Hello, we have an integration to a third party apllication using Oauth 2 and apis v2.0/users and events. we are trying to determine the minimal permissions required to authorize this application, from the documentation it looks like user needs to be either and Admin or co-Admin to authorize. Can someone confirm this.
Below is the infromation in the developer documentation and Box Admin Dicumentation.
The Box API requires the application and user authenticating the application to have the correct permissions.
User permissions and scopes
It is important to understand that even if an application has the right scopes to perform an action, the user authenticated in the API call needs to have permission to perform that action as well, and vice versa.
For example, if your application is set up to read files, the authenticated user does need to have permission to read the file you are trying to access.
The three Box Admin types are:
- ADMIN: Admins can manage users and groups, view and edit all of their organization’s files and folders, log in to any user’s account within their organization, edit settings for their organization, and run or access reports. The Box Admin is the principal account administrator.
- CO-ADMIN: Co-admins can perform the same duties as the organization’s Admin, but they cannot make changes to the Admin’s permissions or other Co-admins' permissions. The default access levels for Co-admins, which are set to include only the ability to manage users and groups, can be modified on a per-user basis.
- GROUP ADMIN: Group Admins can add existing users to their groups, create new users that will be assigned to their groups, and assign folder access to their groups. They can also run reports for their groups.
https://developer.box.com/guides/api-calls/permissions-and-errors/scopes/