Downloading publicly shared files from a different account: error 404

Hi,

I'm trying to programmatically download a file shared by a different Box account. The file is shared publicly, I can download it from a browser without entering any credentials or logging in.

But when I try the same via API by calling sharedItems.get, I'm getting shared_link=null. If I call getDownloadURL or getReadStream by file id, I get a 404 error. Tried via Node SDK and Postman, same result.

My guess: it's something wrong with permissions. I've tried using a developer token, also tried enterprise auth via a Box SDK config file, which includes clientID, clientSecret, private key and enterpriseID — same result. My app in Box developer console has all possible permissions (as far as I can tell).

Result of sharedItems.get:

{
  type: 'file',
  id: (...),
  file_version: (...),
  sequence_id: (...),
  etag: (...),
  sha1: (...),
  name: (...),
  description: '',
  size: (...),
  path_collection: { total_count: 0, entries: [] },
  created_at: (...),
  modified_at: (...),
  trashed_at: null,
  purged_at: null,
  content_created_at: (...),
  content_modified_at: (...),
  created_by: (...),
  modified_by: (...),
  owned_by: (...),
  shared_link: null,
  parent: null,
  item_status: 'active'
}

(note that it returns id, but no shared_link)

Result of files.getDownloadURL:
Error: Unexpected API Response [404 Not Found | (...)] not_found - Could not find the specified resource

Result of files.getReadStream:
Error: Unexpected API Response [404 Not Found | (...)] not_found - Could not find the specified resource

To recap: I'm getting the file ID from sharedItems.get, but cannot download it by id after that. shared_link field is null.

I'm close to just giving up on Box API altogether and making a bot that runs headless Chrome to download this file using a browser. Appreciate any help.

Thank you.

cbetta

August 26, 2020 11:44

Hi there.

Any of our APIs support the boxapi header that allows you to specify the shared link that you want to use to access the file. Without this info, the API will return a 404 as you don't have access to the file explicitly.

An example of this header is as follows:

boxapi: shared_link=[link]&shared_link_password=[password]

In Node, you can pass any headers to the options object.

client.files.getReadStream('12345', { headers: { boxapi: "....." }}).then(...)

homekilo

September 11, 2020 18:54

Thanks for your help.

I was not able to make getReadStream work with BoxApi header in Node SDK ("headers" seem to be added as a GET param to the http request instead of being sent as actual headers).

However, I was able to make it work via a custom GET request:

const url = await client.get('https://api.box.com/2.0/files/' + file.id + '/content', {
headers: {
boxapi: 'shared_link=https://MY_LINK_HERE',
},
})

— and then download file from url.headers.location

Comments