API

Our application was impersonating an account that had viewer uploader permissions on a folder in Box and was able to delete a file thru the API (not Web UI).My understanding was a viewer uploader did not have delete permissions.  Is that in the Web UI only?

Hey there! My organization uses box to store all our files and such. Locating files new and old can be really difficult on box which has been slowing down efficiency and files are getting lost. I noticed a ton of integrations that are created to help solve this but was curious if anyone has used any and seen success? I am specifically interested in integrations that are secure, low cost or free.  Thanks!

I’m currently developing a PHP application that uploads and downloads files to and from a folder in Box. I’ve created a Box App, and it has been approved and enabled by the administrator.However, when I look at the Developer Console, it still appears that the app is not enabled. administrator console : developer console : In fact, when the application attempts to perform JWT authentication, I get the following error:GuzzleHttp\Exception\ClientException: Client error: `POST https://api.box.com/oauth2/token` resulted in a `400 Bad Request` response:{"error":"invalid_grant","error_description":"Please check the 'sub' cla

After configuring a Box app in my Box Dev console, installed the Box CLI tools and, following the steps in documentation, eventually get to the step where you enter the command:box login -n BoxCLIafter which I’m prompted to enter the client id/secret for my app. After doing so I get the error “signalExit is not a function.” I’ve tried many variations of these steps and rebooted multiple times but always get this same error.

For a number of years (and in fact, one of the reasons we started with box), we allowed our students to set an external alias in their box account, and when the student leaves, if they have an external email alias, rather than deleting their account, we “release” it to then.We do this (via the API) by setting their “login” to the external email alias, and then setting “enterprise” to null. Recently, we have been having issues with the process (we only do expires once or twice a year, so it may have been broken for a while). The API call is returning:{ "type": "error", "status": 400, "code": "bad_request", "context_info": { "errors": [ { "reason": "invalid_parameter", "name": "user", "message": "Invalid value 'Box_User [removed by moderator] '." } ] }, "help_url": "http://developers.box.com/docs/#errors", "message": "Bad Request", "request_id":

I’m a dev at a video production company. We want to programmatically understand when editors have uploaded new drafts into certain folders in box, but when they use applications like Adobe Media Encoder/Adobe Premiere to render video directly to a folder in Box Drive, Box Drive uploads the file incrementally as it's being written, as it doesn’t understand when the file is fully rendered and ready to be properly uploaded. This triggers multiple FILE.UPLOADED webhooks throughout the render process.For example, when rendering 592.4 MB file, I received 3 FILE.UPLOADED payloads at   - 0.09 MB   - 184.77 MB  - 592.4 MB (render actually complete + fully uploaded)Am I correct that the best workaround for this issue (for assets that generate thumbnails according to https://developer.box.com/guides/

Hey folks,Im under free developer license, trying to build app, which will access box to upload download files. I cannot use OAuth, since this is part of pipeline flow. And I have to use box, since it’s part of SONY automation portal I’m getting error ‘*BoxOAuthException**: Message: Please check the 'sub' claim. The 'sub' specified is invalid.Status: 400’Is this because my enterprise account = 0? If so, any ways I can use JWT with free licence? Or what tier do I need to carry?

HelloI’m trying to integrate Box into my app for file storage. I think I want JWT Auth as the app will only ever store files in its own Box account. I’m getting a typescript error: Type '{ clientId: string; clientSecret: string; jwtKeyId: string; privateKey: string; privateKeyPassphrase: string; enterpriseId: string; }' is missing the following properties from type 'JwtConfig': tokenStorage, privateKeyDecryptor with the following code: const config = { clientId: BOX_CLIENT_ID, clientSecret: BOX_CLIENT_SECRET, jwtKeyId: '8495cr9l', privateKey: Buffer.from(BOX_PRIVATE_KEY_BASE64, 'base64').toString('ascii'), privateKeyPassphrase: BOX_PASSPHRASE, enterpriseId: BOX_ENTERPRISE_ID,}const jwtAuth = new BoxJwtAuth({config})

If you have been to developer.box.com in the last few minutes, you may notice a lot has changed. We are now live on Mintlify! All the guides and API reference materials you are used to are there. But with Mintlify, the site is built on AI. Thing are now much easier to find, and with the AI Assistant, you don’t even have to find it. Check out all the improvements in this blog.There are more improvements coming, but check it out and let us know what you think!

Hi!I’ve created a custom app using client credentials. After authorizing the app, I noticed that the automation user has a default storage limit of 10 GB.I attempted to increase the storage by first retrieving the user ID via the endpoint “api.box.com/2.0/users/me”, and then sending a PUT request to “api.box.com/2.0/users/{id}”.However, I received a 403 error:error="insufficient_scope", error_description="The request requires higher privileges than provided by the access token."I also verified the app permissions and confirmed that “Manage users” is enabled.Any suggestions on what might be causing this issue?Thanks in advance!

I’m trying to find a way to trigger some automations when a tag is added to a file or folder. I saw this post: and understand there is not currently a webhook event that can do this, but I’m wondering if anyone has figured out a clever workaround? It doesn’t look like there are any Relay events associated with tags either. I see that there is a “TAG_ITEM_CREATE” event type in the Events endpoint: https://developer.box.com/guides/events/, but only by user (i.e., there’s no way to filter enterprise events by that event type)?

When I click 'Run App Diagnostic Report', it gives me an error saying 'Something went wrong. The report did not initiate.' 

The API that I use is this :{{BASE_URL}}/enterprise_configurations/{{ENTERPRISE_ID}}?categories=user_settings,securityAnd I always have 404 response.  I have made sure the enterprise scope is present in token. Infact I tried to login from my docs using same oauth and receive 404 so is it something that needs to be enabled in account?

 Hello,I'm running a program that automatically creates folders and shared links using the Box API.After creating a folder, when I execute the shared link creation (PUT /folders/{id}) for the newly created folder,I receive the following error:Status: 404Details: trashedBoth the folder creation and shared link creation are performed by the same user. Also, although the error message says "trashed," the folder is not in the trash and can be viewed normally in the Box Web UI. Therefore, I'm unable to determine why the 404 error is occurring and am stuck. If anyone has experienced a similar problem or knows a solution, I would appreciate your guidance. Thank you in advance. 

Hello!I need assistance with enabling my account as a free developer account so I can authorize apps and continue developing. However, I keep seeing the message, "Log in or sign up for a Box Developer account to access all of the Developer Console features," even though I am already logged in.If anyone knows what might be happening or how to resolve this, I would really appreciate your help.

Hi All,We are a Box enterprise customer  having developer licence and are currently working on a integration project involving our developer account and the Box REST API. Specifically, we are building api to perform CRUD operations on the Box User object.We need to utilize the User Tracking Codes functionality to accurately tag our users upon creation. the issue is: The User Tracking Codes section is currently not visible in our Box Admin Console under Enterprise Settings > User Settings. Attempts to create a user via the API using the tracking_codes parameter result in a 400 Bad Request error, which is expected if the feature is not active. Question:          Please help use to enable the tracking_codes feature for the our account.

Files uploaded years ago using OAuth2.0 were being re-uploaded recently as indicted by the dates on my box.com folder files. I checked the website which it originated from and it wasn’t updated recently. The old files were even actually deleted already from the website it originated from. Any ideas on why this is happening?

I am trying to move a file to another folder where a file with that name already exists. Right now this operation throws 409 “item_name_in_use”. I want to enable versioning on this file move operation. Is there any way to do this or do I need to download and reupload the file for versioning to work?AI suggested using `conflict_resolution = "replace" ` in the body but it did nothing. Is this hallucination?

Dear all.I have a business requirement involving multiple files of different formats that are uploaded at different times to the same folder. I need to extract data from these files and consolidate it into a single file. It is important to note that these files cannot be downloaded to the local machine; the entire process needs to be carried out on the BOX platform.My question is: Is it possible to use the BOX API to write this logic and then have it run automatically in the background at scheduled intervals on BOX?If anyone has experience with similar implementations or solutions, I would appreciate your insights or suggestions. Thank you for your help!

Hello! Has anyone used the no code platform n8n to create workflows? I am currently working on an image tagging workflow that would trigger when a folder is created in a specified box location, and then send those images to be tagged and then update the metadata being stored in a json file. When I create actions in the workflow like get files or get folders, I have no issues. But when I use a box trigger node to start the workflow, I get the following error message : Forbidden - perhaps check your credentials? Show Details Box Trigger: 403 - “”

There are several apps in our Box environment that I need to have deleted. I have them disable but our information security team wants them deleted. How do I go about getting them removed ASAP?

Dear Box Developer Support Team,I hope you are doing well.We are currently using the Box.V2 .NET SDK in our C# application to fetch files and folders from Box.We have a requirement to retrieve all files and folders within a specific date range (e.g., created or modified date) without providing any keyword in the search query.Our goal is to filter Box content by date range only — for example, all items modified between 2025-01-01 and 2025-01-31 — without specifying a search term.Below is the code snippet we are currently using: var searchParams = new BoxSearchRequest(){    Query = "", // No keyword    ContentTypes = new List<string> { "name", "description", "file_content" },    FileExtensions = null,    CreatedAtRangeFromDate = new DateTime(2025, 01, 01),    CreatedAtRangeToDate = new DateTime(2025

I am trying to get data after Selected Date in selected Folder I am using dll with Below Code in C#  searchTermFiles = boxClient.SearchManager.QueryAsync(          query: keyword,                             // Names, descriptions, text contents of files, and other data          ancestorFolderIds: null,                          // Searches to specific parent folders          contentTypes: new[] { "file_content", "name" },                       // Can be name, description, file_content, comments, or tags          limit: limit,                                                 // The default is 30 and the maximum is 200                                    type: "file",                                                 // Can be file, folder, or web_link,          scope: "user_content",          //fileExtensions: new[] { "docx" },          //createdAfter: isFirstTimeScan ? null : DateTimeOffset.Parse(keywordCollection.Modific

We are developing a third-party API in-house, and we’ve encountered an issue where, under certain conditions, file uploads via the API result in errors, preventing all files from being uploaded successfully. We would like to determine whether this issue is caused by our application or by specific limitations of the API.To investigate, we generated an API report using the "App Diagnostics" feature on the developer console for our API app at "https://xxxxx.app.box.com/developers/console/app/xxxx". In the report, we found a section labeled "HTTP Status", which showed error statuses such as 400, 409, and 499.However, the list of Box API HTTP status codes available at https://developer.box.com/guides/api-calls/status-codes/ d

Hello all, I am using the Box API to upload files, which is working fine. But I would like to know is there a way to retrieve the “direct link” from the same api? And how would I set the sharing permissions so that my web app can access the file? My use case is:1- Upload an image using the box API.2- Retrieve the image URL.3- Use the image URL in a web app. (as an image source)Current issues:1- No clear way to generate the direct link from the API. It seems I have to share it in another API call. Or download it every time a user wants to preview it on the web app.2- No clear way to set CORS/viewing permissions without authenticating each user. (I would like to use my service account). What I’m looking for:-Add a property that automatically shares the file when it’s uploaded in the same API.-Have a whitelist for the web app domain or a way to allow it to preview without making the l