{ "info": { "_postman_id": "ce2e2661-ae6a-4463-af01-14a015f4264e", "name": "Box Authorize Authorization API", "description": "Needs a description.", "schema": "https://schema.getpostman.com/json/collection/v2.1.0/collection.json", "createdAt": "2026-07-28T01:15:37.000Z", "updatedAt": "2026-07-28T01:15:37.000Z", "lastUpdatedBy": "35240", "uid": "35240-ce2e2661-ae6a-4463-af01-14a015f4264e" }, "item": [ { "name": "authorize", "item": [ { "name": "Box Authorize user", "id": "be30880d-0026-4f57-af10-14ddffba5f74", "protocolProfileBehavior": { "disableBodyPruning": true }, "request": { "method": "GET", "header": [ { "key": "Accept", "value": "text/html" } ], "url": { "raw": "https://account.box.com/api/oauth2/authorize?response_type=code&client_id=&redirect_uri=&state=&scope=", "protocol": "https", "host": [ "account", "box", "com" ], "path": [ "api", "oauth2", "authorize" ], "query": [ { "description": "(Required) The type of response we'd like to receive.", "key": "response_type", "value": "code" }, { "description": "(Required) The Client ID of the application that is requesting to authenticate\nthe user. To get the Client ID for your application, log in to your\nBox developer console and click the **Edit Application** link for\nthe application you're working with. In the OAuth 2.0 Parameters section\nof the configuration page, find the item labelled `client_id`. The\ntext of that item is your application's Client ID.", "key": "client_id", "value": "" }, { "description": "The URI to which Box redirects the browser after the user has granted\nor denied the application permission. This URI match one of the redirect\nURIs in the configuration of your application. It must be a\nvalid HTTPS URI and it needs to be able to handle the redirection to\ncomplete the next step in the OAuth 2.0 flow.\nAlthough this parameter is optional, it must be a part of the\nauthorization URL if you configured multiple redirect URIs\nfor the application in the developer console. A missing parameter causes\na `redirect_uri_missing` error after the user grants application access.", "key": "redirect_uri", "value": "" }, { "description": "A custom string of your choice. Box will pass the same string to\nthe redirect URL when authentication is complete. This parameter\ncan be used to identify a user on redirect, as well as protect\nagainst hijacked sessions and other exploits.", "key": "state", "value": "" }, { "description": "A space-separated list of application scopes you'd like to\nauthenticate the user for. This defaults to all the scopes configured\nfor the application in its configuration page.", "key": "scope", "value": "" } ] }, "description": "Authorize a user by sending them through the [Box](https://box.com)\nwebsite and request their permission to act on their behalf.\n\nThis is the first step when authenticating a user using\nOAuth 2.0. To request a user's authorization to use the Box APIs\non their behalf you will need to send a user to the URL with this\nformat." }, "response": [ { "id": "4a612284-e109-40f6-badc-5b0fdbd05dd1", "name": "Does not return any data, but rather should be used in the browser.", "originalRequest": { "method": "GET", "header": [ { "key": "Accept", "value": "text/html" } ], "url": { "raw": "https://account.box.com/api/oauth2/authorize?response_type=code&client_id=&redirect_uri=&state=&scope=", "protocol": "https", "host": [ "account", "box", "com" ], "path": [ "api", "oauth2", "authorize" ], "query": [ { "description": "(Required) The type of response we'd like to receive.", "key": "response_type", "value": "code" }, { "description": "(Required) The Client ID of the application that is requesting to authenticate\nthe user. To get the Client ID for your application, log in to your\nBox developer console and click the **Edit Application** link for\nthe application you're working with. In the OAuth 2.0 Parameters section\nof the configuration page, find the item labelled `client_id`. The\ntext of that item is your application's Client ID.", "key": "client_id", "value": "" }, { "description": "The URI to which Box redirects the browser after the user has granted\nor denied the application permission. This URI match one of the redirect\nURIs in the configuration of your application. It must be a\nvalid HTTPS URI and it needs to be able to handle the redirection to\ncomplete the next step in the OAuth 2.0 flow.\nAlthough this parameter is optional, it must be a part of the\nauthorization URL if you configured multiple redirect URIs\nfor the application in the developer console. A missing parameter causes\na `redirect_uri_missing` error after the user grants application access.", "key": "redirect_uri", "value": "" }, { "description": "A custom string of your choice. Box will pass the same string to\nthe redirect URL when authentication is complete. This parameter\ncan be used to identify a user on redirect, as well as protect\nagainst hijacked sessions and other exploits.", "key": "state", "value": "" }, { "description": "A space-separated list of application scopes you'd like to\nauthenticate the user for. This defaults to all the scopes configured\nfor the application in its configuration page.", "key": "scope", "value": "" } ] } }, "status": "OK", "code": 200, "_postman_previewlanguage": "text", "header": [ { "key": "Content-Type", "value": "text/html" } ], "cookie": [], "responseTime": null, "body": "", "createdAt": "2026-07-28T01:15:37.000Z", "updatedAt": "2026-07-28T01:15:37.000Z", "uid": "35240-4a612284-e109-40f6-badc-5b0fdbd05dd1" }, { "id": "9f843459-90ac-4ecd-99a0-99d659eee2ab", "name": "Does not return any data, but rather should be used in the browser.", "originalRequest": { "method": "GET", "header": [ { "key": "Accept", "value": "text/html" } ], "url": { "raw": "https://account.box.com/api/oauth2/authorize?response_type=code&client_id=&redirect_uri=&state=&scope=", "protocol": "https", "host": [ "account", "box", "com" ], "path": [ "api", "oauth2", "authorize" ], "query": [ { "description": "(Required) The type of response we'd like to receive.", "key": "response_type", "value": "code" }, { "description": "(Required) The Client ID of the application that is requesting to authenticate\nthe user. To get the Client ID for your application, log in to your\nBox developer console and click the **Edit Application** link for\nthe application you're working with. In the OAuth 2.0 Parameters section\nof the configuration page, find the item labelled `client_id`. The\ntext of that item is your application's Client ID.", "key": "client_id", "value": "" }, { "description": "The URI to which Box redirects the browser after the user has granted\nor denied the application permission. This URI match one of the redirect\nURIs in the configuration of your application. It must be a\nvalid HTTPS URI and it needs to be able to handle the redirection to\ncomplete the next step in the OAuth 2.0 flow.\nAlthough this parameter is optional, it must be a part of the\nauthorization URL if you configured multiple redirect URIs\nfor the application in the developer console. A missing parameter causes\na `redirect_uri_missing` error after the user grants application access.", "key": "redirect_uri", "value": "" }, { "description": "A custom string of your choice. Box will pass the same string to\nthe redirect URL when authentication is complete. This parameter\ncan be used to identify a user on redirect, as well as protect\nagainst hijacked sessions and other exploits.", "key": "state", "value": "" }, { "description": "A space-separated list of application scopes you'd like to\nauthenticate the user for. This defaults to all the scopes configured\nfor the application in its configuration page.", "key": "scope", "value": "" } ] } }, "status": "Internal Server Error", "code": 500, "_postman_previewlanguage": "text", "header": [ { "key": "Content-Type", "value": "text/html" } ], "cookie": [], "responseTime": null, "body": "", "createdAt": "2026-07-28T01:15:37.000Z", "updatedAt": "2026-07-28T01:15:37.000Z", "uid": "35240-9f843459-90ac-4ecd-99a0-99d659eee2ab" } ], "createdAt": "2026-07-28T01:15:37.000Z", "updatedAt": "2026-07-28T01:15:37.000Z", "uid": "35240-be30880d-0026-4f57-af10-14ddffba5f74" } ], "id": "717e4eed-f669-478a-93f3-3988adb2e4a0", "createdAt": "2026-07-28T01:15:37.000Z", "updatedAt": "2026-07-28T01:15:37.000Z", "uid": "35240-717e4eed-f669-478a-93f3-3988adb2e4a0" }, { "name": "oauth2", "item": [ { "name": "token", "item": [ { "name": "Box Request access token", "id": "f2d80a5b-493e-4b91-93bc-3e5705bdda2a", "protocolProfileBehavior": { "disableBodyPruning": true }, "request": { "method": "POST", "header": [ { "key": "Content-Type", "value": "application/x-www-form-urlencoded" }, { "key": "Accept", "value": "application/json" } ], "body": { "mode": "urlencoded", "urlencoded": [ { "description": "(Required) The type of request being made, either using a client-side obtained\nauthorization code, a refresh token, a JWT assertion, client credentials\ngrant or another access token for the purpose of downscoping a token.", "key": "grant_type", "value": "authorization_code" }, { "description": "The Client ID of the application requesting an access token.\n\nUsed in combination with `authorization_code`, `client_credentials`, or\n`urn:ietf:params:oauth:grant-type:jwt-bearer` as the `grant_type`.", "key": "client_id", "value": "" }, { "description": "The client secret of the application requesting an access token.\n\nUsed in combination with `authorization_code`, `client_credentials`, or\n`urn:ietf:params:oauth:grant-type:jwt-bearer` as the `grant_type`.", "key": "client_secret", "value": "" }, { "description": "The client-side authorization code passed to your application by\nBox in the browser redirect after the user has successfully\ngranted your application permission to make API calls on their\nbehalf.\n\nUsed in combination with `authorization_code` as the `grant_type`.", "key": "code", "value": "" }, { "description": "A refresh token used to get a new access token with.\n\nUsed in combination with `refresh_token` as the `grant_type`.", "key": "refresh_token", "value": "" }, { "description": "A JWT assertion for which to request a new access token.\n\nUsed in combination with `urn:ietf:params:oauth:grant-type:jwt-bearer`\nas the `grant_type`.", "key": "assertion", "value": "" }, { "description": "The token to exchange for a downscoped token. This can be a regular\naccess token, a JWT assertion, or an app token.\n\nUsed in combination with `urn:ietf:params:oauth:grant-type:token-exchange`\nas the `grant_type`.", "key": "subject_token", "value": "" }, { "description": "The type of `subject_token` passed in.\n\nUsed in combination with `urn:ietf:params:oauth:grant-type:token-exchange`\nas the `grant_type`.", "key": "subject_token_type", "value": "urn:ietf:params:oauth:token-type:access_token" }, { "description": "The token used to create an annotator token.\nThis is a JWT assertion.\n\nUsed in combination with `urn:ietf:params:oauth:grant-type:token-exchange`\nas the `grant_type`.", "key": "actor_token", "value": "" }, { "description": "The type of `actor_token` passed in.\n\nUsed in combination with `urn:ietf:params:oauth:grant-type:token-exchange`\nas the `grant_type`.", "key": "actor_token_type", "value": "urn:ietf:params:oauth:token-type:id_token" }, { "description": "The space-delimited list of scopes that you want apply to the\nnew access token.\n\nThe `subject_token` will need to have all of these scopes or\nthe call will error with **401 Unauthorized**.", "key": "scope", "value": "" }, { "description": "Full URL for the file that the token should be generated for.", "key": "resource", "value": "" }, { "description": "Used in combination with `client_credentials` as the `grant_type`.", "key": "box_subject_type", "value": "enterprise" }, { "description": "Used in combination with `client_credentials` as the `grant_type`.\nValue is determined by `box_subject_type`. If `user` use user ID and if\n`enterprise` use enterprise ID.", "key": "box_subject_id", "value": "" }, { "description": "Full URL of the shared link on the file or folder\nthat the token should be generated for.", "key": "box_shared_link", "value": "" } ] }, "url": { "raw": "https://api.box.com/oauth2/token", "protocol": "https", "host": [ "api", "box", "com" ], "path": [ "oauth2", "token" ] }, "description": "Request an Access Token using either a client-side obtained OAuth 2.0\nauthorization code or a server-side JWT assertion.\n\nAn Access Token is a string that enables Box to verify that a\nrequest belongs to an authorized session. In the normal order of\noperations you will begin by requesting authentication from the\n[authorize](#get-authorize) endpoint and Box will send you an\nauthorization code.\n\nYou will then send this code to this endpoint to exchange it for\nan Access Token. The returned Access Token can then be used to to make\nBox API calls." }, "response": [ { "id": "c740d6e7-5445-4348-9389-31f941ec0ab4", "name": "Returns a new Access Token that can be used to make authenticated\nAPI calls by passing along the token in a authorization header as\nfollows `Authorization: Bearer `.", "originalRequest": { "method": "POST", "header": [ { "key": "Content-Type", "value": "application/x-www-form-urlencoded" }, { "key": "Accept", "value": "application/json" } ], "body": { "mode": "urlencoded", "urlencoded": [ { "description": "(Required) The type of request being made, either using a client-side obtained\nauthorization code, a refresh token, a JWT assertion, client credentials\ngrant or another access token for the purpose of downscoping a token.", "key": "grant_type", "value": "authorization_code" }, { "description": "The Client ID of the application requesting an access token.\n\nUsed in combination with `authorization_code`, `client_credentials`, or\n`urn:ietf:params:oauth:grant-type:jwt-bearer` as the `grant_type`.", "key": "client_id", "value": "" }, { "description": "The client secret of the application requesting an access token.\n\nUsed in combination with `authorization_code`, `client_credentials`, or\n`urn:ietf:params:oauth:grant-type:jwt-bearer` as the `grant_type`.", "key": "client_secret", "value": "" }, { "description": "The client-side authorization code passed to your application by\nBox in the browser redirect after the user has successfully\ngranted your application permission to make API calls on their\nbehalf.\n\nUsed in combination with `authorization_code` as the `grant_type`.", "key": "code", "value": "" }, { "description": "A refresh token used to get a new access token with.\n\nUsed in combination with `refresh_token` as the `grant_type`.", "key": "refresh_token", "value": "" }, { "description": "A JWT assertion for which to request a new access token.\n\nUsed in combination with `urn:ietf:params:oauth:grant-type:jwt-bearer`\nas the `grant_type`.", "key": "assertion", "value": "" }, { "description": "The token to exchange for a downscoped token. This can be a regular\naccess token, a JWT assertion, or an app token.\n\nUsed in combination with `urn:ietf:params:oauth:grant-type:token-exchange`\nas the `grant_type`.", "key": "subject_token", "value": "" }, { "description": "The type of `subject_token` passed in.\n\nUsed in combination with `urn:ietf:params:oauth:grant-type:token-exchange`\nas the `grant_type`.", "key": "subject_token_type", "value": "urn:ietf:params:oauth:token-type:access_token" }, { "description": "The token used to create an annotator token.\nThis is a JWT assertion.\n\nUsed in combination with `urn:ietf:params:oauth:grant-type:token-exchange`\nas the `grant_type`.", "key": "actor_token", "value": "" }, { "description": "The type of `actor_token` passed in.\n\nUsed in combination with `urn:ietf:params:oauth:grant-type:token-exchange`\nas the `grant_type`.", "key": "actor_token_type", "value": "urn:ietf:params:oauth:token-type:id_token" }, { "description": "The space-delimited list of scopes that you want apply to the\nnew access token.\n\nThe `subject_token` will need to have all of these scopes or\nthe call will error with **401 Unauthorized**.", "key": "scope", "value": "" }, { "description": "Full URL for the file that the token should be generated for.", "key": "resource", "value": "" }, { "description": "Used in combination with `client_credentials` as the `grant_type`.", "key": "box_subject_type", "value": "enterprise" }, { "description": "Used in combination with `client_credentials` as the `grant_type`.\nValue is determined by `box_subject_type`. If `user` use user ID and if\n`enterprise` use enterprise ID.", "key": "box_subject_id", "value": "" }, { "description": "Full URL of the shared link on the file or folder\nthat the token should be generated for.", "key": "box_shared_link", "value": "" } ] }, "url": { "raw": "https://api.box.com/oauth2/token", "protocol": "https", "host": [ "api", "box", "com" ], "path": [ "oauth2", "token" ] } }, "status": "OK", "code": 200, "_postman_previewlanguage": "json", "header": [ { "key": "Content-Type", "value": "application/json" } ], "cookie": [], "responseTime": null, "body": "{\n \"access_token\": \"\",\n \"expires_in\": \"\",\n \"token_type\": \"bearer\",\n \"restricted_to\": [\n {\n \"scope\": \"annotation_edit\",\n \"object\": {\n \"id\": \"\",\n \"type\": \"folder\",\n \"etag\": \"\",\n \"sequence_id\": \"\",\n \"name\": \"\"\n }\n },\n {\n \"scope\": \"item_preview\",\n \"object\": {\n \"id\": \"\",\n \"type\": \"folder\",\n \"etag\": \"\",\n \"sequence_id\": \"\",\n \"name\": \"\"\n }\n }\n ],\n \"refresh_token\": \"\",\n \"issued_token_type\": \"urn:ietf:params:oauth:token-type:access_token\"\n}", "createdAt": "2026-07-28T01:15:37.000Z", "updatedAt": "2026-07-28T01:15:37.000Z", "uid": "35240-c740d6e7-5445-4348-9389-31f941ec0ab4" }, { "id": "41c9620a-d6c2-496e-b189-88618c37cf96", "name": "An authentication error.", "originalRequest": { "method": "POST", "header": [ { "key": "Content-Type", "value": "application/x-www-form-urlencoded" }, { "key": "Accept", "value": "application/json" } ], "body": { "mode": "urlencoded", "urlencoded": [ { "description": "(Required) The type of request being made, either using a client-side obtained\nauthorization code, a refresh token, a JWT assertion, client credentials\ngrant or another access token for the purpose of downscoping a token.", "key": "grant_type", "value": "authorization_code" }, { "description": "The Client ID of the application requesting an access token.\n\nUsed in combination with `authorization_code`, `client_credentials`, or\n`urn:ietf:params:oauth:grant-type:jwt-bearer` as the `grant_type`.", "key": "client_id", "value": "" }, { "description": "The client secret of the application requesting an access token.\n\nUsed in combination with `authorization_code`, `client_credentials`, or\n`urn:ietf:params:oauth:grant-type:jwt-bearer` as the `grant_type`.", "key": "client_secret", "value": "" }, { "description": "The client-side authorization code passed to your application by\nBox in the browser redirect after the user has successfully\ngranted your application permission to make API calls on their\nbehalf.\n\nUsed in combination with `authorization_code` as the `grant_type`.", "key": "code", "value": "" }, { "description": "A refresh token used to get a new access token with.\n\nUsed in combination with `refresh_token` as the `grant_type`.", "key": "refresh_token", "value": "" }, { "description": "A JWT assertion for which to request a new access token.\n\nUsed in combination with `urn:ietf:params:oauth:grant-type:jwt-bearer`\nas the `grant_type`.", "key": "assertion", "value": "" }, { "description": "The token to exchange for a downscoped token. This can be a regular\naccess token, a JWT assertion, or an app token.\n\nUsed in combination with `urn:ietf:params:oauth:grant-type:token-exchange`\nas the `grant_type`.", "key": "subject_token", "value": "" }, { "description": "The type of `subject_token` passed in.\n\nUsed in combination with `urn:ietf:params:oauth:grant-type:token-exchange`\nas the `grant_type`.", "key": "subject_token_type", "value": "urn:ietf:params:oauth:token-type:access_token" }, { "description": "The token used to create an annotator token.\nThis is a JWT assertion.\n\nUsed in combination with `urn:ietf:params:oauth:grant-type:token-exchange`\nas the `grant_type`.", "key": "actor_token", "value": "" }, { "description": "The type of `actor_token` passed in.\n\nUsed in combination with `urn:ietf:params:oauth:grant-type:token-exchange`\nas the `grant_type`.", "key": "actor_token_type", "value": "urn:ietf:params:oauth:token-type:id_token" }, { "description": "The space-delimited list of scopes that you want apply to the\nnew access token.\n\nThe `subject_token` will need to have all of these scopes or\nthe call will error with **401 Unauthorized**.", "key": "scope", "value": "" }, { "description": "Full URL for the file that the token should be generated for.", "key": "resource", "value": "" }, { "description": "Used in combination with `client_credentials` as the `grant_type`.", "key": "box_subject_type", "value": "enterprise" }, { "description": "Used in combination with `client_credentials` as the `grant_type`.\nValue is determined by `box_subject_type`. If `user` use user ID and if\n`enterprise` use enterprise ID.", "key": "box_subject_id", "value": "" }, { "description": "Full URL of the shared link on the file or folder\nthat the token should be generated for.", "key": "box_shared_link", "value": "" } ] }, "url": { "raw": "https://api.box.com/oauth2/token", "protocol": "https", "host": [ "api", "box", "com" ], "path": [ "oauth2", "token" ] } }, "status": "Bad Request", "code": 400, "_postman_previewlanguage": "json", "header": [ { "key": "Content-Type", "value": "application/json" } ], "cookie": [], "responseTime": null, "body": "{\n \"error\": \"\",\n \"error_description\": \"\"\n}", "createdAt": "2026-07-28T01:15:37.000Z", "updatedAt": "2026-07-28T01:15:37.000Z", "uid": "35240-41c9620a-d6c2-496e-b189-88618c37cf96" }, { "id": "d8d68635-e00d-4d84-ba3a-ba09c12d1287", "name": "An authentication error.", "originalRequest": { "method": "POST", "header": [ { "key": "Content-Type", "value": "application/x-www-form-urlencoded" }, { "key": "Accept", "value": "application/json" } ], "body": { "mode": "urlencoded", "urlencoded": [ { "description": "(Required) The type of request being made, either using a client-side obtained\nauthorization code, a refresh token, a JWT assertion, client credentials\ngrant or another access token for the purpose of downscoping a token.", "key": "grant_type", "value": "authorization_code" }, { "description": "The Client ID of the application requesting an access token.\n\nUsed in combination with `authorization_code`, `client_credentials`, or\n`urn:ietf:params:oauth:grant-type:jwt-bearer` as the `grant_type`.", "key": "client_id", "value": "" }, { "description": "The client secret of the application requesting an access token.\n\nUsed in combination with `authorization_code`, `client_credentials`, or\n`urn:ietf:params:oauth:grant-type:jwt-bearer` as the `grant_type`.", "key": "client_secret", "value": "" }, { "description": "The client-side authorization code passed to your application by\nBox in the browser redirect after the user has successfully\ngranted your application permission to make API calls on their\nbehalf.\n\nUsed in combination with `authorization_code` as the `grant_type`.", "key": "code", "value": "" }, { "description": "A refresh token used to get a new access token with.\n\nUsed in combination with `refresh_token` as the `grant_type`.", "key": "refresh_token", "value": "" }, { "description": "A JWT assertion for which to request a new access token.\n\nUsed in combination with `urn:ietf:params:oauth:grant-type:jwt-bearer`\nas the `grant_type`.", "key": "assertion", "value": "" }, { "description": "The token to exchange for a downscoped token. This can be a regular\naccess token, a JWT assertion, or an app token.\n\nUsed in combination with `urn:ietf:params:oauth:grant-type:token-exchange`\nas the `grant_type`.", "key": "subject_token", "value": "" }, { "description": "The type of `subject_token` passed in.\n\nUsed in combination with `urn:ietf:params:oauth:grant-type:token-exchange`\nas the `grant_type`.", "key": "subject_token_type", "value": "urn:ietf:params:oauth:token-type:access_token" }, { "description": "The token used to create an annotator token.\nThis is a JWT assertion.\n\nUsed in combination with `urn:ietf:params:oauth:grant-type:token-exchange`\nas the `grant_type`.", "key": "actor_token", "value": "" }, { "description": "The type of `actor_token` passed in.\n\nUsed in combination with `urn:ietf:params:oauth:grant-type:token-exchange`\nas the `grant_type`.", "key": "actor_token_type", "value": "urn:ietf:params:oauth:token-type:id_token" }, { "description": "The space-delimited list of scopes that you want apply to the\nnew access token.\n\nThe `subject_token` will need to have all of these scopes or\nthe call will error with **401 Unauthorized**.", "key": "scope", "value": "" }, { "description": "Full URL for the file that the token should be generated for.", "key": "resource", "value": "" }, { "description": "Used in combination with `client_credentials` as the `grant_type`.", "key": "box_subject_type", "value": "enterprise" }, { "description": "Used in combination with `client_credentials` as the `grant_type`.\nValue is determined by `box_subject_type`. If `user` use user ID and if\n`enterprise` use enterprise ID.", "key": "box_subject_id", "value": "" }, { "description": "Full URL of the shared link on the file or folder\nthat the token should be generated for.", "key": "box_shared_link", "value": "" } ] }, "url": { "raw": "https://api.box.com/oauth2/token", "protocol": "https", "host": [ "api", "box", "com" ], "path": [ "oauth2", "token" ] } }, "status": "Internal Server Error", "code": 500, "_postman_previewlanguage": "json", "header": [ { "key": "Content-Type", "value": "application/json" } ], "cookie": [], "responseTime": null, "body": "{\n \"error\": \"\",\n \"error_description\": \"\"\n}", "createdAt": "2026-07-28T01:15:37.000Z", "updatedAt": "2026-07-28T01:15:37.000Z", "uid": "35240-d8d68635-e00d-4d84-ba3a-ba09c12d1287" } ], "createdAt": "2026-07-28T01:15:37.000Z", "updatedAt": "2026-07-28T01:15:37.000Z", "uid": "35240-f2d80a5b-493e-4b91-93bc-3e5705bdda2a" } ], "id": "946d0cc1-060b-4d60-bfea-4b2120e5201c", "createdAt": "2026-07-28T01:15:37.000Z", "updatedAt": "2026-07-28T01:15:37.000Z", "uid": "35240-946d0cc1-060b-4d60-bfea-4b2120e5201c" }, { "name": "token#refresh", "item": [ { "name": "Box Refresh access token", "id": "7ec422f8-0de7-48f8-9652-f212f2fb95f0", "protocolProfileBehavior": { "disableBodyPruning": true }, "request": { "method": "POST", "header": [ { "key": "Content-Type", "value": "application/x-www-form-urlencoded" }, { "key": "Accept", "value": "application/json" } ], "body": { "mode": "urlencoded", "urlencoded": [ { "description": "(Required) The type of request being made, in this case a refresh request.", "key": "grant_type", "value": "refresh_token" }, { "description": "(Required) The client ID of the application requesting to refresh the token.", "key": "client_id", "value": "" }, { "description": "(Required) The client secret of the application requesting to refresh the token.", "key": "client_secret", "value": "" }, { "description": "(Required) The refresh token to refresh.", "key": "refresh_token", "value": "" } ] }, "url": { "raw": "https://api.box.com/oauth2/token#refresh", "protocol": "https", "host": [ "api", "box", "com" ], "path": [ "oauth2", "token" ], "hash": "refresh" }, "description": "Refresh an Access Token using its client ID, secret, and refresh token." }, "response": [ { "id": "4b76db3c-8ae9-4354-91d4-5bb4060b91c6", "name": "Returns a new Access Token that can be used to make authenticated\nAPI calls by passing along the token in a authorization header as\nfollows `Authorization: Bearer `.", "originalRequest": { "method": "POST", "header": [ { "key": "Content-Type", "value": "application/x-www-form-urlencoded" }, { "key": "Accept", "value": "application/json" } ], "body": { "mode": "urlencoded", "urlencoded": [ { "description": "(Required) The type of request being made, in this case a refresh request.", "key": "grant_type", "value": "refresh_token" }, { "description": "(Required) The client ID of the application requesting to refresh the token.", "key": "client_id", "value": "" }, { "description": "(Required) The client secret of the application requesting to refresh the token.", "key": "client_secret", "value": "" }, { "description": "(Required) The refresh token to refresh.", "key": "refresh_token", "value": "" } ] }, "url": { "raw": "https://api.box.com/oauth2/token#refresh", "protocol": "https", "host": [ "api", "box", "com" ], "path": [ "oauth2", "token" ], "hash": "refresh" } }, "status": "OK", "code": 200, "_postman_previewlanguage": "json", "header": [ { "key": "Content-Type", "value": "application/json" } ], "cookie": [], "responseTime": null, "body": "{\n \"access_token\": \"\",\n \"expires_in\": \"\",\n \"token_type\": \"bearer\",\n \"restricted_to\": [\n {\n \"scope\": \"annotation_edit\",\n \"object\": {\n \"id\": \"\",\n \"type\": \"folder\",\n \"etag\": \"\",\n \"sequence_id\": \"\",\n \"name\": \"\"\n }\n },\n {\n \"scope\": \"item_preview\",\n \"object\": {\n \"id\": \"\",\n \"type\": \"folder\",\n \"etag\": \"\",\n \"sequence_id\": \"\",\n \"name\": \"\"\n }\n }\n ],\n \"refresh_token\": \"\",\n \"issued_token_type\": \"urn:ietf:params:oauth:token-type:access_token\"\n}", "createdAt": "2026-07-28T01:15:37.000Z", "updatedAt": "2026-07-28T01:15:37.000Z", "uid": "35240-4b76db3c-8ae9-4354-91d4-5bb4060b91c6" }, { "id": "0537fbe3-69d8-4741-8b57-fc2bc4ecd896", "name": "An authentication error.", "originalRequest": { "method": "POST", "header": [ { "key": "Content-Type", "value": "application/x-www-form-urlencoded" }, { "key": "Accept", "value": "application/json" } ], "body": { "mode": "urlencoded", "urlencoded": [ { "description": "(Required) The type of request being made, in this case a refresh request.", "key": "grant_type", "value": "refresh_token" }, { "description": "(Required) The client ID of the application requesting to refresh the token.", "key": "client_id", "value": "" }, { "description": "(Required) The client secret of the application requesting to refresh the token.", "key": "client_secret", "value": "" }, { "description": "(Required) The refresh token to refresh.", "key": "refresh_token", "value": "" } ] }, "url": { "raw": "https://api.box.com/oauth2/token#refresh", "protocol": "https", "host": [ "api", "box", "com" ], "path": [ "oauth2", "token" ], "hash": "refresh" } }, "status": "Bad Request", "code": 400, "_postman_previewlanguage": "json", "header": [ { "key": "Content-Type", "value": "application/json" } ], "cookie": [], "responseTime": null, "body": "{\n \"error\": \"\",\n \"error_description\": \"\"\n}", "createdAt": "2026-07-28T01:15:37.000Z", "updatedAt": "2026-07-28T01:15:37.000Z", "uid": "35240-0537fbe3-69d8-4741-8b57-fc2bc4ecd896" }, { "id": "51636c88-4a6f-41c5-9921-b2cb3046d2a8", "name": "An authentication error.", "originalRequest": { "method": "POST", "header": [ { "key": "Content-Type", "value": "application/x-www-form-urlencoded" }, { "key": "Accept", "value": "application/json" } ], "body": { "mode": "urlencoded", "urlencoded": [ { "description": "(Required) The type of request being made, in this case a refresh request.", "key": "grant_type", "value": "refresh_token" }, { "description": "(Required) The client ID of the application requesting to refresh the token.", "key": "client_id", "value": "" }, { "description": "(Required) The client secret of the application requesting to refresh the token.", "key": "client_secret", "value": "" }, { "description": "(Required) The refresh token to refresh.", "key": "refresh_token", "value": "" } ] }, "url": { "raw": "https://api.box.com/oauth2/token#refresh", "protocol": "https", "host": [ "api", "box", "com" ], "path": [ "oauth2", "token" ], "hash": "refresh" } }, "status": "Internal Server Error", "code": 500, "_postman_previewlanguage": "json", "header": [ { "key": "Content-Type", "value": "application/json" } ], "cookie": [], "responseTime": null, "body": "{\n \"error\": \"\",\n \"error_description\": \"\"\n}", "createdAt": "2026-07-28T01:15:37.000Z", "updatedAt": "2026-07-28T01:15:37.000Z", "uid": "35240-51636c88-4a6f-41c5-9921-b2cb3046d2a8" } ], "createdAt": "2026-07-28T01:15:37.000Z", "updatedAt": "2026-07-28T01:15:37.000Z", "uid": "35240-7ec422f8-0de7-48f8-9652-f212f2fb95f0" } ], "id": "7d6b1a02-7c3f-404e-9784-f0757f0ce400", "createdAt": "2026-07-28T01:15:37.000Z", "updatedAt": "2026-07-28T01:15:37.000Z", "uid": "35240-7d6b1a02-7c3f-404e-9784-f0757f0ce400" }, { "name": "revoke", "item": [ { "name": "Box Revoke access token", "id": "e5c083a3-e69a-46bd-a249-6e17712e213d", "protocolProfileBehavior": { "disableBodyPruning": true }, "request": { "method": "POST", "header": [ { "key": "Content-Type", "value": "application/x-www-form-urlencoded" }, { "key": "Accept", "value": "application/json" } ], "body": { "mode": "urlencoded", "urlencoded": [ { "description": "The Client ID of the application requesting to revoke the\naccess token.", "key": "client_id", "value": "" }, { "description": "The client secret of the application requesting to revoke\nan access token.", "key": "client_secret", "value": "" }, { "description": "The access token to revoke.", "key": "token", "value": "" } ] }, "url": { "raw": "https://api.box.com/oauth2/revoke", "protocol": "https", "host": [ "api", "box", "com" ], "path": [ "oauth2", "revoke" ] }, "description": "Revoke an active Access Token, effectively logging a user out\nthat has been previously authenticated." }, "response": [ { "id": "587b9d5b-8cff-448d-815b-513467809fdc", "name": "Returns an empty response when the token was successfully revoked.", "originalRequest": { "method": "POST", "header": [ { "key": "Content-Type", "value": "application/x-www-form-urlencoded" } ], "body": { "mode": "urlencoded", "urlencoded": [ { "description": "The Client ID of the application requesting to revoke the\naccess token.", "key": "client_id", "value": "" }, { "description": "The client secret of the application requesting to revoke\nan access token.", "key": "client_secret", "value": "" }, { "description": "The access token to revoke.", "key": "token", "value": "" } ] }, "url": { "raw": "https://api.box.com/oauth2/revoke", "protocol": "https", "host": [ "api", "box", "com" ], "path": [ "oauth2", "revoke" ] } }, "status": "OK", "code": 200, "_postman_previewlanguage": "text", "header": [], "cookie": [], "responseTime": null, "body": null, "createdAt": "2026-07-28T01:15:37.000Z", "updatedAt": "2026-07-28T01:15:37.000Z", "uid": "35240-587b9d5b-8cff-448d-815b-513467809fdc" }, { "id": "9a4c40ba-549e-427c-8469-4bd821508ab1", "name": "An authentication error.", "originalRequest": { "method": "POST", "header": [ { "key": "Content-Type", "value": "application/x-www-form-urlencoded" }, { "key": "Accept", "value": "application/json" } ], "body": { "mode": "urlencoded", "urlencoded": [ { "description": "The Client ID of the application requesting to revoke the\naccess token.", "key": "client_id", "value": "" }, { "description": "The client secret of the application requesting to revoke\nan access token.", "key": "client_secret", "value": "" }, { "description": "The access token to revoke.", "key": "token", "value": "" } ] }, "url": { "raw": "https://api.box.com/oauth2/revoke", "protocol": "https", "host": [ "api", "box", "com" ], "path": [ "oauth2", "revoke" ] } }, "status": "Bad Request", "code": 400, "_postman_previewlanguage": "json", "header": [ { "key": "Content-Type", "value": "application/json" } ], "cookie": [], "responseTime": null, "body": "{\n \"error\": \"\",\n \"error_description\": \"\"\n}", "createdAt": "2026-07-28T01:15:37.000Z", "updatedAt": "2026-07-28T01:15:37.000Z", "uid": "35240-9a4c40ba-549e-427c-8469-4bd821508ab1" }, { "id": "2c628e4c-d30e-4de1-9453-19a6ee6f1f12", "name": "An authentication error.", "originalRequest": { "method": "POST", "header": [ { "key": "Content-Type", "value": "application/x-www-form-urlencoded" }, { "key": "Accept", "value": "application/json" } ], "body": { "mode": "urlencoded", "urlencoded": [ { "description": "The Client ID of the application requesting to revoke the\naccess token.", "key": "client_id", "value": "" }, { "description": "The client secret of the application requesting to revoke\nan access token.", "key": "client_secret", "value": "" }, { "description": "The access token to revoke.", "key": "token", "value": "" } ] }, "url": { "raw": "https://api.box.com/oauth2/revoke", "protocol": "https", "host": [ "api", "box", "com" ], "path": [ "oauth2", "revoke" ] } }, "status": "Internal Server Error", "code": 500, "_postman_previewlanguage": "json", "header": [ { "key": "Content-Type", "value": "application/json" } ], "cookie": [], "responseTime": null, "body": "{\n \"error\": \"\",\n \"error_description\": \"\"\n}", "createdAt": "2026-07-28T01:15:37.000Z", "updatedAt": "2026-07-28T01:15:37.000Z", "uid": "35240-2c628e4c-d30e-4de1-9453-19a6ee6f1f12" } ], "createdAt": "2026-07-28T01:15:37.000Z", "updatedAt": "2026-07-28T01:15:37.000Z", "uid": "35240-e5c083a3-e69a-46bd-a249-6e17712e213d" } ], "id": "9f98b8f8-a687-4edd-9f6c-e2c7b011fc7f", "createdAt": "2026-07-28T01:15:37.000Z", "updatedAt": "2026-07-28T01:15:37.000Z", "uid": "35240-9f98b8f8-a687-4edd-9f6c-e2c7b011fc7f" } ], "id": "c08a57d1-fc3e-4033-b072-46fe4cfab4a4", "createdAt": "2026-07-28T01:15:37.000Z", "updatedAt": "2026-07-28T01:15:37.000Z", "uid": "35240-c08a57d1-fc3e-4033-b072-46fe4cfab4a4" } ], "variable": [ { "key": "baseUrl", "value": "/" } ] }