Box for Developers

I'm trying to build an automation between Annature and Box. We use Box as a document management system and Annature as e-signing software. I would really like to automate when a document is signed in Annature, have it push back through into Box and stay down to the correct client folder. Just noting that we have Zapier set up but I'm just struggling to dot the i's and cross the t's and get it fully over the line. If anyone's got any experience in this, I'd love to hear from you. 

Hi,I have a service account that was invited into a few client’s folders. It was probably renamed and it is under developers console → Platform Apps → Name of app now. I got everything here as Authorized and enabled since Jan 2023. Client changed security and enforces 2FA now, which I do have for my account. If I go to to the Content Manager, I see nothing here. All folders I had access to are gone. From the folder’s perspective I see the automation user as Pending I’m also Co-owner in another folder and I have rights to resend the invitationit says it does sent the email but that email is automatically generated so I assumed it comes to me or ideally all owners of the app as listed here but nope, I didn’t receive anything nor other Admins. How am I supposed to accept the invitation to virtual email that doesn’t exist? My use case is that I want to upload files or create sub-folders in a given folder from our integration application. It is our client’s Box probably as Enterprise and th

I have the exact problem that is discussed here - Transfer owned folders | CommunityThe account that is using OAUTH has all Co-Admin management for user and file access based on what is seen in the Manage Users. And the application appears to have the needed rights. However, when attempting to move the content to an Admin account (which we do within the web portal) a 403 forbidden is received. The process seems to allow the transfer to the OAuth user so member to Co-Admin which doesn’t correlate with the error that is received.  I have not tried transferring ownership of the folder to the admin account that we are using for all the other folder storage but really feel like that is not going to work.  I really wish there was an easier way to do this but if anyone has done this and can validate that it will work, I would appreciate the response.

Hi there, we submitted our app mid July for review and haven't heard back from you. We haven’t heard back from the team after 10 days and reached out to [removed by moderator] but also don’t get a response. Do you have a rough ETA on the review? The app can be previewed here: https://app.box.com/integrations/NepcCkAiWm/i Best,Erhard.

We need to rotate the OAuth client secret for an existing production mobile application while older versions remain installed.Could you clarify:1. Can multiple client secrets remain active during migration?2. Does generating a new secret revoke the existing secret?3. Will existing access and refresh tokens remain valid?4. Can existing refresh tokens be used with the new secret?5. Will users need to authenticate again?6. What zero-downtime migration process do you recommend?7. Does rotation require another application review?8. When is it safe to revoke the previous secret?

I am unable to view option to submit my app for authorization. I am not sure why, please help. I have none of the tabs or options where I am able to submit the app for request.

Hi everyone,I'm trying to automate our document approval process and wanted to see if anyone has implemented something similar.Here's our current workflow: A Word document/template is completed. Depending on the document, different people may need to sign. For example: Sometimes A, B, and C Sometimes A, D, and E Sometimes B, C, and F I receive the document and manually create a Box Sign request. I manually add each signer. I manually create every signature field and assign it to the correct signer. I send the request. The most time-consuming part is manually determining who needs to sign and then creating all of the signature fields every single time.Ideally, I'd like the process to work like this: The system reads the document (or metadata within the document). It determines which signers are required. It automatically creates the Box Sign request. It assigns the document to the correct signers. It automatically places the required signature fields for

Hello,We have created a Box Sign document template and would like to send it to multiple existing users for signature in an automated way. I am not an admin and have been trying to achieve this using automation tools like Zapier and n8n.Currently, I have a workflow that reads rows from a Google Sheet (containing user email and template ID) and attempts to send a Box Sign request when a new row is added. However, I am encountering permission-related errors (insufficient scope / 403) when calling the Box Sign API.From my understanding, this might be due to missing Box Sign API permissions (e.g., sign_requests.write) or lack of access to Box Sign for my account.Could you please confirm: Do I need admin approval or additional permissions to use the Box Sign API? Is it possible to automate sending Box Sign requests without admin involvement? Are there recommended approaches or tools for this use case (bulk sending via template)? Any guidance would be greatly appreciated.Thank you!

Subject: Custom App (Client Credentials Grant) blocked from downloading file content despite correct scopes, collaboration, and verified impersonationEnterprise ID: 290084Enterprise name: Simplexity ServicesApp name: WebDataApp ID: 2633167Client ID: 81jcl8rh4t3pc2b22z05n5rcumo5x4lkAuthentication type: Client Credentials Grant (Server Authentication)Service Account: [removed by moderator] (user id [removed by moderator] )SUMMARYMy Custom App's service account can successfully authenticate, list foldercontents, and read file metadata, but every attempt to download actual filecontent via GET /2.0/files/{id}/content returns: HTTP 403 {"type":"error","status":403,"code":"access_denied_insufficient_permissions", "message":"Access denied - insufficient permission"}This happens even when the request impersonates a full co-owner of theenterprise via the As-User header, so it does not appear to be apermissions/ownership/collaboration issue on any specific file or folder.I believe this is an ente

Hi Box Developer Team,We are developing a Node.js-based Box connector and are facing an issue while working with HTML files.We have uploaded an HTML file (for example, myhtml.html) to our Box account. However, we are unable to retrieve its metadata or upload a new version of the file using the Box API. What we have triedRetrieved the File ID from the Box web interface. Generated a valid OAuth 2.0 access token. Called the Get File Metadata endpoint using the official Box API. Tested the same request using the official Box API Swagger / API Explorer. Verified that the File ID and Access Token belong to the same Box account.   Issue The API consistently returns: HTTP 404 Not Found As a result, we are unable to: Retrieve the metadata of the HTML file. Upload a new version of the HTML file. Continue implementing our Box connector.QuestionsDoes Box support HTML (.html) files as regular files for metadata retrieval and version upload? Are there any limitations or special requirements for HTM

Hello. I’m hoping someone can help with this…I am trying to set up an app, to support the migration of some files from Box to a different storage system.I’ve set up the app on the developer console and it is showing as ‘Pending authorisation’, waiting for our admin to approve.But I am the admin and I’ve not received any emails or contact about it.Any advice on how I can get authorised?Thank you!

Our automation has been successfully uploading files to the folder shared by client for several years.Recently, the integration lost access to the folder.When authenticating as the App User, the following request returns Not Found:GET /2.0/folders/ [removed by moderator] When authenticated as my Box user account (using developer token), I can access the folder without issueThe folder still contains a collaboration for the App User:{ "accessible_by": { "login": " [removed by moderator] " }, "status": "pending", "created_at": "2023-06-26T06:50:34-07:00", "modified_at": "2026-06-25T11:56:27-07:00"}Notably:The collaboration has been in pending status since 2023. The integration worked while the collaboration was pending. Recreating the collaboration did not resolve the issue. Creating new application and sharing the folder did not resolve the issue. Not able to accept this collaboration thru API call: PUT /2.0/collaborations/{collaboration_id}23{4"status": "accepted"5}Returns:needs_two_fac

Hi there! We're hitting a consistent internal_server_error (HTTP 500) when creating a Box Sign request via the API.Setup: JWT Server Authentication app, App + Enterprise Access, "Manage signature requests" scope enabled, "Make API calls using the As-User header" enabled and re-authorized. We're impersonating the human user (ID [removed by moderator] ) who owns the Box Sign template, since our service account can list templates via GET /sign_templates but can't use them directly in POST /sign_requests (a limitation we confirmed with your community team).The problem: Under impersonation, POST /sign_requests takes ~55–60 seconds and then returns internal_server_error. We've reproduced this three times, varying the template and the payload each time, and it doesn't seem related to our request content. Request IDs:0b9355de83cd15cef04504510a7f61465 0a9813c0d687102d871cee0e92f1189ce 0668ad87c76e7d1b208840e67d0c13163 (bare payload, no prefill_tags — most useful for isolating the cause)The tem

I have an Automate workflow with a generate PDF outcome followed by a request signature outcome. I have 3 signers identified and 3 signature tags on the docgen template. When looking at the final PDF, the signatures are identifed as Signature1, Signature2 and Signature3 for the Field Name in the Signature Details. Does anyone know if there is a way to customize the Field Name for each signature? For example, Signature1 is actually the system user, so I would like to identify that as “User Signature” - I have this as text on the docgen template as a workaround, but I am looking for a dynamic solution.

I have an Automate workflow with a generate PDF outcome followed by a request signature outcome. On my docgen template I have the signature tag [[s|1|r:0     ]] and it is in white text color to hide it from showing under the actual signature that is applied to the final PDF. Unfortunately, the tag is also showing when the PDF is converted to text. Anyone know why the signature tag is not being replaced by the signature itself?

I would like to be able to have 2 lines of text for the ‘Title’ field on a signed document. I am entering the Title as Pre-filled Text but without the ability to have a second line, some employees job titles are too long?

I want to create a python script that grabs data from SQL Server, creates a csv, and drops it into my box.com folder automatically. I can do this with a developer token, but that expires after 60 minutes.The issue is that I have a enterprise_id of 0. Company A uses box.com and they are getting data from a bunch of Companies like mine. So they instructed me (Company B) to create a free personal account and they shared a folder with me that I can dump my data into.I have to drop data in weekly, and setting up an automated process would be best. I created a developer account and got a developer token and was successful in a test. But I need a token that lasts longer, and I am reading that JWT does not work with enterprise_ids of 0. OAuth doesn’t really apply to my situation.Is there anything I can do to automate this process? 

Will keep it short and sweet. I am looking to build a folder structure traversal UX that includes search/sort/filtering capabilities. e.g.Find me files with metadata attribute == X in folder YIt doesn’t seem like this is possible today. There are three APIs in questionGet Folder ItemsSearchMetadata Query Search and Metadata Query do not have the ability to only search within a single folder. Get Folder Items is limited in it’s filtering capabilities. It seems like an attribute I would expect in the metadata query filter options. ancestor_folder_id does not look at just a single folder, it looks at all folders below, which means we cannot recreate the folder structure navigation experience without serious server interception (prohibitively expensive). Has anyone solved this? Is this a known issue in the API offering? 

I am trying to integrate IBM Box with IBM Bob IDE using MCP to query files and folders from Box in real time. Here is what I have done so far: Created a Platform App in Box Developer Console - Selected Server type with Client Credentials Grant - Configured mcp_settings.json in Bob.Issues I am facing:1. Package @box/box-ai-agent-toolkit-mcp returns 404 on npm — does not exist2. App status is Disabled — pending IBM enterprise admin approval3. Developer Token option is greyed outQuestions:1. What is the correct npm package name for Box MCP Server?2. Does Box MCP officially support IBM Bob IDE?3. How to get enterprise Box app approved faster?4. Is there an alternative way to connect Box to Bob without admin approval?Any guidance would be really helpful!

We created a Box Platform App using JWT server authentication. The app is configured as App Access Only, not App + Enterprise Access, and the authorized scope currently shown is “Read all files and folders stored in Box.”The JWT token authenticates as the app’s Service Account / Automation User. In our case, the token identifies as:Name of automation serviceE-mail of automation serviceWhat is confusing is that we have not intentionally collaborated that Service Account onto the target folder or any parent folder. The folder and test Excel files were created by my sandbox admin user, not by the Service Account. Despite that, when we call the Box API with the JWT Service Account token and provide the folder ID, the app can list the folder contents and read file/folder metadata.For example, it can see the folder and files and read metadata such as owner, creator, file name, file ID, permissions, etag, etc. The metadata shows the folder/file is owned and created by my sandbox user, not the

Hi everyone,I have used Box Microsoft Sentinel Codeless Connector (CCP) connector which uses the REST API Poller to ingest Box Enterprise Events.The connector authenticates using the Client Credentials Grant against the Box OAuth endpoint.OAuth EndpointPOST https://api.box.com/oauth2/tokenGrant Typeclient_credentialsAdditional Parametersbox_subject_type=enterprisebox_subject_id=<Enterprise ID>The connector configuration is similar to:"auth": { "type": "OAuth2", "grantType": "client_credentials", "TokenEndpoint": "https://api.box.com/oauth2/token"}However, the connector consistently fails.Microsoft Sentinel reports the following error:RES40001Invalid Credential or cannot get credential for example OAuth2 access token.Call failed with status code 429 (Too Many Requests):POST https://api.box.com/oauth2/tokenNote that the credentials used are valid, Microsoft Sentinel Data Connector shows the following:  

I just created a webhook v1 and it says that I need to contact support in order to enable it, but it seems I need to have an Enterprise account in order to contact support in order to enable my webhook v1 for other users?

Using the Box Java SDK v10:During a high volume of uploads I occasionally see a “Stream already closed” exception.  This appears to be caused by a retry attempt on a 429 response from the original upload request.  It appears that the Box SDK attempts to retry the upload without resetting the stream so the stream has been read. I have written a custom RetryStrategy that resets the stream before a retry and this fixes the issue.  It seems like this should be part of the retry code or is this the expected way to handle retry attempts for uploads?

Using Box Java SDK v10:During a high volume of uploads (1000+ files), I occasionally receive a 409 (name_temporarily_reserved) error. When verifying the upload, the file that threw the exception DOES exists in the folder and appears to be uploaded successfully. It looks like the request is receiving a 429 response but retrying too fast (before the original upload is cleaned up)?  Seems like an Box issue but I’m not sure how to handle this scenario in my code.    

I’m trying to download a file that I created via the API, but keep getting an SSL error. Note that I can download the same file successfully using the API Developer playground, providing just the file ID and my developer token. See curl output below:$ curl -i -L "https://api.box.com/2.0/files/ [removed by moderator] /content" -H "authorization: Bearer <REDACTED_TOKEN>"HTTP/2 302 date: Wed, 11 Mar 2026 12:55:49 GMTx-envoy-upstream-service-time: 259location: <REDACTED_LINK>box-request-id: 07a3f1d1a260e4d0957df37044c38d148cache-control: no-cache, no-storestrict-transport-security: max-age=31536000via: 1.1 googlecontent-length: 0alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000curl: (35) error:0A000126:SSL routines::unexpected eof while reading