Get user who created shared link

Answered

New post

jcerise

August 06, 2019 11:50

Subject, basically. Is there a way to get the ID of the user who created a shared link for a resource? From a security posture, it would be extremely useful to see which users are creating shared links inside an enterprise. The API and my own investigations lead me to believe that this is not currently possible to retrieve. Did I miss something somewhere, or this not retrievable information?

Comments

4 comments

anoland

August 06, 2019 12:00
With the API, you have to run a loop through existing shared links on each file/folder. A faster way would be to use a non-programmatic option by generated a report for shared links (docs here).
0

Comment actions Permalink
jcerise

August 06, 2019 12:10
I noticed the reports contain the user, but unfortunately, I'm using the API.

Can you elaborate on how looping over the shared links would allow me to extract the user that created the link? The data I see on each shared link is:
```
{
  "url": "https://www.box.com/s/vspke7y05sb214wjokpk",
  "download_url": null,
  "vanity_url": null,
  "is_password_enabled": false,
  "unshared_at": null,
  "download_count": 0,
  "preview_count": 0,
  "access": "open",
  "permissions": {
    "can_download": true,
    "can_preview": true
  }
}
```
Is there some implied rule that only the owner of the resource can create a shared link on that resource? If so, then I could just get the owner of the resource as the creator of the shared link. But, as far as I've been able to ascertain, co-owner, editor, viewer/editor and viewer can all create links (according to the 'send view only links' perm listed here: https://community.box.com/t5/Collaborate-By-Inviting-Others/Understanding-Collaborator-Permission-Levels/ta-p/144). Having multiple collaborators on a resource makes it impossible to tell which user created the shared link, as the User ID is not included in the shared link data returned via API.

Am I missing something obvious here?
0

Comment actions Permalink
anoland

August 06, 2019 13:26
The "looping" I referred to is multi-part. By using events, you could look at up to a year's worth of events, including those listed as "ITEM_SHARED_CREATE". Moving forward, you could also set up logging from this event for scripted reporting/auditing.

The event will have a `created_by` field which refers to who "created"/triggered the event.
0

Comment actions Permalink
jcerise

August 06, 2019 13:55
That is a very workable solution. Thanks so much for the prompt replies !
0

Comment actions Permalink

Please sign in to leave a comment.