Get user who created shared link

回答済み

新規投稿

jcerise

2019年08月06日 11:50

Subject, basically. Is there a way to get the ID of the user who created a shared link for a resource? From a security posture, it would be extremely useful to see which users are creating shared links inside an enterprise. The API and my own investigations lead me to believe that this is not currently possible to retrieve. Did I miss something somewhere, or this not retrievable information?

4件のコメント

anoland

2019年08月06日 12:00
With the API, you have to run a loop through existing shared links on each file/folder. A faster way would be to use a non-programmatic option by generated a report for shared links (docs here).
0

コメントアクションパーマリンク
jcerise

2019年08月06日 12:10
I noticed the reports contain the user, but unfortunately, I'm using the API.

Can you elaborate on how looping over the shared links would allow me to extract the user that created the link? The data I see on each shared link is:
```
{
  "url": "https://www.box.com/s/vspke7y05sb214wjokpk",
  "download_url": null,
  "vanity_url": null,
  "is_password_enabled": false,
  "unshared_at": null,
  "download_count": 0,
  "preview_count": 0,
  "access": "open",
  "permissions": {
    "can_download": true,
    "can_preview": true
  }
}
```
Is there some implied rule that only the owner of the resource can create a shared link on that resource? If so, then I could just get the owner of the resource as the creator of the shared link. But, as far as I've been able to ascertain, co-owner, editor, viewer/editor and viewer can all create links (according to the 'send view only links' perm listed here: https://community.box.com/t5/Collaborate-By-Inviting-Others/Understanding-Collaborator-Permission-Levels/ta-p/144). Having multiple collaborators on a resource makes it impossible to tell which user created the shared link, as the User ID is not included in the shared link data returned via API.

Am I missing something obvious here?
0

コメントアクションパーマリンク
anoland

2019年08月06日 13:26
The "looping" I referred to is multi-part. By using events, you could look at up to a year's worth of events, including those listed as "ITEM_SHARED_CREATE". Moving forward, you could also set up logging from this event for scripted reporting/auditing.

The event will have a `created_by` field which refers to who "created"/triggered the event.
0

コメントアクションパーマリンク
jcerise

2019年08月06日 13:55
That is a very workable solution. Thanks so much for the prompt replies !
0

コメントアクションパーマリンク

サインインしてコメントを残してください。