Skip to main content
Question

[C# SDK] Box API v2: Chunked upload fails with "400 Bad Request - Digest Mismatch"

  • August 29, 2026
  • 1 reply
  • 24 views

We are currently working on a project where we use the Box C# SDK (v5.x) to upload large files (100MB+) to our Box Enterprise account using the Chunked Upload API (CreateUploadSessionAsync). While standard single-part uploads work flawlessly for smaller files, large chunked uploads fail consistently.

After creating the upload session and splitting the file into chunks, calls to UploadFilePartAsync return a 400 Bad Request (Digest Mismatch) response.

anyone help?

1 reply

  • Jill
  • Community Manager
  • August 31, 2026

Hi ​@Nguyễn Thị Mai,

 

Welcome to Box Community! 

 

A 400 Bad Request (Digest Mismatch / digest_mismatch) error occurs during chunked upload sessions when the SHA-1 digest provided in the request header does not match the SHA-1 hash computed by Box's upload servers for that specific chunk of data.

 

To resolve this issue with the Box C# SDK (v5.x), please review the following common causes and troubleshooting steps:

  1. Reset Stream Read Position If you calculate the SHA-1 hash by reading from a byte stream or MemoryStream, the stream position will be at the end of the chunk. Ensure you reset the stream's read position

  2. Verify Digest Header Format 

  3. Confirm Chunk Boundaries and Byte Alignment Ensure that each chunk's size and byte offset match the exact part_size specified when the upload session was created via CreateUploadSessionAsync. Every chunk (except possibly the final part) must match this expected size.

  4. Leverage Built-In SDK Chunked Upload Utilities Rather than manually managing chunk splitting, hashing, and commit logic, we recommend utilizing the Box SDK's built-in file upload helpers (such as the chunked uploader utility), which handle stream partitioning, SHA-1 digest generation, retries, and session commitment automatically.

  5. Check for Intermediary Network Appliances (Proxies/Firewalls/DLP) Certain enterprise proxies, firewalls, or Data Loss Prevention (DLP) tools inspect and modify HTTP PUT payloads or headers in transit, which can corrupt the byte stream received by Box.

Please let us know if adjusting these parameters resolves the issue or if you need further assistance with your implementation.

Terms of ServiceAccessibility statement