BOX: Add Collaboration to a folder using AppUser user token

Question

I am building an integration between my organization back-end systems and BOX.

One of the scenarios is that when certain event is happening inside my organization there is a need to create a folder in BOX and add collaboration objects to that folder (connect groups to the folder).

I have no problem to create the folder but when trying to create the collaboration I am getting the following error:

Box.V2.Exceptions.BoxException: Bearer realm="Service", error="insufficient_scope", error_description="The request requires higher privileges than provided by the access token."

I am using BOX SDK for .Net to interact with BOX.

The application I created in BOX is assigned to use AppUser User Type and I provided all the scopes that BOX allows me (All scopes except "Manage enterprise" which is disabled).

The code that fails is (C#):

var privateKey = File.ReadAllText(Settings.JwtPrivateKeyFile);
var boxConfig = new BoxConfig(Settings.ClientID, Settings.ClientSecret, Settings.EnterpriseID, privateKey, Settings.JwtPrivateKeyPassword, Settings.JwtPublicKeyID);
var jwt = BoxJWTAuth(boxConfig);
var token = jwt.AdminToken();
var client = jwt.AdminClient(token);

var addRequest = new BoxCollaborationRequest(){
    Item = new BoxRequestEntity() {
       Id = folderId,
       Type = BoxType.folder
    },
    AccessibleBy = new BoxCollaborationUserRequest(){
       Type = BoxType.@group,
       Id = groupId
    },
    Role = "viewer"
}; 
var api = client.CollaborationsManager;
var task = api.AddCollaborationAsync(addRequest);
task.Wait();

When running this code but replacing the Admin Token with Developer Token generated from the Box Applicaiton Edit Page it works.

Any help is appreciated

Koby Mizrahy Koby Mizrahy · Accepted Answer · 2016-07-07T12:32:08

OK, I had long discussion with BOX Technical team and here is the conclusion: Using AppUser is not the right choice for my scenario because it is limited only to the folders it creates. There is no way to bypass it.

The solution is: 1. Configure the Application to use standard user 2. Create User with administrative rights that will be used by the API to do activities in BOX. I named this user "API User" 3. Follow the oAuth 2 tutorial to generate access token and refresh token that the API .Net application can use instead of generating token for the AppUser. the oAuth 2 tutorial can be found at https://www.box.com/blog/get-box-access-tokens-in-2-quick-steps/

BOX: Add Collaboration to a folder using AppUser user token

2 Answers