403 Forbidden When Using As-User Header with Co-Admin Authorization

Hi Box Support Team,

We are running into an issue while collecting data from one of our shared customers.

For data collection, we use the below API As-User header to access the customer's Box data.

GET https://api.box.com/2.0/folders/{folder_id}/items

We have a customer where the authorization was configured using a user with the Co-Admin role. However, when we use this authorized user to collect data from another user who has either the Co-Admin or Admin role, the API returns a 403 Forbidden response.

We would like to understand whether this is a known limitation of Box's As-User functionality or permissions model.

Specifically:

1. Can a user with the Co-Admin role, who has authorized our application, use the As-User header to access data belonging to another Co-Admin or Admin user?
2. If this is not supported, is there any recommended approach to collect this data without changing the authorizing user's role to Admin?
3. Are there any additional permissions, scopes, or configuration settings that would allow a Co-Admin-authorized user to access the required data?
4. Is the 403 response expected when attempting to access content owned by another Co-Admin or Admin?

send the As-User header with the authorized user's user ID when making these API requests.

Could you please confirm whether this behavior is expected and advise us on the recommended solution? We would prefer to avoid requiring the customer to change the authorizing user from Co-Admin to Admin if there is another supported approach.

Thank you!