Box Platform

Hi, I’m trying to figure out why our app integration no longer opens successfully, it shows “403 forbidden” when opening the app via Box (in a new tab). From our logs it looks like it stopped working August 22th (the oath endpoint haven’t been called since then). Have something changed in how Box calls the authentication endpoint? Its this network call https://app.box.com/index.php?rm=box_openbox_post_form&url=[...] that returns a 403. See screenshot:

Hi Everyone, I am configuring the Box App and setting up the BOX CLI. After executing the login command and entering the client ID and client secret,and granting access,I am redirected,and the following message appears: (node:7544) UnhandledPromiseRejectionWarning: BoxCLIError: Error: Unexpected API Response [403 Forbidden] at C:\Program Files (x86)@boxcli\client\src\commands\login.js:122:11 (Use node --trace-warnings ... to show where the warning was created) (node:7544) UnhandledPromiseRejectionWarning: Unhandled promise rejection. This error originated either by throwing inside of an async function without a catch block, or by rejecting a promise which was not handled with .catch(). To terminate the node process on unhandled promise rejection, use the CLI flag --unhandled-rejections=strict (see

Hi, I’m part of an IT company and one of our clients has been using Box since before we started managing them. We’ve been trying to handle an issue with the permissions and so far, we haven’t been able to find a good solution. Box support was not helpful, and I spent some time learning the CLI, but I’m still struggling to figure anything out. Anyways, here is the problem: The file structure that they have set up does not work with the way Box handles permissions. The situation is they have a folder titled “Human Resources”. In this folder there is an “Employees” folder and each employee of the company has their own subfolder. Within each employee’s folder, there are two subfolders. One of these subfolders is called “Confidential” and should only be accessed by HR. The other subfolder is “Personnel” and should be accessed by HR and Accounting. Since Box forces their waterfall/inheritance permissions model, we are not able to make this work. If we give read access for Ac

We are currently working on Deploying Microsoft Sentinel, and I’d like to get the data connector for Box working, Microsoft’s documentation is sparse and vague (feigning surprise!). In combining both their docs and Box.com, I think the issue is what is needed for the JSON input parameters, nothing I’ve seen so far has given me specifics. Has anyone been able to implement this successfully? Thanks! Mike

What is the best way to use the Box API to get all shared links created by a specific user?

Hello. I would like to update the tracking code in PowerShell, but when I run the following code, I get a 400 error. $token = "<access token>" $uri = 'https://api.box.com/2.0/users/<user id>' $headers = @{"Authorization" = "Bearer " + $token} $body = [System.Text.Encoding]::UTF8.GetBytes("tracking_codes": [ { "type": "tracking_code", "name":"<tracking code name>",value":"<tracking code value> "}]) Invoke-RestMethod -Method Put -Uri $uri -Headers $headers -Body $body -ContentType 'application/json' ▼Error content + Invoke-RestMethod -Method Put -Uri $uri -Headers $headers -Body $body ... + ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ + CategoryInfo : InvalidOperation: (System.Net.HttpWebRequest:HttpWebRequest) [Invoke-RestMethod], WebException + FullyQualifiedErrorId : WebCmdletWebResponseException,Microsoft.PowerShell.Commands.InvokeRestMe

We want to make you aware of a recent effort by certain third-party bad actors to leverage free Box developer accounts in a social engineering attack on certain Box free individual accounts. Upon discovery of this issue, Box decided to temporarily disable new sign-ups for free developer accounts while we work to implement additional technical controls to prevent similar efforts in the future. The security and integrity of our Service is of utmost priority to Box, and we must ensure that we are providing the most secure product experience to our customers. We understand that some Enterprise customers use these free developer accounts for their own business purposes, and that they may have questions about their inability to sign-up new free accounts. Please use the following talking points when addressing these Customers’ questions or concerns: Any free developer accounts that were in place before March 9, 2023 are unaffected by this action; Customers may

Our Use Case: We are a SaaS vendor with security concious enterprise customers. We recommend that our customers connect their cloud storage provider (e.g., Google Drive) so that we can import configuration files and export report files. We would like to add Box to our list of supported cloud storage providers. We would be implementing a Box custom app. Our current recommendation to our customers for other cloud storage providers: Create a cloud storage user account specifically for our app, with access only to folders intended for import/export. From within our application, the organization admin enables the integration to their cloud storage provider (we have a plugin/app concept). On integration enablement, we start an OAuth2 flow; the customer enters the user described above, and we obtain the temporary code (i.e., ?code=… on the redirect). We immediately send the temporary code to our server. The server exchanges the

Hi! We have gotten a report of an “access_denied_insufficient_permissions” error when our connector is trying to fetch users via the “https://api.box.com/2.0/users” endpoint. The authentication works as expected. These are the permissions setup in the app: Manage users Manage enterprise properties They are reporting that they are using Box for education. As far as I can tell Box for education is either Enterprise or Enterprise Plus at a discounted price, and not a separate product. Or are there any API limitations for education plan customers and this is expected behavior?

I see that box allows me to upload a folder containing multiple files. Is there any way to do that all the files in the folder have been uploaded, I am looking at webhook but could not utilize this event because FOLDER.CREATED is issued before all the files have been uploaded.

Hi, We are using the open-source tool grouper for managing the groups in BOX. The grouper uses the Box SDK to query the users or groups, manage the groups, and manage the group membership. The Box API throws a 503 error randomly while querying users or groups. Please review the error message and let me know if you need anything. type: consumer, finalLog: false, state: init, consumerName: provisioner_incremental_boxProvisioner, totalCount: 147, currentSequenceNumber: null, publisherClass: edu.internet2.middleware.grouper.app.provisioning.ProvisioningConsumer, runId: vuk1k5nv, exception: java.lang.RuntimeException: provisionerClass: GrouperBoxProvisioner, configId: boxProvisioner, provisioningType: incrementalProvisionChangeLog, state: retrieveIncrementalTargetData, changeLogRawCount: 147, changeLogItemsApplicableByType: 106, recalcEventsDuringFullSync: 0, checkErrors: all, syncGroupsToQuery: 20, syncGroupsFound: 1, retrieveSyncGroupsMillis: 1, syncGroupCount: 1, filterB

Hello! I am trying to use the API to add a security classification to a folder and then create a metadata cascade policy so that the classification cascades to anything added to that folder. I can add the classification successfully through the API, but I cannot create the metadata cascade policy. In Postman, my request body to create the metadata cascade policy looks like this: { "folder_id": "12345678901", "scope": "enterprise_XXXXXX", "templateKey": "securityClassification-6VMVochwUWo" } But this returns a 404 error. Is there something wrong with my request? Or am I missing a step somewhere else? I’m able to do this successfully through the Box CLI, but not by making API calls through my integration app (which uses OAuth 2.0 w/ Client Credentials Grant (Server Authentication)).

I have a tiny Python utility that checks for the existence of Autocad .dwl files every 20 seconds in about a hundred folders on my computer. Several co-workers use the same app on their computers. The problem is the time lag between the creation of that file on one co-worker’s computer and its arrival at my computer (and those of the other guys too). One of them suggested I could use the Box API to maybe reduce the time lag. I’m hoping one of you might be willing to help me make the first steps if this is possible. Thanks.

I created personal Box account and am attempting to request a token using the client ID and secret. I am getting the following error. {“error”:“invalid_grant”,“error_description”:“Grant credentials are invalid”} Here are my application settings and requests: App access level : App + Enterprise access Authentication method: Server Authentication (Client Credentials Grant) curl -X POST https://api.box.com/oauth2/token -d “grant_type=client_credentials” -d “client_id=redacted” -d “client_secret=redacted” -d “box_subject_type=user” -d “box_subject_id=redacted” I am providing the user_id of my Box account as the box_subject_id.

Hi Team, I have some box folders on https://gehealthcare.box.com and I am trying to upload files on the same using python scripts which are executed via jenkins. I am currently using JWT without SDK approach and I am able to get the token but when I pass that token to my box URL where the files needs to get uploaded I am getting below error message: upload_response.text: {“type”:“error”,“status”:404,“code”:“not_found”,“context_info”:{“errors”:[{“reason”:“invalid_parameter”,“name”:“parent”,“message”:“Invalid value ‘d_139168108673’. ‘parent’ with value ‘d_139168108673’ not found”}]} Here 139168108673 is my folder id where the file needs to get uploaded. Kindly help as it is quite urgent. Looking forward to hear from you. Thanks, Shailendra Jetpuria

I am getting below error when I have concurrent request to have a Box Token. {“error”:“invalid_grant”,“error_description”:“Please check the ‘jti’ claim. A unique ‘jti’ value is required.”} Java Box SDK - 2.32.0

I am trying to call the Box api with c# and search for documents and get their metadata. I am able to see the metadata when I pass “metadata.enterprise.{metadata_template_key}” in a string array into the fields for the Search Manager. How am I able to extract that data? I do not see a way to get it from the BoxItem type. I know I can make a second call to get the metadata directly but I would have to make this call on all the documents the search api returned. I would like to prevent making so many calls if possible.

Hi there! Our app uses box-ui-elements and we want to start using the latest annotations API functionality with text highlight, drawing, mentioning and more. We already updated box-ui-elements to the latest version, but it didn’t give expected result, annotations were still not highlighted So I have a question: Does box-ui-elements already use the latest annotations API functionality or integration is still in progress? Thank you in advance!

This is the place to discuss the Box API Postman collections. Let us know if you found a bug, saw an inconsistency with the documentations or even have suggestions on how to improve the collection.

Hi, We have observed that the Box API is not returning the files consistently in multiple runs, however, this issue is occurring rarely. Sometimes it fetches less files than what is present in the Box without making any changes anywhere. We are using the following Box SDK. <dependency> <groupId>com.box</groupId> <artifactId>box-java-sdk</artifactId> <version>2.58.0</version> </dependency> Sample code: BoxFolder folders = new BoxFolder(api, userRootFolderId); folders.forEach(item-> { if (itemInfo instanceof BoxFile.Info) { BoxFile.Info fileInfo = (BoxFile.Info) itemInfo; log.info("Fetched BoxFile {} with id {}.", fileInfo.getName(), fileInfo.getID()); } else if (itemInfo instanceof BoxWebLink.Info) { if (boxConfiguration.getCrawlWebLinks()) { log.info("Fetched Weblink {} with id {}.", item.

Hi folks, Hi folks, thinking that you use the Box Postman Collection to interact with our API, I wanted to share this with you: With the objective to make our API Postman collection more flexible, I’ve been working on it so that it supports all of Box authentication types Developer Token, OAuth, CCG, and JWT. The idea is to detect the type of environment selected, and adjust the token refresh accordingly. I’ve also created a few helper methods to create these environments. I would very much like you take it for a spin, and send some feedback. You can fork this collection from here. You can leave your feedback by replying to this post. And of course ping me wi

Do you have questions about the Box AI API? This is the place to ask!