Hi,
I'm testing the API of Box and I want to test the annotation feature.
I can do annotations with the application user but when I want to create an actor token as described in the API documentation, the serveur return a 400 error :
{"error":"invalid_request","error_description":"Your app cannot use \"actor_token\" due to Box policy"}
Could you explain me which policies are taken in account in this case and the code/configuration to use annotations features (with actor token) ?
Regards,
Ludovic SMADJA
---
Here's the content of the request
data[0] = new NameValuePair("subject_token",accessToken);
data[1] = new NameValuePair("subject_token_type", "urn:ietf:params:oauth:token-type:access_token");
data[2] = new NameValuePair("scope", "item_preview");
data[3] = new NameValuePair("resource", "https://api.box.com/2.0/files/"+boxId);
data[4] = new NameValuePair("grant_type", "urn:ietf:params:oauth:grant-type:token-exchange");
data[5] = new NameValuePair("actor_token", assertion);
data[6] = new NameValuePair("actor_token_type", "urn:ietf:params:oauth:token-type:id_token");
The assertion added to this request is :
wtClaims claims = new JwtClaims();
claims.setIssuer(clientID);
claims.setAudience(JWT_AUDIENCE);
claims.setExpirationTimeMinutesInTheFuture(0.9f);
claims.setSubject("j_2");
claims.setClaim("box_sub_type", "external");
claims.setClaim("name", "My name for annotation");
claims.setGeneratedJwtId(64);