Box for Developers

 These error was occor . Somebody Know?esponse_type=codeedirect_uri=https://vertexaisearch.cloud.google.com/oauth-redirectstate=eyJvcmlnaW4iOiJodHRwczovL2NvbnNvbGUuY2xvdWQuZ29vZ2xlLmNvbSIsInRpbWVzdGFtcCI6MTc3NTk3NTMwMTYyN30=client_id=ye0n4oqaz2qbh1j2ej1broyja7lixmv

I am creating a signature request using the API. When the end user accesses the sign-in link, this dialog appears and is in English language. How can I change this text language?

I have been attempting to initiate a DocGen process through the API, and am being met with a 403 error indicating insufficient permissions. According to the developer console, ‘Manage Doc Gen’ is checked and enabled. I even forced a token refresh to see if that would make things update. Those efforts have had no effect, and the 403 error is still present. Are there any further steps I can take?The error response in full:{"message":"Insufficient permissions: Document Generation scope not enabled for this OAuth application","status":"error","fileId":null}The app’s service account is the one performing the action, and I have verified that it has access to all of the relevant folders and files the call is attempting to interact with.

Subject: OAuth 2.0 app — invalid_client on authorize endpointI'm getting an `invalid_client` error when attempting the OAuth 2.0 authorization flow for a custom app on our Standard Enterprise account (Enterprise ID: 42813).What I've done:1. Created a new Custom App in the Developer Console, selecting "OAuth 2.0" as the App Type at creation time (App ID: 2544805, "Claude OAuth")2. Configured redirect URI: http://localhost3. Scopes: Read all files/folders, Write all files/folders, Manage AI4. Saved configuration5. Verified Enterprise Settings > Platform Apps > "Disable unpublished platform apps by default" is OFFWhen I visit:https://account.box.com/api/oauth2/authorize?client_id=8q17251dyhyzbopddx012vadvvnk6at3&response_type=code&redirect_uri=http://localhostI get: "There was an error logging you in. Please restart your application and try again."In incognito, the error is more specific: "Error: invalid_client" with the correct client_id and redirect_uri shown in the detail

Hi, I need to restricting folder renaming for user after creation. Is there any SDK API available to call or any other option.ThanksSampathkumar s

Our company currently uses Box for Salesforce installed within our Salesforce environment. To further enhance integration with Box, we are considering adding new functionality to Salesforce. Specifically, we plan to develop a feature that automatically grants access permissions to the corresponding folder in Box when record-level access permissions are granted in Salesforce. In the standard Box for Salesforce specification, Box access permissions are granted when the user accesses the corresponding record in Salesforce. However, we want to be able to search and access Box content without accessing related records in Salesforce. To achieve this, we are considering using box.Toolkit, which is included in Box for Salesforce. Before proceeding, please allow us to confirm the following technical constraints and specifications regarding the use of box.Toolkit: We want to synchronize permissions to Box for Box users linked to Salesforce users. However, it is possible that Box users are not li

Hi, I’m trying to use the metadata query API to find files with a particular multiSelect value, but nothing I’m trying is working correctly and the documentation doesn’t even address this issue except to say that the “IN” operator won’t work on these fields. There has to be a way to do this. Currently , all I can do is find files with *the exact same list of multiSelect values* as I specify, but that’s not what I want. I want to be able to search for: assetType := “LOGO” and return all assets that *include* LOGO as one of the assetType values, but could contain other values as well. I’m not looking for items that only have that one value. So for instance, that search above should also match an item with assetType = ‘LOGO’, ‘ART’]   

Given a lock event returned from the List user and enterprise events endpoint, how can I determine the parent item that the event applies to? I cannot see any reference to the parent from the response payload (see below) nor any “Get lock by ID” endpoint or equivalent that I could use. Lock event response example{ "type" : "event", "createdAt" : "2026-03-19T14:41:22Z", "recordedAt" : "2026-03-19T14:41:25Z", "eventId" : "XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX", "createdBy" : { "id" : "XXXXXXXXXXX", "type" : "USER", "name" : "Foo Bar", "login" : "foo.bar@example.com" }, "eventType" : "LOCK_CREATE", "source" : { "id" : "XXXXXXXXXXX", "type" : "LOCK", "createdAt" : { "value" : "2026-03-19T14:41:22Z", "isPresent" : true }, "modifiedAt" : { "isPresent" : false }, "notificationEmail" : { "isPresent" : false }, "parent" : { "isPresent" : false }, "etag" : { "isPresent" : false }, "sequenceId" : { "i

As part of a disaster recovery my hosting company has moved my website to a different server, even a different datacentre. Since then my rclone backups don’t work, saying the token has expited, The expirry date in rclone.conf is shown as the last successful backup on the old server.Can someone advise me what I have to do to get it working again please?

Hello Box Community,I am currently using a free account, and I’ve noticed that I am unable to find the "Webhook" tab in the Developer Console. Could anyone here clarify which paid plan includes access to the "Webhook" feature?I would appreciate any help or insights on this.Thanks in advance!

HiError code as below, can you help me to solve this problem? {  "error": {    "message": "403: Box team folder not found",    "type": "server_error",    "param": null,    "code": null  }}

I would like to remove pinned devices in our enterprise on accounts that have had no activity in 90 days. I wrote the following with the help of Gemini and it appears it will work. I’m new to the Box CLI so if anyone else with more experience can take a look at this I’d appreciate it. # 1. Calculate the date 90 days ago in ISO 8601 format$thresholdDate = (Get-Date).AddDays(-90)Write-Host "Looking for users inactive since: $($thresholdDate.ToShortDateString())" -ForegroundColor Cyan# 2. Get all users and filter by 'modified_at'# Note: --max-items 5000 ensures we don't just get the first page$inactiveUsers = box users --all-users --json --max-items 5000 | ConvertFrom-Json | Where-Object { [datetime]$_.modified_at -lt $thresholdDate}if ($inactiveUsers.Count -eq 0) { Write-Host "No inactive users found. Exiting." -ForegroundColor Green exit}Write-Host "Found $($inactiveUsers.Count) inactive users. Fetching device pins..." -ForegroundColor Yellow# 3. Get all enterprise device pins$

In short: the app created a second folder ( [removed by moderator] ) because the Box service account it authenticates with may have a different root folder ("0") than the Box user where your original folder ( [removed by moderator] ) exists.Your files are being saved inside the app's folder ( [removed by moderator] ), not your existing one ( [removed by moderator] ). To find them, look for the service account's content in your Box admin console — it may be listed under "Service Account" or "App User" content depending on your Box enterprise setup.How do I see Service Account or App User folders????

When a folder is moved to the trash, webhook notifications for the files inside are not sent. Is this by design?Notifications will be sent for folders inside a folder that has been moved to the trash.

Need to Access Folder Using Personal User Connect using Server Auth Jwt For Accessing Folder and Files.But Didnt find Authentication tabWithout this can we connect through App?I have generated config but didnt work  might be enterprise id =0;Currently try to execute using this code.string path = @"D:\Box\Personal\config.json"; var reader = System.IO.File.ReadAllText(path); var config = BoxConfig.CreateFromJsonString(reader); var jwtAuth = new BoxJWTAuth(config);Is there any way to connect personal user with 3rd party api using Server Auth Jwt? 

We have installed and are currently using Box for Salesforce in our Salesforce environment.We are now considering adding new functionality in Salesforce to integrate more closely with Box. Specifically, we are planning to develop a feature that automatically grants permissions to the corresponding folder in Box when a user is granted record-level access in Salesforce.Under the standard specifications of Box for Salesforce, permissions on the Box side are granted when the relevant user accesses the corresponding record in Salesforce. However, we would like to enable users to search and access content in Box without requiring them to first access the related record in Salesforce.To achieve this, we are considering using the box.Toolkit included in Box for Salesforce.Before proceeding, we would like to confirm the following technical constraints and specifications regarding the use of box.Toolkit: Is it correct to understand that API calls made via box.Toolkit are not counted toward the B

Hi everyone,I would like to delete a V1 Webhook associated with my application, as I am planning to migrate to V2 Webhook.However, according to the official documentation, V1 Webhooks cannot be completely deleted. I understand that the only option is to revert it back to developer mode.Could anyone advise on how to proceed with this?[Application Information]- App Name: Dify Box Integration- Client ID: [removed by moderator]

Hello,I am currently developing an external system integration that retrieves data from Box via API.For this integration, we need to use an access token. However, the default access token expiration time is 1 hour, and refreshing the token every hour is not operationally practical for our use case.I would like to ask the following: Is it possible to extend the expiration time of an access token beyond the default 1 hour? In the documentation below, it appears that “Access Token Expiry” can be configured:https://developer.box.com/guides/authentication/app-token/app-token-setup#primary-and-secondary-app-tokens Could you clarify how to modify the expiration time and whether there are any limitations? Additionally, regarding Limited Access Apps:The documentation recommends using a Limited Access App, but I am unable to create one in my Developer Console. Is the creation of a Limited Access App restricted to Box Enterprise accounts? If I am using a non-enterprise developer account, is t

I encountered the following error.Could you please advise me on how to resolve it? An Apex error occurred: box.Toolkit.BoxApiException: Unable to create folder for record id 0019D00000Z9QJyQAN - Details: The folder was returned with a null id.

hello,I created an API request with cUrl to give access to a folder to an external user. I used the collaboration request and it worked for a very few folders and doesn’t work with most of them.Here is my request#!/bin/bash# Set your Box API key and access token API_KEY="xoxp-My Api Key" ACCESS_TOKEN="My valid Token"# Set the folder ID to which you want to invite the user FOLDER_ID="198762389512"# Set the email address of the user you want to invite USER_EMAIL="useremail@gmail.com"# Set the collaboration role to "viewer" COLLAB_ROLE="viewer"# Define the cURL request curl -X POST "https://api.box.com/2.0/collaborations" \ -H "Authorization: Bearer $ACCESS_TOKEN" \ -H "Content-Type: application/json" \ -d '{ "item": { "id": "'$FOLDER_ID'", "type": "folder" }, "accessible_by": { "login": "'$USER_EMAIL'", "type": "user" }, "role": "'$COLLAB_ROLE'" }'   Here is the error message :{ "type": "error",

Hi Team,I am currently investigating the best security practice for the Box Java SDK into our enterprise application and have a question regarding private key handling and PKCS standards.We are evaluating secure key management approaches and would like to understand whether the Box Java SDK supports authentication using private keys in standard PKCS formats, specifically: PKCS#1 (RSA private key format) PKCS#8 (Private-Key Information Syntax Specification) More specifically: Does the Box Java SDK natively support loading private keys in PKCS#1 or PKCS#8 format for JWT-based authentication? If PKCS#1 is not directly supported, is PKCS#8 required? Does the SDK support encrypted PKCS#8 keys? Are there any recommended best practices from Box for handling private keys in Java (e.g., conversion requirements, keystore usage, or specific security providers)? We are particularly concerned about enterprise-grade security compliance and compatibility with standard Java security libraries.

I’m using cURL to access the API.  I’ve successfully been able to search for a file by passing the template name and querying the value.  What I’m looking to do is structure the query as such that I can find a list of files that don’t have any metadata assigned to them. For this application, every file needs this particular template assigned to them, and a file without it is a good indicator that it needs to be processed.

Having a problem when I try to open MSOffice files through the web application and BoxTools. I can open files in Office for Web but when I try Office for Desktop I get this message:  “This action couldn’t be performed because Office doesn’t recognize the command it was given”I can open the files using Windows File Explorer through Box Drive. Any suggestions or ideas?   

Hi,I have created an application (2392115) to read the files from a program. It is in status “Pending Authorization”. How long it takes to get approved?  Thanks. 

On 2026-02-05 11:54:44, we use the Upload file version API (https://developer.box.com/reference/post-files-id-content). I got the below response: {"type":"error","status":503,"code":"unavailable","help_url":"http:\/\/developers.box.com\/docs\/#errors","message":"Service is temporarily unavailable","request_id":"r1l5zti9zii42z1x"} The file size is small (~1MB). I want to know more detail for the above error. Thank you.