Box Platform

Hi,I’m trying to find a way to restrict a range of files.Using a down scoped token like this: List<String> scopes = new ArrayList<String>();scopes.add("item_preview");scopes.add("item_download");List<TokenRestriction> restrictions = new ArrayList<>();for (String id : fileIds) { String resourceUrl = "https://api.box.com/2.0/files/" + id; restrictions.add(new TokenRestriction(scopes, resourceUrl));}ScopedToken downscopedToken = api.getDownscopedToken(scopes, null, null, restrictions);boxToken = downscopedToken.getAccessToken();I can’t find the class of the TokenRestriction.import com.box.sdk.TokenRestriction;   is not available.I’m using version 5.9 of the java SDK.Is there a solution use TokenRestriction or other way to restrict a list of files?Kind regards,Marcel​​​​​​​

We need access to the v1 webhooks for our app. This is so that our users can select a folder or root folder to monitor for new media files to auto import and transcribe using our service.I have already tested the webhooks functionality in production using our collaborator accounts.This is urgent because a lot of our box users have been asking for instant sync - currently we are having to poll the api for each connected user - hitting api rate limits.

Hi,I am using BOX python sdk to download files from a shared box drive. I use the code below to download files from the box drive. Recently, i noticed that this doesn’t return/download all of the files that matches the search query. I reported the issue to box sdk here but i was told it was an API issue. Can you please resolve this issue ASAP.

Hello!I need assistance with enabling my account as a free developer account so I can authorize apps and continue developing. However, I keep seeing the message, "Log in or sign up for a Box Developer account to access all of the Developer Console features," even though I am already logged in.If anyone knows what might be happening or how to resolve this, I would really appreciate your help.

How often does Box AI update the default LLM model? How do we get advance notification that this will happen?

  Hi everyone,  We are investigating an intermittent upload failure pattern and would  appreciate any community insights or official clarification.  When uploading files via the Box REST API using direct upload (non-chunked),  we have observed that some transfers are terminated mid-stream by the  server. The termination appears as TCP FIN followed by RST from  upload.box.com, with no HTTP response returned prior to disconnection.  This behavior occurs specifically on clients with lower network throughput,  which suggests the issue may be related to a time-based or throughput-based  threshold on the server side.  What we have ruled out:  - SSL inspection (not deployed in our environment)  - Intermediate proxy interference (packet analysis confirms server-initiated    disconnection from Box IP)  - HTTP-level rate limiting (no HTTP 429 received)  - Client-side timeout (the SDK does not initiate the disconnection)  Questions:  1. Has anyone encountered similar behavior where uploads from s

Installed Box for Salesforce and Box AI for Salesforce add on. Most of the calls work out of the box except a few such as Ask Box which would read a PDF stored in Box. Opened a Support case and the initial responses were incorrect.You can only access Box AI via Box Interface - No I just installed Box AI for Salesforce and it works. This is only available to Enterprise plans and up - Not according to this Oct 25 release from Box. https://support.box.com/hc/en-us/articles/45612941554835-Expanded-AI-API-Access-and-AI-Units-for-Business-Business-Plus-and-Enterprise-Plans So now I don’t trust the answers I’m getting. I just want a handful of credits to: 1. Confirm that the reason I’m getting the Unauthorization error for this specific API is because I need credits. 2. See if what it’s returning is what I can use for my Agent Action. The only purchase of credit option I see is for a full year?? I’d even buy a handful but I obviously do not want to commit to a year without trying. Support als

SummaryThe preflight check endpoint applies NFKC normalization to the incoming filename/folder name before checking for conflicts, but does not apply the same normalization to the names already stored in the folder. This causes an order-dependent, asymmetric 409 conflict for NFKC-equivalent names that can legitimately coexist as separate items.Steps to reproduceTake two names that are NFKC-equivalent but distinct code points:- Item A: `\uFA1B` (CJK Compatibility Ideograph, U+FA1B)- Item B: `\u798F` (CJK Unified Ideograph, U+798F)These two items can coexist in Box — the actual upload/create endpoint accepts both. However:Order 1 (succeeds):1. Upload/create `\uFA1B` → stored as `\uFA1B` ✓2. Upload/create `\u798F` → preflight normalizes `\u798F` → `\u798F`, no exact `\u798F` in folder → OK ✓Order 2 (fails):1. Upload/create `\u798F` → stored as `\u798F` ✓2. Upload/create `\uFA1B` → preflight normalizes `\uFA1B` → `\u798F`, finds existing `\u798F` → **409 Conflict** ✗This behavior is reprod

Hello,We are looking to automate Box workflows using the API, and I would like to better understand how the tagging system works. Are there any limits on the number of tags that can be assigned to a file or folder? Are there restrictions on tag length, as well as on the type of characters allowed (special characters, numbers, etc.), particularly when using the Box API?

Apologies if this has been asked in the past. Can someone tell me how I can get release notification for upcoming changes to Box AI API? I saw notes from https://support.box.com/hc/en-us/categories/21356727474323-Product-Guides but does not articulate any changes in the API (or changes to the default AI model). I’d like to be notified before the changes roll into Production so we can adequately prepare for the changes.

Hi, We are trying to connect box to a salesforce sandbox to run a few tests before this goes into Production. We keep getting the error “AccountId for User XXXXXX AccountId for Service Account null” We have installed the latest version of the package and we have never had box connected to Salesfoce before. We are a new customer. Some support and help on this would be great! Thanks.

Is it possible to create and list service accounts using box api 

 These error was occor . Somebody Know?esponse_type=codeedirect_uri=https://vertexaisearch.cloud.google.com/oauth-redirectstate=eyJvcmlnaW4iOiJodHRwczovL2NvbnNvbGUuY2xvdWQuZ29vZ2xlLmNvbSIsInRpbWVzdGFtcCI6MTc3NTk3NTMwMTYyN30=client_id=ye0n4oqaz2qbh1j2ej1broyja7lixmv

I am creating a signature request using the API. When the end user accesses the sign-in link, this dialog appears and is in English language. How can I change this text language?

I have been attempting to initiate a DocGen process through the API, and am being met with a 403 error indicating insufficient permissions. According to the developer console, ‘Manage Doc Gen’ is checked and enabled. I even forced a token refresh to see if that would make things update. Those efforts have had no effect, and the 403 error is still present. Are there any further steps I can take?The error response in full:{"message":"Insufficient permissions: Document Generation scope not enabled for this OAuth application","status":"error","fileId":null}The app’s service account is the one performing the action, and I have verified that it has access to all of the relevant folders and files the call is attempting to interact with.

Subject: OAuth 2.0 app — invalid_client on authorize endpointI'm getting an `invalid_client` error when attempting the OAuth 2.0 authorization flow for a custom app on our Standard Enterprise account (Enterprise ID: 42813).What I've done:1. Created a new Custom App in the Developer Console, selecting "OAuth 2.0" as the App Type at creation time (App ID: 2544805, "Claude OAuth")2. Configured redirect URI: http://localhost3. Scopes: Read all files/folders, Write all files/folders, Manage AI4. Saved configuration5. Verified Enterprise Settings > Platform Apps > "Disable unpublished platform apps by default" is OFFWhen I visit:https://account.box.com/api/oauth2/authorize?client_id=8q17251dyhyzbopddx012vadvvnk6at3&response_type=code&redirect_uri=http://localhostI get: "There was an error logging you in. Please restart your application and try again."In incognito, the error is more specific: "Error: invalid_client" with the correct client_id and redirect_uri shown in the detail

Hi, I need to restricting folder renaming for user after creation. Is there any SDK API available to call or any other option.ThanksSampathkumar s

Our company currently uses Box for Salesforce installed within our Salesforce environment. To further enhance integration with Box, we are considering adding new functionality to Salesforce. Specifically, we plan to develop a feature that automatically grants access permissions to the corresponding folder in Box when record-level access permissions are granted in Salesforce. In the standard Box for Salesforce specification, Box access permissions are granted when the user accesses the corresponding record in Salesforce. However, we want to be able to search and access Box content without accessing related records in Salesforce. To achieve this, we are considering using box.Toolkit, which is included in Box for Salesforce. Before proceeding, please allow us to confirm the following technical constraints and specifications regarding the use of box.Toolkit: We want to synchronize permissions to Box for Box users linked to Salesforce users. However, it is possible that Box users are not li

Hi, I’m trying to use the metadata query API to find files with a particular multiSelect value, but nothing I’m trying is working correctly and the documentation doesn’t even address this issue except to say that the “IN” operator won’t work on these fields. There has to be a way to do this. Currently , all I can do is find files with *the exact same list of multiSelect values* as I specify, but that’s not what I want. I want to be able to search for: assetType := “LOGO” and return all assets that *include* LOGO as one of the assetType values, but could contain other values as well. I’m not looking for items that only have that one value. So for instance, that search above should also match an item with assetType = ‘LOGO’, ‘ART’]   

Hello,We have created a Box Sign document template and would like to send it to multiple existing users for signature in an automated way. I am not an admin and have been trying to achieve this using automation tools like Zapier and n8n.Currently, I have a workflow that reads rows from a Google Sheet (containing user email and template ID) and attempts to send a Box Sign request when a new row is added. However, I am encountering permission-related errors (insufficient scope / 403) when calling the Box Sign API.From my understanding, this might be due to missing Box Sign API permissions (e.g., sign_requests.write) or lack of access to Box Sign for my account.Could you please confirm: Do I need admin approval or additional permissions to use the Box Sign API? Is it possible to automate sending Box Sign requests without admin involvement? Are there recommended approaches or tools for this use case (bulk sending via template)? Any guidance would be greatly appreciated.Thank you!

Given a lock event returned from the List user and enterprise events endpoint, how can I determine the parent item that the event applies to? I cannot see any reference to the parent from the response payload (see below) nor any “Get lock by ID” endpoint or equivalent that I could use. Lock event response example{ "type" : "event", "createdAt" : "2026-03-19T14:41:22Z", "recordedAt" : "2026-03-19T14:41:25Z", "eventId" : "XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX", "createdBy" : { "id" : "XXXXXXXXXXX", "type" : "USER", "name" : "Foo Bar", "login" : "foo.bar@example.com" }, "eventType" : "LOCK_CREATE", "source" : { "id" : "XXXXXXXXXXX", "type" : "LOCK", "createdAt" : { "value" : "2026-03-19T14:41:22Z", "isPresent" : true }, "modifiedAt" : { "isPresent" : false }, "notificationEmail" : { "isPresent" : false }, "parent" : { "isPresent" : false }, "etag" : { "isPresent" : false }, "sequenceId" : { "i

As part of a disaster recovery my hosting company has moved my website to a different server, even a different datacentre. Since then my rclone backups don’t work, saying the token has expited, The expirry date in rclone.conf is shown as the last successful backup on the old server.Can someone advise me what I have to do to get it working again please?

Hello Box Community,I am currently using a free account, and I’ve noticed that I am unable to find the "Webhook" tab in the Developer Console. Could anyone here clarify which paid plan includes access to the "Webhook" feature?I would appreciate any help or insights on this.Thanks in advance!

HiError code as below, can you help me to solve this problem? {  "error": {    "message": "403: Box team folder not found",    "type": "server_error",    "param": null,    "code": null  }}

I would like to remove pinned devices in our enterprise on accounts that have had no activity in 90 days. I wrote the following with the help of Gemini and it appears it will work. I’m new to the Box CLI so if anyone else with more experience can take a look at this I’d appreciate it. # 1. Calculate the date 90 days ago in ISO 8601 format$thresholdDate = (Get-Date).AddDays(-90)Write-Host "Looking for users inactive since: $($thresholdDate.ToShortDateString())" -ForegroundColor Cyan# 2. Get all users and filter by 'modified_at'# Note: --max-items 5000 ensures we don't just get the first page$inactiveUsers = box users --all-users --json --max-items 5000 | ConvertFrom-Json | Where-Object { [datetime]$_.modified_at -lt $thresholdDate}if ($inactiveUsers.Count -eq 0) { Write-Host "No inactive users found. Exiting." -ForegroundColor Green exit}Write-Host "Found $($inactiveUsers.Count) inactive users. Fetching device pins..." -ForegroundColor Yellow# 3. Get all enterprise device pins$