Box Platform

I’m trying to transfer files and folders from one Box user to another. The technique is described in this post:developer.box.com/guides/users/deprovision/transfer-folders/#collaboration-transfer-methodThe last step of the process is to remove access for the owner by removing the collaboration:developer.box.com/guides/users/deprovision/transfer-folders/#remove-transfer-from-user-as-ownerHowever, when you use the API to get collaborations of files and folders using the API, the API only returns the collaborations of users other than the current owner.There was a similar post about this issue in:How to get Owner's collaboration ID through Box API – Box SupportThe answer there was to use the API to transfer ownership - using this API:https://developer.box.com/reference/put-users-id-folders-0/The problem with that is that the whole point of using the Collaboration Transfer method was to avoid doing a synchronous ownership transfer so using the transfer folder is not solving the problem.  So

Using an App+Enterprise JWT (server Auth) Service Account I am unable to interact with other service accounts using the Box API./users - return only users not service accounts/folders/0/items - returns 403 when I am impersonating (As-User) a Service Account userId.The issue is that I am trying to find all files in the organization, and service accounts can hold files/folders under their file tree, but these are unreachable using the API.Is there any way to find service Accounts and read their files using the API?

📌 Use Case:-For existing sign requests, we need to retrieve the embedded signing URL.-For new sign requests, we need both:-The embedded signing experience (embed_url_external_user_id)-The email notification sent to the signer❗Issue:When we include the embed_url_external_user_id parameter in the request payload (to generate the embedded signing link), the email notification to the signer is not sent.-No errors are returned in the API response-The sign request is created successfully-The embedded URL is generated and works-But no email is triggered to the signer✅ Expected Behavior:-When creating a new sign request and providing embed_url_external_user_id, we expect:-The signer to receive the standard email notification-The embedded URL to be available as an alternative signing option🔍 Request for Clarification:-Is it expected behavior that enabling embed_url_external_user_id suppresses the email notification?-Is there any way to enable both embedded signing and email notification simul

Is it possible to programmatically create an app user via Apex (Box Toolkit/Box SDK for Salesforce) and associate it with an Experience Cloud user in Salesforce?

Hi, a user is trying to connect BOX to my app and they’re not seeing any of their files show up. When they navigate to the web they get this: The application could not be added as it is lacking the proper configuration. Please check with an enterprise admin if the app is properly configured via Admin Console or contact the support e-mail indicated in app description for assistance. Any ideas?

Hi everyone,I’ve been testing the Content Sidebar UI Element via the CDN and noticed that the “Open With” option isn’t showing up. After digging into the docs and doing some trial and error, I wanted to confirm what I found in case others hit the same thing: The hasOpenWith parameter used to be part of Sidebar, but it only works for Enterprise accounts where App Integrations (Google Docs, Adobe, Box Edit, etc.) are enabled by an admin. On Free/Personal plans, those integrations aren’t available, so the Open With option won’t appear in the Sidebar at all, even if you set the flag in code. The current Sidebar options you can use on Free plans are: hasActivityFeed, hasMetadata, hasSkills, and detailsSidebarProps. So if you’re on a free plan and wondering why you don’t see “Open With,” that’s expected. To access it you’d need to be on a Business or Enterprise plan with integrations turned on by your admin.Hope this saves someone else a few hours of confusion 🙂

My BOX and Salesforce connection was working fine, and the connection was established between the BOX and Salesforce until last week. Starting this week, I am getting “Invalid Crypto Error” while Salesforce and BOX tries to connect.No, update is being made on the Private Key, and the Private Key is not expired as well, and no updates are being made on the BOX as well. All of sudden, the connection between BOX and Salesforce died on me. I tried to look for this issue in BOX and found this article which is not so helpful. My Private key is not encrypted to follow the encryption. I am using PKCS#8 PEM Format Private Key to connect it to BOX. Any suggestion or help on this issue will be really appreciated.Thank you!

I’m using the following snippet, I don’t receive any event in uploaderClose method. var configData = { ACCESS_TOKEN: "XXXXXXXX", FOLDER_ID: "XXXXXX" }; function uploaderClose(e) { console.log('close:', e); } var optionsUploader = { 'onClose' : uploaderClose } var options = { 'container': '.explorer', 'contentUploaderProps': optionsUploader } var contentExplorer = new Box.ContentExplorer(); contentExplorer.show(configData.FOLDER_ID, configData.ACCESS_TOKEN, options);

During call to query folder by metadata I'm getting HTTP 400 - too_many_instances, this is happening just with one box subscription, it's working for the other oneRequest:curl --location 'https://api.box.com/2.0/metadata_queries/execute_read' \--header 'box-version: 2024.0' \--header 'Content-Type: application/json' \--header 'Authorization: Bearer ****' \--data '{ "from": "enterprise_1234.metadata", "query": "entityId = :entityId and entityType = :entityType", "query_params": { "entityId": 1, "entityType": "TEST_FOLDER" }, "fields": [ "id" ], "ancestor_folder_id": "0"}'Response:{ "type": "error", "status": 400, "code": "too_many_instances", "help_url": "https://developer.box.com/reference/post-metadata-queries-execute-read/", "message": "Too many instances, and no supporting index available", "request_id": "0e75317d0072c5a523ba79f1422552050"}Tried to find something in box community but all the references are old and the links

issue 1: Were I have a box account as a admin and have the access to the whole box and things in there i am a partner on a box app in the developer console which i can’t able to access to the webhook v2 (with the signature and security) there i have enabled the manage webhook there but i can’t be able to use the webhook tab in there and use them there…issue 2: were there is no option for creating the access token (the permanent developer token) for my application there i need the specific steps to do it and enable them as well.. I need the proper steps to mitigate these issues and solve it the docs of the box are not suffice in some aspects in there which misses out the the primary and complete steps in there can you guide me through the steps to solve these things in there.  

 Hello, I'm trying to connect to the BOX MCP server. I referred to the guide here.  I couldnt get it working. How do I get the auth credentials?Is this endpoint correct?   I'm trying to connect to my our Agent Platform targeted at enterprise deployments  I wanted to try it with how we enabled shopify endpoints.  Best,Arun 

In today’s digital world, education has expanded beyond classrooms. Many parents now prefer online platforms for teaching their children important subjects, including religious education. One of the most effective ways technology is being used is through online Quran learning platforms.These platforms offer: Interactive classes with qualified teachers. Flexible schedules that suit children across different time zones. Digital resources like Noorani Qaida, Tajweed rules, and translation guides. Safe learning environments with parental supervision options. At Quran Kids Online, we provide kids with structured online Quran classes that include Tajweed, memorization, and translation. Our mission is to make Quran learning easy, accessible, and engaging for young learners worldwide.Technology has truly bridged the gap between teachers and students, and with platforms like Box supporting collaboration and education, the future of online learning looks even brighter.Question for the comm

 OverviewWhen executing the following API, only certain accounts are unable to retrieve the file list, which prevents the process from proceeding.If you have any insights on possible causes or solutions, I would greatly appreciate your guidance. Target APIhttps://api.box.com/2.0/folders/${folderId}/items?fields=id%2Cname%2Ctype%2Cmodified_at%2Cextension%2Cshared_link%2Cexpiring_embed_link&limit=100&offset=0 OAuth Endpoint Authorization: https://account.box.com/api/oauth2/authorize Revoke: https://api.box.com/oauth2/revoke Scope root_readwrite Execution EnvironmentReact Native + Expo SDK 51 + Expo Auth SessionWhat we have checked so far No API or network errors occurred, and no error information is available. Other accounts can retrieve the file list without any issues (both free and organizational accounts work fine). We verified account information using https://api.box.com/2.0/users/me. However, for accounts that cannot retrieve the file list, certain expec

Hey allI’m trying to use the Box Typescript SDK’s `client.search.searchForContent()` method to query for Folders using `tags`. There are two routes that I tried, both did not result in success, so was hoping someone knows what’s going on. The two routes were:Update Folder `tags` property:on Folder Create, add step which calls PATCH Folder (`client.folders.updateFolderById`) and update `tags` property const folder = await this.scopedClient.folders.updateFolderById( folderId, { requestBody: { tags: tags }, } ); oddly, when I GET Folder after this PATCH, I don’t see the “tags” attribute defined (ie: `tags: undefined`). I tried the same call, with both `name` and `tags`, and still, `tags` was not updated, however `name` was updated and changed when query’ing, add to query params `query: {tags}` const searchResults = await this.scopedClient.search.searchForContent({ contentTypes: 'tags', query: tags.join(' '),

Hi, I couldn’t find any information on whether I can create custom apps on Business and Business Plus plans. And if we can, can we enable the “App + Enterprise Access” scope for the custom app? Thanks!

Hi, im using n8n box create folder node, sometimes i get this error, seems like box api issues?{  "errorMessage": "The DNS server returned an error, perhaps the server is offline",  "errorDetails": {    "rawErrorMessage": [      "getaddrinfo EAI_AGAIN api.box.com",      "getaddrinfo EAI_AGAIN api.box.com"    ],    "httpCode": "EAI_AGAIN"  },  "n8nDetails": {    "nodeName": "Create a folder",    "nodeType": "n8n-nodes-base.box",    "nodeVersion": 1,    "resource": "folder",    "operation": "create",    "time": "8/11/2025, 5:29:04 PM",    "n8nVersion": "1.102.3 (Self Hosted)",    "binaryDataMode": "default",    "stackTrace": [      "NodeApiError: The DNS server returned an error, perhaps the server is offline",      "    at ExecuteContext.boxApiRequest (/usr/local/lib/node_modules/n8n/node_modules/.pnpm/n8n-nodes-base@file+packages+nodes-base_@aws-sdk+credential-providers@3.808.0_asn1.js@5_1af219c3f47f2a1223ec4ccec249a974/node_modules/n8n-nodes-base/nodes/Box/GenericFunctions.ts:46:9)", 

Hello Box Community,I’m working on integrating Box with my application and want to establish a security policy federation. Specifically, I want to map user permissions from Box to my application’s permission model, ensuring consistent access control across both platforms.So far, I have explored the following: The Get File API to retrieve permissions, but it only returns permissions for the current user. This means I would need to get all enterprise users and execute the Get File API for each user individually to gather permissions for all users, which seems inefficient. The Collaborations API to retrieve collaborators on files and folders. Is there any existing solution, best practice, or recommended approach for: Federating security policies between Box and an external application? Efficiently mapping Box user permissions or roles to custom permissions in my app without having to query each user individually? Tools or APIs provided by Box to facilitate this kind of integration?

I’m an admin in our Box Business (not plus) account and have already enabled all the required permissions as outlined in the Box documentation.I’m trying to impersonate a user using the As-User header, but when I use an OAuth 2.0 access token obtained via the refresh token flow, I consistently receive a 403 Forbidden error.However, when I use a Developer Token generated directly from the Box Developer Console (UI), the same API call works without issues. What could I be missing here?Does the Developer Token grant broader permissions compared to tokens obtained via the OAuth 2.0 refresh token flow?Is there something I need to configure differently during authentication to ensure the correct permissions or context are applied?  

Thought I read somewhere that free accounts can’t upload files using the Python API, but I couldn’t find anything about it in the docs.Anyone know if that’s still true?

I’m building a web application (React + Node.js) that integrates Box for document storage and collaboration using the Office Online editing feature. Here's a summary of our use case:✅ Use Case Overview: Users in our app upload various documents (e.g. .docx) for collaboration purposes When a document is uploaded: It is saved to Box via the API We store the file_id and metadata in our own database The user interface (our app) allows users to: Preview documents (via embedded Box preview) Edit documents (in Word Online) 🔐 Access Design: All Box operations are handled by a single Box service account End users do not have Box accounts When users click “Edit,” we want to redirect them directly to an Office Online editing session for the document ❓ Key Question:Is there any supported way to generate an editable Office Online link via the Box API that does not require the end user to log into Box?If not, is there a workaround — such as using App Users, JWT auth, or pr

In my iOS app, I am using UIDocumentPickerViewController to pick a file from a Box Drive file provider. I am using startAccessingSecurityScopedResource on the url I receive and register an NSFilePresenter for this url to get change notifications. When I read the contents of the file, I am using file coordination.  Reading the initial content is working fine. When now however the file is changed on some other machine, I expect a change notification from the file presenter and I should be able to read the fresh data from the updated file. This is however not working. I am only getting fresh data, when I terminate my app and re-pick the file with the UIDocumentPickerViewController.Is this a fundamental limitation of the Box Drive file provider under iOS or is there some secret on how to get fresh data while the app is running?

I'm trying to generate a client secret on my developer account. I have fully set up MFA (see screenshot below). Whenever I try to click "Fetch Client Secret", it redirects me to "https://app.box.com/login/mfa?redirectUrl=/developers/console/app/2363167/configuration&from=dev_console" and I then get the below screenshot. This is a bug, can somebody please help me?

I noticed that there is a change on Jun 24th, 2025 about Enhanced extract agent.Could you please tell me when I can use extract agent successfully in my code？(now when I post request to https://api.box.com/2.0/ai/extract I will get response with 400 bad request)Thank you for your support.

I’m trying to clarify MCP billing.1. Remote Box MCP Server  2. Self‑Hosted Box MCP Server  The Self‑Hosted Box MCP Server uses the Box SDK internally, which makes the underlying API calls. I think this is chargeable.Docs say:• Partner Integration is non-chargeable.  • Custom App is chargeable.For case of remote box mcp server, will the API calls be marked as chargeable or not?

https://api.box.com/2.0/users call fails eventhough right permission set thru developer portal