Box Platform

Hi everyone,I'm trying to integrate Box with WatsonX Orchestrate, and I’ve run into an issue I hope someone can help me with.Here’s my setup:I created a Box application using OAuth 2.0 with Client Credentials Grant (Server Authentication). The application has already been approved by the Box administrator. I’m attempting to connect this Box app to WatsonX Orchestrate. However, when I try to establish the connection from WatsonX Orchestrate, I get the following error:redirect_uri_mismatchI understand that this error typically means the redirect URI used in the authentication flow doesn’t match what’s registered in the Box Developer Console. But since I’m using Client Credentials Grant, there shouldn’t be a redirect URI involved, right?Has anyone successfully connected Box to WatsonX Orchestrate using this method?Do I need to configure a redirect URI anyway, or is there something specific WatsonX expects?Any guidance or examples would be greatly appreciated. I’d love to learn from others

Hello, I am wondering if anyone can explain a bit more about how the ftp server add on works. (https://support.box.com/hc/en-us/articles/ [removed by moderator] -Using-Box-with-FTPS , https://app.box.com/integrations/box_ftp_server/) I have a client that still uses FTP to upload images to an online platform. It would be great if I could share with them the proper use of this addon. They need to be able to send images or the contents of a folder from their box.com account directly to the external platform via FTP. The functionality I’m looking for is as follows: Images from my clients box account ---->FTP ---> external site platform Can anyone tell me how much this addon costs? I have been having difficulty finding a price. Any details would be greatly appreciated.

I’m using the Box Sign API to send a signature request using the POST /sign-requests endpoint:https://developer.box.com/reference/post-sign-requests/I’ve included HTML-formatted text in the email_message field so the email content appears styled (e.g., bold text, line breaks, etc.).The email is received correctly — the formatting in the email appears to be fine. However, in the signature request view, the email text is displayed with raw HTML tags instead of being rendered as formatted text.Is there a way to make the HTML render properly in the signature request, or does the API only support plain text for this field?Thanks in advance for your help! 

We are using Box from the user's perspective. We have an Enterprise license.It seems that the SFTP feature has been implemented, so I tried to check the connection because I want to use it for our regular operations, but it appears to be denied with 'Permission denied'.I would like to contact the Box administrator, but is there any permission setting that needs to be configured on the administrator side?ー　ー　ーboxをユーザ側の立場で利用しています。enterpriseライセンスです。SFTPの機能が実装されたということで、普段の運用業務で利用したいと思い接続確認してみましたが、Permission deniedで拒否されてしまうようです。box管理者に問い合わせしたいのですが、管理者側で何か許可設定をする必要はあるのでしょうか。

I’m an admin trying to transfer files from one user who has left our organization to her supervisor… however… I am getting an error "Source User is locked" with the API or “...is in another operation” when attempting to move files or change the folder owner in Box -- it’s been several days and it just never changes. I’ve tried several things and tried waiting for days -- but this is just a weird account that won’t budge.

I’m using Box SDK python package for development. Since the developer token is valid for only 60 minutes, I need to refresh once it’s expired. How to refresh developer token with Box SDK automatically so that my service can run without manually interrupted? Thanks.

Hi all — looking for guidance and confirmation on a BC/DR pattern for Box SSO.Current state (redacted): Box Enterprise with SAML SSO enabled. Primary IdP = a third-party SAML provider (not Okta). “SSO Required” is OFF so password logins remain possible. Two Box admin accounts have SSO bypass enabled and strong passwords (tested at https://account.box.com/login). A standby Okta SAML configuration is pre-staged in Enterprise Settings → Authentication (uploaded Okta IdP metadata & SHA-256 signing cert). Okta app uses NameID = EmailAddress; app username = email; standard givenName/sn claims. No change to the production IdP yet—we only want an emergency fallback. SCIM provisioning from Okta is not enabled (SSO only). What we want to do during an IdP outage: Admins enter via password (SSO bypass). Optionally flip SSO Provider in Box from the primary IdP → Okta to keep SSO for users. Keep SSO Required = OFF during the flip; validate with pilots; later flip back to the prim

I’m trying to confirm whether or not Box development could support setting up an SFTP server with Elliptic Curve Digital Signature Algorithm (ECDSA), such as using Server-side authentication using JSON Web Tokens (JWT).  And if so can anyone estimate the effort and/or point me to relevant examples or docs? I know that SFTP is supported with a user password (not SSO) per Box docs, but the financial services client I’m working has security stipulations allowing SFTP but only with key pair authorization (ECDSA preferred). I’m otherwise looking at setting up a basic Azure blob storage SFTP but they don’t support ECDSA specifically, and our teams already use Box for internal project document storage and sharing, so Box would be a preferred method for us if it’s possible. Overall goal is to be able to securely share files back and forth with external clients without requiring Box user licenses and access for those clients individual team members for short-term projects (their security team w

I am using a free account and want to generate access token from client credentials without browser login just through api calls.

The OAuth 2.1 “spec” simplifies some of the OAuth 2.0 specifications (e.g. eliminates those that are no longer considered secure, etc). One of the things OAuth 2.1 suggests is using PKCE even for Confidential (Server Side Clients). Here’s what OAuth 2.1 says, " PKCE is required for all OAuth clients using the authorization code flow" I don’t see any mention of PKCE in the Box documentation. Can you tell me if PKCE is being considered for future Box authentication?

Hi - Has there been any change or update to the BOX SFTP? I was able to connect to BOX via SFTP on Thursday, but since Friday I’ve been receiving the error ““Failed: Interactive authentication announced but rejected”. Our login credentials have not changed. I followed the below link to setup the connection.https://urldefense.com/v3/__https://support.box.com/hc/en-us/articles/ [removed by moderator] -Using-Box-with-SFTP__;!!NFWRZ6kECLqu!phiDSBMaKKLIQkISKivtTPZYrj23HEG8wLvWvYQ7EtkrwGihuhmkKAxBQanR5ATwNDCndxzRxby5xEylRR87YSbL$Thank you,Supritha.

Hi everyone, I’m looking to use the Box CLI Scripts to bulk delete Open links in Box in certain folders. I looked at the list of properties you can attach to the string and see nothing that specifies to target Open links, is there a way I can do that or is the script set to delete everything in the folder? Help would be appreciated :)

Hello,I’m facing an issue with Box Sign API: I upload a file via API and create a Sign Request — API responds successfully, but the sign email is not sent. If I upload the same file manually in the same folder and create a Sign Request, the email is sent. Question: How can I make API-uploaded files trigger the sign email automatically, like manually uploaded files?

Hi Box Team,I have a question regarding how API calls are counted towards the license-based rate limit when downloading a file.According to the File Download Guide, when I download a file, the SDK (or my app) first sends:GET https://api.box.com/2.0/files/{file_id}/contentThen Box responds with a 302 redirect, and my client follows it by making:GET https://dl.boxcloud.com/d/1/[long-random-string]/downloadMy questions are:  How many API calls are counted towards the license-based rate limit in this scenario — just the initial GET /files/{file_id}/content request, or both the API request and the subsequent dl.boxcloud.com download request? If the initial API request results in a 429 (rate limit exceeded) response, does this 429 request itself count against the license-based API call allocation? Thanks in advance for clarifying!

Hello,I’m facing an issue with my application that uses Client Credentials Grant. The app has already been authorized by the organization admin.I’m able to authenticate successfully using this request:curl --location 'https://api.box.com/oauth2/token' \ --header 'Content-Type: application/x-www-form-urlencoded' \ --data-urlencode 'grant_type=client_credentials' \ --data-urlencode 'client_id=<CLIENT_ID>' \ --data-urlencode 'client_secret=<CLIENT_SECRET>' \ --data-urlencode 'box_subject_type=enterprise' \ --data-urlencode 'box_subject_id=<ENTERPRISE_ID>'  With the token obtained, I can successfully call the metadata endpoint:curl --location 'https://api.box.com/2.0/files/<FILE_ID>' \ --header 'authorization: Bearer <TOKEN>'  This returns the file information correctly.However, when I try to download the file, I get a 403 error with code access_denied_insufficient_permissions: curl --location 'https://api.box.com/2.0/files/<FILE_ID>/content' \ --header

I'm having issues with Box Sign.  I have to agree to sign each time I sign, even if one right after the other.  I have to go back to the main search page and reset the filters (pending my action).  Is there a way to open each signature in a new tab?  Or better yet, set the default to open the next envelope?  It is really depressing when you have to sign 50 envelopes.

The OAuth "Grant Access" modal/page is not formatting the redirect URL so that it fits in the provided area, even for URLs of reasonable length.  Looks unprofessional. Suggest that the URL be wrapped so that it fits within the allotted space.

HiI have 3 systems that all need to see updates from Box.  Some of these will cross over (Ie Only 1 system needs to know about signatures but all 3 systems need to see updates about new files created)I know I can not create 3 webhooks against the same folder but can I create a folder structure Folder 1 - Folder 2 - Folder 3 and then my structure beneath folder 3 and attach a single webhook to each of the three folders?  Any activity within the lower levels would in theory trigger all 3 webhooks and update to 3 locations?I know I can not create a webhook at Root!Thanks in advance 

Completely unrelated to the “Invalid Crypto Key” error we ran into last month, a SINGLE one of our client’s (so far) Salesforce Partial sandboxes is now getting CORS errors from Box (using the Box SDK in a LWC) w/o making any changes to the component code, Salesforce, or Box config. We use this same lower level utility LWC code across about a dozen different client’s Salesforce Org’s, including dozens of total sandboxes & Production envs, and no other env is encountering this error...yet.I’ve opened a case w/ Salesforce Partner Community support and they’re running out of ideas, our Box CORS config is unchanged and includes the URL that’s throwing the CORS error, we’ve added and removed the domain back w/ & w/o the trailing slash and didn’t make a difference.I upgraded to the latest 4.91 version of the Box for Salesforce managed package since it adds a couple of extra Trusted URL’s...didn’t make a difference.The “Invalid Crypto Key” error also started as a single client’s Parti

I am currently able to send documents for electronic signature to members of my organization, whose names and email addresses auto-populate when adding them. However, I cannot find a way to add contact names and email addresses for persons outside my organization so that they, too, auto-populate when attempting to add them. Is there a way to import and/or create a contacts list for signatories outside of my company? 

I’m running a fairly straight-forward “ask ai question” API call, but it seems to be failing silently and returning a blank.  Using the same agent and prompt on box.com in UI on the same file, I get an answer, but when I call the exact same thing via API I get a blank.  I’m using the older boxsdk in python.  This is what my code looks like:  items = [ { "id": file_id, "type": "file", "content": "This is the document in PDF format" } ] ai_agent = { 'id':'40266263', 'type': 'ai_agent_id' } result = client.send_ai_question( items=items, prompt=prompt, mode="single_item_qa", ai_agent=ai_agent ) And I get this response:{'answer': '[]', 'created_at': '2025-09-12T08:47:04.178-07:00', 'completion_reason': 'done', 'ai_agent_info': {'models': [{'name': 'openai__gpt_5', 'provider': 'openai'}], 'processor': 'basic_text'}}I’m not sure what the issue is, I don’t get any erro

Hi all,I'm developing a java application to fetch box documents/files properties/Info. I'm able to get most of the file properties/Info except MIME type of the files. Is it possible to directly get the MIME type of a document/file using Box Java SDK ? Please suggest your suggestion. Thank you,Arpit

Do any one has any experience connecting Business Objects to Box? We are trying to schedule the file transfer from Business Objects to Box and not able to make the successful connection.

We are needing further clarification on which API calls are chargeable in regards to custom apps.It seems like from our testing that below is true :1 : Upload/Download calls are NOT charged2 : Failed calls are NOT chargedWe are looking at developing a new custom app that will replace our current one for provisioning/deprovisioning users on a daily basis as we are a large org and want to do more than just creating/disabling/deleting users like having reports automatically run or updating metadata.Is there a list or document that details which calls are chargeable and which aren’t?Thanks!

Hi all,I am a composer that uses box for file sending.  Unfortunately the streaming of audio on the site is not very good and introduces artifacts to the mixes.  So my clients aren’t hearing what i am intending them to hear.Its a deal breaker for obvious reasons.  I was wondering if the devs are aware of this issue?  Thanks!Greg