Skip to main content

Documentation Index

Fetch the complete documentation index at: https://developer.box.com/llms.txt

Use this file to discover all available pages before exploring further.

It is possible for a JWT application to act on behalf of another user by leveraging the as-user header. 
curl https://api.box.com/2.0/folders/0 \
    -H "as-user: [USER_ID]" \
    -H "authorization: Bearer [ACCESS_TOKEN]"
In this situation the user ID is the Box identifier for a user. User IDs can found for any user via the GET /users endpoint, which is only available to admins, or by calling the GET /users/me endpoint with an authenticated user session.

​
Preconditions

The application must be configured to perform actions as users in the Developer Console.
Advanced Features
Additionally, the authenticated user needs to be a user with Admin permissions, meaning either an Admin or Co-Admin. See our guide on for more details.

​
as-user using SDKs

All of the support acting on behalf of a user using the as-user header. 
var userClient = client.WithAsUserHeader("[USER_ID]");
These methods return a new client instance with the as-user header applied, leaving the original client unmodified.

​
Limitations

  • You cannot use the user_id of a in the as-user header.
  • When impersonating a managed user, access is limited to content owned or controlled by the enterprise. Content owned by external users cannot be accessed through the as-user header.
  • The as-user header cannot specify the same user ID as the authenticated user. If the specified user ID matches the current user, the request fails with a 403 Forbidden error.