.

Common sync patterns

1. Initial backfill

One-time pull of all existing contracts. Paginate through folders/cabinets; download each file; ingest. Often runs over multiple days for large corpora.

2. Scheduled polling

Daily / hourly check for new files. List with a modified-since filter; ingest new files. Simplest pattern; works for most use cases.

3. Webhook-driven

Source system fires a webhook on file creation; you ingest immediately. Requires customer-side setup. More complex but enables near-real-time flows.

4. Watch-folder

Some customers prefer to "drop files in a folder" — usually a SharePoint folder or a shared drive — that the platform monitors. Simplest for them; sometimes more reliable than direct sync from CLM.

Idempotency

All sync patterns must be idempotent. Same file processed twice (because the modified-since query overlapped, or the webhook fired twice) must not duplicate. The document_id derivation from content hash (chapter 03 of the data model) handles this.

The first conversation in discovery

"Where do your contracts actually live today?" is the most important discovery question after the executive sponsor's outcome question. The answer determines the integration architecture for the whole deployment.