Failed to create webhook for FOLDER.TRASHED trigger

Recently I am unable to create webhook for my own folder when I include the "FOLDER.TRASHED" trigger in the list. The same API call works and create a webhook if I remove the "FOLDER.TRASHED" from the trigger list. 

Below are my API calls:

Failed Call

curl -v -X POST https://api.box.com/2.0/webhooks -H 'Authorization: Bearer yYRCfyKcXXXXXXXXXXXnL0YZotzJHK2v' -d '{"target": {"id": "70662471613", "type": "folder"}, "address": "https://f4c62130.ngrok.io", "triggers": ["FILE.UPLOADED", "FILE.TRASHED", "FILE.RESTORED","FOLDER.COPIED", "FOLDER.TRASHED", "FOLDER.MOVED", "FOLDER.CREATED", "COLLABORATION.ACCEPTED", "COLLABORATION.REMOVED", "COLLABORATION.UPDATED"]}'
Note: Unnecessary use of -X or --request, POST is already inferred.
*   Trying 107.152.24.197...
* TCP_NODELAY set
* Connected to api.box.com (107.152.24.197) port 443 (#0)
* ALPN, offering h2
* ALPN, offering http/1.1
* Cipher selection: ALL:!EXPORT:!EXPORT40:!EXPORT56:!aNULL:!LOW:!RC4:@STRENGTH
* successfully set certificate verify locations:
*   CAfile: /etc/ssl/cert.pem
  CApath: none
* TLSv1.2 (OUT), TLS handshake, Client hello (1):
* TLSv1.2 (IN), TLS handshake, Server hello (2):
* TLSv1.2 (IN), TLS handshake, Certificate (11):
* TLSv1.2 (IN), TLS handshake, Server key exchange (12):
* TLSv1.2 (IN), TLS handshake, Server finished (14):
* TLSv1.2 (OUT), TLS handshake, Client key exchange (16):
* TLSv1.2 (OUT), TLS change cipher, Client hello (1):
* TLSv1.2 (OUT), TLS handshake, Finished (20):
* TLSv1.2 (IN), TLS change cipher, Client hello (1):
* TLSv1.2 (IN), TLS handshake, Finished (20):
* SSL connection using TLSv1.2 / ECDHE-RSA-AES256-GCM-SHA384
* ALPN, server accepted to use http/1.1
* Server certificate:
*  subject: C=US; ST=California; L=Redwood City; O=Box, Inc.; CN=*.box.com
*  start date: Feb  7 00:00:00 2018 GMT
*  expire date: Nov 28 12:00:00 2020 GMT
*  subjectAltName: host "api.box.com" matched cert's "*.box.com"
*  issuer: C=US; O=DigiCert Inc; OU=www.digicert.com; CN=GeoTrust RSA CA 2018
*  SSL certificate verify ok.
> POST /2.0/webhooks HTTP/1.1
> Host: api.box.com
> User-Agent: curl/7.54.0
> Accept: */*
> Authorization: Bearery YRCf yKcXXXXXXXXXXXnL0YZotzJHK2v
> Postman-Token: **removed for privacy**
> cache-control: no-cache
> Content-Length: 299
> Content-Type: application/x-www-form-urlencoded
>
* upload completely sent off: 299 out of 299 bytes
< HTTP/1.1 403 Forbidden
< Date: Wed, 20 Mar 2019 18:55:44 GMT
< Transfer-Encoding: chunked
< Connection: keep-alive
< Strict-Transport-Security: max-age=31536000
< WWW-Authenticate: Bearer realm="Service", error="insufficient_scope", error_description="The request requires higher privileges than provided by the access token."
< Vary: Accept-Encoding
< BOX-REQUEST-ID: 0l3ls2m6fk7i62p6vp6n0dpseke
< Age: 1
<
* Connection #0 to host api.box.com left intact

Success call:

curl -v -X POST https://api.box.com/2.0/webhooks -H 'Authorization: Bearer yYRCfyXXXXXXXX0YZotzJHK2v'  -d '{"target": {"id": "70662471613", "type": "folder"}, "address": "https://f4c62130.ngrok.io", "triggers": ["FILE.UPLOADED", "FILE.TRASHED", "FILE.RESTORED","FOLDER.COPIED", "FOLDER.MOVED", "FOLDER.CREATED", "COLLABORATION.ACCEPTED", "COLLABORATION.REMOVED", "COLLABORATION.UPDATED"]}'
Note: Unnecessary use of -X or --request, POST is already inferred.
*   Trying 107.152.24.197...
* TCP_NODELAY set
* Connected to api.box.com (107.152.24.197) port 443 (#0)
* ALPN, offering h2
* ALPN, offering http/1.1
* Cipher selection: ALL:!EXPORT:!EXPORT40:!EXPORT56:!aNULL:!LOW:!RC4:@STRENGTH
* successfully set certificate verify locations:
*   CAfile: /etc/ssl/cert.pem
  CApath: none
* TLSv1.2 (OUT), TLS handshake, Client hello (1):
* TLSv1.2 (IN), TLS handshake, Server hello (2):
* TLSv1.2 (IN), TLS handshake, Certificate (11):
* TLSv1.2 (IN), TLS handshake, Server key exchange (12):
* TLSv1.2 (IN), TLS handshake, Server finished (14):
* TLSv1.2 (OUT), TLS handshake, Client key exchange (16):
* TLSv1.2 (OUT), TLS change cipher, Client hello (1):
* TLSv1.2 (OUT), TLS handshake, Finished (20):
* TLSv1.2 (IN), TLS change cipher, Client hello (1):
* TLSv1.2 (IN), TLS handshake, Finished (20):
* SSL connection using TLSv1.2 / ECDHE-RSA-AES256-GCM-SHA384
* ALPN, server accepted to use http/1.1
* Server certificate:
*  subject: C=US; ST=California; L=Redwood City; O=Box, Inc.; CN=*.box.com
*  start date: Feb  7 00:00:00 2018 GMT
*  expire date: Nov 28 12:00:00 2020 GMT
*  subjectAltName: host "api.box.com" matched cert's "*.box.com"
*  issuer: C=US; O=DigiCert Inc; OU=www.digicert.com; CN=GeoTrust RSA CA 2018
*  SSL certificate verify ok.
> POST /2.0/webhooks HTTP/1.1
> Host: api.box.com
> User-Agent: curl/7.54.0
> Accept: */*
> Authorization: Bearer YRCfyKcXXXXXXXXXXXnL0YZotzJHK2v
> Postman-Token: **removed for privacy**
> cache-control: no-cache
> Content-Length: 281
> Content-Type: application/x-www-form-urlencoded
>
* upload completely sent off: 281 out of 281 bytes
< HTTP/1.1 201 Created
< Date: Wed, 20 Mar 2019 18:57:18 GMT
< Content-Type: application/json
< Transfer-Encoding: chunked
< Connection: keep-alive
< Strict-Transport-Security: max-age=31536000
< Cache-Control: no-cache, no-store
< Vary: Accept-Encoding
< BOX-REQUEST-ID: 0fbptbnohllii21vl2t17kerevp
< Age: 1
<
* Connection #0 to host api.box.com left intact
{"id":"152232716","type":"webhook","target":{"id":"70662471613","type":"folder"},"created_by":{"type":"user","id":"388601184","name":"QA 1","login":"***email address removed for privacy***"},"created_at":"2019-03-20T11:57:17-07:00","address":"https:\/\/f4c62130.ngrok.io","triggers":["FILE.TRASHED","FILE.RESTORED","FILE.UPLOADED","FOLDER.CREATED","FOLDER.MOVED","FOLDER.COPIED","COLLABORATION.ACCEPTED","COLLABORATION.REMOVED","COLLABORATION.UPDATED"]}

Only difference is "FOLDER.TRASHED"  is missing from trigger list. 

And this started happening very recently (dont have exact dates) the same code was working last month.

Anybody else seeing this? or know what is happening? 

Thanks,

Manish