Box Platform

We are a software house, currently we signed up box.net, and we would like to share out different folders based on client, e.g. my-box.net account + ClientA folder + ClientB folder and our client A, B are not box’s subscribers. Hence, is it possible for us to share any credentials (similar to SFTP) and allow client A, B to access their folders respectively and pull out their files?

We want to make you aware of a recent effort by certain third-party bad actors to leverage free Box developer accounts in a social engineering attack on certain Box free individual accounts. Upon discovery of this issue, Box decided to temporarily disable new sign-ups for free developer accounts while we work to implement additional technical controls to prevent similar efforts in the future. The security and integrity of our Service is of utmost priority to Box, and we must ensure that we are providing the most secure product experience to our customers. We understand that some Enterprise customers use these free developer accounts for their own business purposes, and that they may have questions about their inability to sign-up new free accounts. Please use the following talking points when addressing these Customers’ questions or concerns: Any free developer accounts that were in place before March 9, 2023 are unaffected by this action; Customers may continue to use these pre-exist

Hi, Last year we had to disable the creation of free developer accounts due to abuses from some bad actors. You can read about it here: Free developer accounts -Please READ I’m happy to inform that creation of free developer accounts is now back! To create a free developer account simple navigate to the developer signup. The main difference between the free developer account and a simple free account is that the developer version has access to the administrator console which will allow you to authorize JWT and CCG applications. Stuck with OAuth 2.0? Not anymore! Enjoy!

Hello Box Developer Community, I hope this message finds you well. I am currently experiencing an issue with the Box UI Element’s Content Preview feature in our application. We are using this feature to preview PDFs, but we have noticed that the preview becomes unavailable after approximately 10 to 15 minutes. We have confirmed that this issue also occurs in the official documentation, where the preview times out after the same duration. We are seeking a solution to prevent this from happening without requiring our users to clear their cache. Additionally, we have identified that URLs from the domain dl.boxcloud.com, which are provided by Box for downloading, expire after 15 minutes. We suspect this might be related to the issue we are experiencing with the content preview timing out. Could anyone confirm if this expiration is affecting the preview functionality and provide guidance on how to handle it? Here are a few considerations and questions we have: Session Expiration: It seems

Hi folks, For those of you using the Box Postman advanced collection with JWT authentication, with a recently generated private key, you might be having error when the pre-request script tries to get a new access token. The error in question is a malformed PCKS. The reason behind this is that Box has updated the encryption method of the private key to something not supported by the JSRSASign v10.x. The good news is that the new version of JSRSASign (v11.x) does support it. While we fix the collection here is a quick fix: Download the JSRSASign from the CDN. Go to and select the Box Advanced collection Replace the content of the variable libJSRSASign with the content from the CDN link above. Remember to Save!!! Your all set. We’ll update the collection in Postman shortly.

Good morning, I have a long running process that starts by reading the directory contents of between 70k + 700k files, when running the process on a very small set of data, it works 100%, on my side of the process it then runs a series of ‘things’ on that data, then generates a metadata template and stamps it on the file. This works 100% until, what I think is, the token becoming stale/invalid/expired. I say this because if this process runs for like 4-6hrs, nothing. It works perfect, but around 24hr, when i stamp the template i get 401 errors. So the first thing i did (my program is in Rust) is re-build my auth before stamping the templates. Example Code: let client = Client::builder().build().unwrap(); let params = [ (“client_id”, “”), (“client_secret”, “”), (“grant_type”, “client_credentials”), (“box_subject_type”, “enterprise”), (“box_subject_id”, “534608”), ]; //Get client token let response = client .post(“https://api.box.com/oauth2/token”) .form(&params) .send() .await .un

We have a number of users outside of our domain that were inappropriately added as managed users. I want to roll them off the enterprise and convert them to external users, but when using box-sdk-gen and emit a client.users.update_user_by_id(xxxx, enterprise=None) nothing happens. It seems to execute successfully, but fetching that user again shows that the enterprise information is still present. If I try to execute with enterprise={'id':None} or enterprise='null' I get a 403 insufficient permissions error. I noticed that the type on the enterprise field is str so that’s why I tried the latter. { 'code': 'access_denied_insufficient_permissions', 'help_url': 'http://developers.box.com/docs/#errors', 'message': 'Access denied - insufficient permission', 'request_id': 'xxxxx', 'status': 403, 'type': 'error'} Raw body: {"type":"error","status":403,"code":"access_denied_insufficient_permissions","help_url":"http:\/\/developers.box.com\/docs\/#

Hi Box Team I have a Box business account that has a monitoring system in place to track which files are being downloaded by each user. I would like to exclude a specific user (identified by their user ID or email address) from this monitoring system. Is there a manual process within the Box admin console to achieve this? Or is it possible to do this programmatically via the Box API? Please provide the steps for both the manual process and the API method, if available. I want to understand how to selectively skip monitoring for a single user while keeping it enabled for all other users. Let me know if you need any clarification on the question. I appreciate you taking the time to provide a detailed response on how to accomplish this in Box. Thanks

I’m trying to use the .NET SDK to create a signature request for a file. My code is: public async Task<BoxSignRequest> CreateSignatureRequest(BoxUser user, string signerEmail, string emailMessage, string subject, string sourceFileId, string destinationFolderId) { var userClient = GetUserClient(user); //this uses the Client Credentials Grant to get a token for the user that owns the file BoxSignRequestCreateRequest createRequest = new BoxSignRequestCreateRequest() { AreRemindersEnabled = true, AreTextSignaturesEnabled = false, DaysValid = 10, EmailMessage = emailMessage, EmailSubject = subject, ParentFolder = new BoxRequestEntity() { Id = destinationFolderId }, Signers = new List<BoxSignRequestSignerCreate>() { new BoxSignRequestSignerCreate() { Email = signerEmail, LoginRequired = true, Role = BoxSignRequest

My request is VERY basic. Get a list of thee following: List all top level folders List the path of the folder List the owners and co-admins List the size of the folder including subfolders List the number of items in the folder and subfolders Using JWT for this and have enabled all scopes with apps + enterprise access The real issue is that I STILL have to add the service account as a co-admin to get this data. How can I ensure my enterprise token access allows me to read data enterprise-wide? It is ridiculous that this isn’t even a report in the console that I must build a custom solution.

Question about the Collaboration Limit Is the maximum number of collaborators that can be invited to a file 500 people? When trying to invite collaborators with 500 already present, the following response is returned: Unexpected API Response [403 Forbidden | xxxx ] access_denied_insufficient_permissions - Access denied - insufficient permission I have confirmed that more than 1000 people can be invited to a folder, but is there a limit on the number of collaborators that can be invited to a folder?

Hi, I am trying to use box-ui-elements in my custom built react app project but keep getting the same errors about box-ui-elements not being installed correctly. Any help would be appreciated.

I cannot upload to the Box by calling API in the Azure Data Factory. I can not use SDK and I got HTTP 400 error , “Malformed stream” following is the Body that I created in the Azure pipeline:( it should be in JSON format) @concat('--------------------------9fd09388d840fef1 content-disposition: form-data; name=“attributes” {“name”:“testdev.xlsx”, “parent”:{“id”:“0”}} --------------------------9fd09388d840fef1 content-disposition: form-data; name=“file”; filename=“testdev.xlsx” content-type: text/csv ‘, variables(‘varFileContents’),’ --------------------------9fd09388d840fef1– ')

I have a ui which I manage authorization via Okta. So for a user to access the box files it creates a temporary shared link that expires after an hour. This link is opened by the UI and this has worked great for past month and lets me manage more advance authorization and such on my end rather than adding people to our folders directly. However, out of no where my code stopped working and its drawing an error at the creating the shared link and the stack trace doesnt give much info. Here is my code: public async Task<string> GetSharedLink(string Id) { try { BoxClient adminClient = _session.AdminClient(await token.FetchTokenAsync()); var sharedLinkParams = new BoxSharedLinkRequest() { Access = BoxSharedLinkAccessType.company, Permissions = new BoxPermissionsRequest { Download = true, Edi

Hello, I would like to know if it is possible to prevent an employee from being able to sign a document or to request a signature. Eventually I would like some help with the java sdk. Sincerely

Is there any way to differentiate the two types of file locks, as explained below?? A user can manually lock a file. A user can click the custom application’s web-integration and it can lock the file using BOX-APIs. I have a custom application with OAuth2.0 and Web Integrations. OnClick of a web-integration, I use node-sdk (Initialised with user’s auth-code) to lock the file. Later, I used the search API to get all files in the folder., Is there any way to identify the files locked via my application, using NodeSDK? I want to unlock them only, if it is locked by the application itself. I couldn’t find anything to achieve this. Can you help me find a workaround for this?? Is there any fields in lock object, that i can re-purpose for this use-case? Thanks, Sarin

Hello - I am working on a custom application that requires the use of annotations on files. I am consistently running into issues with annotations. Our application utilizes JWT for authentication. When attempting to downscope the access token with scopes needed for the UI elements + annotations, I consistently get “Insufficient permissions” for the downscoped token. Upon looking at the permissions for my file using the downscoped token, I notice that there are additional permissions that are not enabled despite following the scopes outlined in the documentation: Downscoped access token (scopes: base_preview item_download item_upload annotation_edit annotation_view_all base_sidebar item_comment item_preview) { "type": "file", "etag": "0", "permissions": { "can_download": true, "can_preview": true, "can_upload": true, "can_comment": true, "can_rename": false, "can_delete": false, "can_share": false, "can_set_shar

I have been using the same call for some days but since a couple of days we started getting 400 responses when using offset in a /search call. For example: {'type': 'error', 'status': 400, 'code': 'bad_request', 'context_info': {'errors': [{'reason': 'invalid_parameter', 'name': 'offset', 'message': "Invalid value '2'."}]}, 'help_url': 'http://developers.box.com/docs/#errors', 'message': 'Bad Request', 'request_id': 'gcvgk4hqlhels3di'} The original call was to the url https://api.box.com/2.0/search?limit=11&offset=2&content_types=name,description&ancestor_folder_ids=250469971042&type=folder&fields=name,description,path_collection&query=%2232%22 Are we composing the URL right? Thanks in advance!