nav[aria-label="Primary Navigation"] { padding: 0; & ul { list-style: none; width: 100%; display: flex; flex-direction: row; justify-content: start; align-items: start; gap: 30px; padding: 0; & li { margin: 0; } & ul li { list-style: none; } } }

Expired-token response from upload API: other error tag and no WWW-Authenticate header

Takashi Yamamoto

Hello,

I have two questions about the response from the /2/files/upload endpoint when an expired access token is used.

First, the top-level error field has the tag other, rather than expired_access_token. The expired_access_token value appears only as JSON-encoded text inside user_message.text, similar to the following:

{"error" => {".tag" => "other"},
 "error_summary" => "other/...",
 "user_message" => {"locale" => "en", 
    "text" => "{\"error\":{\".tag\":\"expired_access_token\"},\"error_summary\":\"expired_access_token/\"}"}}

x-dropbox-request-id: "fb4661de27c24ad982ab7d896a94d259"

Could you confirm whether this is the expected behavior for content-upload endpoints?

I was told that authentication errors for these endpoints may be surfaced through user_message rather than through a specific top-level error tag. Is this behavior documented anywhere? Also, since user_message appears intended primarily for display to users, is it considered a stable and supported field for programmatic error handling?

Second, the API response no longer includes the WWW-Authenticate header. Could you clarify when this change was introduced and whether the omission is intentional?

What is the recommended and reliable way to detect an expired access token when calling /2/files/upload? Should clients inspect user_message or error_summary for expired_access_token, or is there another structured field or header that should be used?

Thank you.

Find more posts tagged with

API

Comments

iNeil

Hi @Takashi Yamamoto,

Thanks for sharing these details.

I’ve raised this case with our Engineering team for further investigation. Once I have an update or any additional information to share, I’ll follow up with you here.

Thanks for your patience while we look into this.

iNeil

Hi @Takashi Yamamoto,

Thanks for your patience while our Engineering team investigated this case.

A fix has been applied to address the behavior you reported. When an expired access token is used, the API should now return the expected error structure and include the WWW-Authenticate header. Thank you for bringing this to our attention!

Takashi Yamamoto

Hi @iNeil ,

Thank you very much for investigating this and applying the fix.

I appreciate the Engineering team’s work in resolving both the error structure and the missing WWW-Authenticate header. I’ll verify the updated behavior on my side.

Thanks again for your help.

iNeil

Hi @Takashi Yamamoto,

Thanks for your patience while our Engineering team worked through this case. I’m glad to hear that the issue has been resolved and that you’ve verified the updated behavior!

If you need any further assistance, please don’t hesitate to let us know.