Skip to main content
Question

How to get a Downscoped Token for a file or folder

  • May 22, 2025
  • 4 replies
  • 55 views
C
Forum|alt.badge.img

I'm playing witth Box API and was trying to get downscoped token for a file (based onhttps://developer.box.com/docs/downscope-tokens), This what I tried:

 

 

 

// Define resource and scopes that downscoped token should have access to// Define resource and scopes that downscoped token should have access to
val resource = "https://app.box.com/file/" + FILE_ID
val scopes = new ArrayList[String]
scopes.add("base_preview")
scopes.add("item_download")

// Perform token exchange to get downscoped token
val downscopedToken: ScopedToken = api.getLowerScopedToken(scopes, resource)

 

 

 

But then get the following error:

Exception in thread "main" com.box.sdk.BoxAPIResponseException: The API returned an error code [400] invalid_resource - The target resource is invalid.

at com.box.sdk.BoxAPIResponse.(BoxAPIResponse.java:92)
at com.box.sdk.BoxJSONResponse.(BoxJSONResponse.java:32)
at com.box.sdk.BoxAPIRequest.trySend(BoxAPIRequest.java:582)
at com.box.sdk.BoxAPIRequest.send(BoxAPIRequest.java:354)
at com.box.sdk.BoxAPIRequest.send(BoxAPIRequest.java:329)
at com.box.sdk.BoxAPIConnection.getLowerScopedToken(BoxAPIConnection.java:721)
at box.GetDownscopedTokens$.main(GetDownscopedTokens.scala:30)
at box.GetDownscopedTokens.main(GetDownscopedTokens.scala)

 

What is the expected resource should look?

    4 replies

    C
    Forum|alt.badge.img

    Hi ,

     

    I believe this is due to the resource that you're using. Box uses standard resource identifiers for files and folders, which looks like this:

     

    https://api.box.com/2.0/{FILES OR FOLDERS}/{RESOURCE-ID}

     

    So this is what it might looks like for a file example and folder example:

    String fileResource = "https://api.box.com/2.0/files/12345";
    String folderResource = "https://api.box.com/2.0/folders/67890";

     

    Here's an example of that in the Java SDK docs. 

     

    Let me know if you run into any issues,

    Jon

    C
    Forum|alt.badge.img

    Still running into The API returned an error code [400] invalid_resource - The target resource is invalid.

    Just to give more context, the file i'm trying to read is publicaly availalble to anyone with the sharing link, also the connection i'm using is a service account connection created as follow:

    val MAX_CACHE_ENTRIES = 100
val boxConfig = BoxConfig.readFrom( new InputStreamReader( new FileInputStream( path ) ) )
val accessTokenCache: IAccessTokenCache = new InMemoryLRUAccessTokenCache(MAX_CACHE_ENTRIES)
val api = BoxDeveloperEditionAPIConnection.getAppEnterpriseConnection(boxConfig, accessTokenCache)
api.setExpires(600000)

    I've been struggling to understand I could read such shared files from within an application!

    C
    Forum|alt.badge.img

     

     

    Would you be able to share the following: 

     

    • Client ID of your application (found in the config tab of the dev console) 
    • Full body response of the error 
    • Example date/time/timezone of the error 

    Alternatively, you can open a support ticket a support.box.com. We can take a look in our backend logs to get some more information on what's going on here! 

     

    Best, 

    Kourtney 

    Box Technical Support Engineer

    C
    Forum|alt.badge.img

    I'm receiving the exact same error with the Python SDK. This works:

    token_info = client.downscope_token(..., item=None)

     But this does not:

    folder = client.folder(folder_id='12345678')
token_info = client.downscope_token(..., item=folder)

     

    Terms of ServiceAccessibility statement