API

Given a lock event returned from the List user and enterprise events endpoint, how can I determine the parent item that the event applies to? I cannot see any reference to the parent from the response payload (see below) nor any “Get lock by ID” endpoint or equivalent that I could use. Lock event response example{ "type" : "event", "createdAt" : "2026-03-19T14:41:22Z", "recordedAt" : "2026-03-19T14:41:25Z", "eventId" : "XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX", "createdBy" : { "id" : "XXXXXXXXXXX", "type" : "USER", "name" : "Foo Bar", "login" : "foo.bar@example.com" }, "eventType" : "LOCK_CREATE", "source" : { "id" : "XXXXXXXXXXX", "type" : "LOCK", "createdAt" : { "value" : "2026-03-19T14

I’m trying to download a file that I created via the API, but keep getting an SSL error. Note that I can download the same file successfully using the API Developer playground, providing just the file ID and my developer token. See curl output below:$ curl -i -L "https://api.box.com/2.0/files/ [removed by moderator] /content" -H "authorization: Bearer <REDACTED_TOKEN>"HTTP/2 302 date: Wed, 11 Mar 2026 12:55:49 GMTx-envoy-upstream-service-time: 259location: <REDACTED_LINK>box-request-id: 07a3f1d1a260e4d0957df37044c38d148cache-control: no-cache, no-storestrict-transport-security: max-age=31536000via: 1.1 googlecontent-length: 0alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000curl: (35) error:0A000126:SSL routines::unexpected eof while reading

Hello Box Community,I am currently using a free account, and I’ve noticed that I am unable to find the "Webhook" tab in the Developer Console. Could anyone here clarify which paid plan includes access to the "Webhook" feature?I would appreciate any help or insights on this.Thanks in advance!

HiError code as below, can you help me to solve this problem? {  "error": {    "message": "403: Box team folder not found",    "type": "server_error",    "param": null,    "code": null  }}

I would like to remove pinned devices in our enterprise on accounts that have had no activity in 90 days. I wrote the following with the help of Gemini and it appears it will work. I’m new to the Box CLI so if anyone else with more experience can take a look at this I’d appreciate it. # 1. Calculate the date 90 days ago in ISO 8601 format$thresholdDate = (Get-Date).AddDays(-90)Write-Host "Looking for users inactive since: $($thresholdDate.ToShortDateString())" -ForegroundColor Cyan# 2. Get all users and filter by 'modified_at'# Note: --max-items 5000 ensures we don't just get the first page$inactiveUsers = box users --all-users --json --max-items 5000 | ConvertFrom-Json | Where-Object { [datetime]$_.modified_at -lt $thresholdDate}if ($inactiveUsers.Count -eq 0) { Write-Host "No inactive users found. Exiting." -ForegroundColor Green exit}

In short: the app created a second folder ( [removed by moderator] ) because the Box service account it authenticates with may have a different root folder ("0") than the Box user where your original folder ( [removed by moderator] ) exists.Your files are being saved inside the app's folder ( [removed by moderator] ), not your existing one ( [removed by moderator] ). To find them, look for the service account's content in your Box admin console — it may be listed under "Service Account" or "App User" content depending on your Box enterprise setup.How do I see Service Account or App User folders????

When a folder is moved to the trash, webhook notifications for the files inside are not sent. Is this by design?Notifications will be sent for folders inside a folder that has been moved to the trash.

Need to Access Folder Using Personal User Connect using Server Auth Jwt For Accessing Folder and Files.But Didnt find Authentication tabWithout this can we connect through App?I have generated config but didnt work  might be enterprise id =0;Currently try to execute using this code.string path = @"D:\Box\Personal\config.json"; var reader = System.IO.File.ReadAllText(path); var config = BoxConfig.CreateFromJsonString(reader); var jwtAuth = new BoxJWTAuth(config);Is there any way to connect personal user with 3rd party api using Server Auth Jwt? 

Hi everyone,I would like to delete a V1 Webhook associated with my application, as I am planning to migrate to V2 Webhook.However, according to the official documentation, V1 Webhooks cannot be completely deleted. I understand that the only option is to revert it back to developer mode.Could anyone advise on how to proceed with this?[Application Information]- App Name: Dify Box Integration- Client ID: [removed by moderator]

Hello,I am currently developing an external system integration that retrieves data from Box via API.For this integration, we need to use an access token. However, the default access token expiration time is 1 hour, and refreshing the token every hour is not operationally practical for our use case.I would like to ask the following: Is it possible to extend the expiration time of an access token beyond the default 1 hour? In the documentation below, it appears that “Access Token Expiry” can be configured:https://developer.box.com/guides/authentication/app-token/app-token-setup#primary-and-secondary-app-tokens Could you clarify how to modify the expiration time and whether there are any limitations? Additionally, regarding Limited

hello,I created an API request with cUrl to give access to a folder to an external user. I used the collaboration request and it worked for a very few folders and doesn’t work with most of them.Here is my request#!/bin/bash# Set your Box API key and access token API_KEY="xoxp-My Api Key" ACCESS_TOKEN="My valid Token"# Set the folder ID to which you want to invite the user FOLDER_ID="198762389512"# Set the email address of the user you want to invite USER_EMAIL="useremail@gmail.com"# Set the collaboration role to "viewer" COLLAB_ROLE="viewer"# Define the cURL request curl -X POST "https://api.box.com/2.0/collaborations" \ -H "Authorization: Bearer $ACCESS_TOKEN" \ -H "Content-Type: application/json" \ -d '{ "item": { "id": "'$FOLDER_ID'", "type": "folder" }, "accessible_by": { "login": "'$

I’m using cURL to access the API.  I’ve successfully been able to search for a file by passing the template name and querying the value.  What I’m looking to do is structure the query as such that I can find a list of files that don’t have any metadata assigned to them. For this application, every file needs this particular template assigned to them, and a file without it is a good indicator that it needs to be processed.

Hi,I have created an application (2392115) to read the files from a program. It is in status “Pending Authorization”. How long it takes to get approved?  Thanks. 

On 2026-02-05 11:54:44, we use the Upload file version API (https://developer.box.com/reference/post-files-id-content). I got the below response: {"type":"error","status":503,"code":"unavailable","help_url":"http:\/\/developers.box.com\/docs\/#errors","message":"Service is temporarily unavailable","request_id":"r1l5zti9zii42z1x"} The file size is small (~1MB). I want to know more detail for the above error. Thank you.

Hi Box Team,I have a question regarding how API calls are counted towards the license-based rate limit when downloading a file.According to the File Download Guide, when I download a file, the SDK (or my app) first sends:GET https://api.box.com/2.0/files/{file_id}/contentThen Box responds with a 302 redirect, and my client follows it by making:GET https://dl.boxcloud.com/d/1/[long-random-string]/download

Hi everyone, I have a question regarding the application creation process in the Box Developer Console. Previously, as shown in the official documentation, it was possible to select "Limited Access App" when creating a new application.However, in my current console, that option no longer appears. Instead, I am only presented with the following three options under "Platform App":OAuth 2.0 Server Authentication (JWT) Client Credentials GrantMy questions are:1. Has the "Limited Access App" type been deprecated or integrated into these other options?2. If I want to create an app with restricted access (similar to the old Limited Access App), which option should I choose now? I would appreciate any clar

I’m trying to use this Nuget package (https://github.com/box/box-windows-sdk-v2/tree/main) to add metadata to files.I followed all the steps in this guide (https://github.com/box/box-windows-sdk-v2/blob/main/docs/Authentication.md#jwt-auth) using the JWT auth method, to set up the platform app, and set up the authentication in the code. I’m using the endpoint described here (https://github.com/box/box-windows-sdk-v2/blob/main/docs/FileMetadata.md#create-metadata-instance-on-file), but when I’m running the code I’m getting an err

We occasionally get `401 Unauthorized` with `error="invalid_token"` when calling the Box Content API (e.g., DELETE /2.0/files/<FILE_ID>).This happens about ~2 times per month. Retrying the same operation later often succeeds.We believe the access token itself is not expired at the time of the request:- Access token was obtained at: <UTC timestamp>- Token lifetime: 60 minutes- Request time: <UTC timestamp> (within the lifetime)We also believe we are not using the same token in parallel (single job / single worker).Error response (sanitized):401 Unauthorized{  "request_url": "https://api.box.com/2.0/files/<FILE_ID>",  "status_code": 401,  "response_header": {    "Date": ["Sat, 24 Jan 2026 17:03:05 GMT"],    "Www-Authenticate": [      "Bearer realm=\"Service\", error=\"invalid_token\", error_description=\"The access token provided is invalid.\""    ]  }

[TextContent(type='text', text='{\n "error": "403 The request requires higher privileges than provided by the access token.; Request ID: This is the error I get  

I have a platform app that allows me to use a Java Web Token.  I have it working locally on my desk top but it fails with a null pointer exception.  (none type object has no attribute encodeIt is failing precisely in line 344 in create_jwt_assertion in box_sdk_gen/internal/utils.py  

We are using Box with SSO set to Required and MFA is enforced at our IdP.When trying to view or regenerate a client secret (Client Credentials Grant) or generate a JWT key pair in the Developer Console, Box requires that the user has Box 2-Step Verification enabled.However, when SSO is Required, the Box-native 2-Step Verification setting is not available in the user’s security settings.Questions: Can IdP-side MFA be recognized by Box as satisfying the “2-Step Verification” requirement for Developer Console operations? If not, is it impossible to regenerate client secrets / JWT key pairs in an SSO Required environment without temporarily disabling SSO? Is there an official workaround or supported procedure for this scenario? We want to avoid relaxing SSO policies in production if possible.

When I search up a folder, I get results: The “Leases_Batch_1” is in a subfolder of “Nextpoint - Barings Loan” called “Leases”. When I try to search for the exact same query, one folder down, I get no results.Seems to behave the same using the API setting AncestorFolderIds. Any thoughts or work arounds would be greatly appreciated. If I be this much more specific with my search, I’m far more likely to get an accurate result.Thanks!

I have been attempting to initiate a DocGen process through the API, and am being met with a 403 error indicating insufficient permissions. According to the developer console, ‘Manage Doc Gen’ is checked and enabled. I even forced a token refresh to see if that would make things update. Those efforts have had no effect, and the 403 error is still present. Are there any further steps I can take?The error response in full:{"message":"Insufficient permissions: Document Generation scope not enabled for this OAuth application","status":"error","fileId":null}The app’s service account is the one performing the action, and I have verified that it has access to all of the relevant folders and files the call is attempting to interact with.

We are facing intermittent slowness of downloads and uploads of files to and from box folders. For time period like 6.00 AM to 10.00 AM IST ( 00:30 UTC to 04:30 UTC) we faced slowness multiple times. It does not seem to be related to throttling or rate limiting as no feedback received from the box server side. Download takes very long time and some times timesout. How to troubleshoot this ? How to conclude if it is box side issue or any other dependencies ?

Our application was impersonating an account that had viewer uploader permissions on a folder in Box and was able to delete a file thru the API (not Web UI).My understanding was a viewer uploader did not have delete permissions.  Is that in the Web UI only?