Error when adding team members to an initally created team folder via http endpoint

@1575475 Apologies for the lack of clarity here. For team folders in particular, you need to add members via groups; you can't add them individually. I'll ask the team to see if we can clarify this in the documentation and error response.

For example, you would set the "members" parameter like:

"members":[{"member":{".tag":"dropbox_id","dropbox_id":"GROUPIDHERE"}}]

You can get group IDs from /2/team/groups/list, etc.

All comments

@1575475 wrote:
... I get a strange error:
Error in call to API function "sharing/add_folder_member": Invalid authorization value in HTTP header "Authorization": "Basic <some base64 string>"
Expecting "Bearer <oauth2-access-token>"
I do provide an bearer oauth2 access token for app authentication (app ) and my user id (as admin) for the "Dropbox-API-Select-Admin" header parameter.
...

Hi @1575475,

As seems, you thought "Bearer" authentication got provided, but you have "Basic" authentication provided actually (something incompatible). Review your algorithm. There is a mistake (most probably typing inaccuracy).

@1575475 wrote:
...
curl -X POST https://api.dropboxapi.com/2/sharing/add_folder_member \
--header 'Authorization: Bearer <created access token using refresh token>' \
--header 'Dropbox-API-Select-Admin: dbid:<my team member id>' \
--header 'Content-Type: application/json' \
--data '{"shared_folder_id":"<team folder id>","members":[{"member":{".tag":"dropbox_id","dropbox_id":"dbid:<my user id>"},"access_level":{".tag":"editor"}}],"quiet":false,"custom_message":"Test"}'

and got "missing scope ..." and "required scope sharing/write"

This means, either you miss "sharing/write" for your application or you have limited scopes on application authorization or on access token receiving. Make sure you have "sharing/write" everywhere (miss even on one place and the scope gets inactive) or remove limiting of scopes on authorization and on token receiving (if applicable) - in such a case token scopes set will match exactly on what's selected, for the application, in application console. Take in mind too that a change in scopes is NOT retroactive - you have to re-authenticate so the change can take effect.

Good luck.

Hi @Здравко,

thank you for your response.

The app I use has all rights possible (just for development, will revoke unneeded ones later on).

But I still don't get the point why I'm getting a popup to authorize to DBX.

Screenshot 2022-09-20 153507.jpg

I do have provided a new Bearer Token to authenticate my app, so why do I have to authenticate myself as Admin, too? Is this normal?

REST calls should be performed pretty much in the background without user interaction.

Since the authentication as Admin (user) is always of type "Basic" (username:password encoded in Base64) the DBX API might get this wrong.

Any futher suggestions? Thank you in advance.

I'd rather post my code here, but doubt anybody can interpret ABAP (SAP programming language) 🙂

Best,

Jan

Sdrastwuj Sdrawko,

I used to learn Russian at school, just about 50 years ago, but almost forgot everything 🙂 At least I'm still able to "decipher" cyrillic letters.

Thank you for your response. I already answered yesterday but somehow this post has vanished.

Ok, let me pls start over:

The DBX app I created has all rights on the Dropbox, I'll revoke some of them after finishing development.

My biggest problem actually is that the following dialog pops up everytime I make a call using the "Dropbox-API-Select-Admin" header parameter.

(Translation: Please enter your user name and password)

This obviously is where I've to authorize myself as DBX/Team Admin. Unfortunately I wasn't able to find anything in the documentation that this particular authorization is needed at all, since I do provide a valid app "Bearer" token. So my question is: Is this the normal behavior?

This applies to all endpoints where I try to tamper with one of the team folders (like adding members).

IMHO this happens:

Authorization as a user is always done using "Basic" authorization method with "username:password" as Base64 string.

So, this might be the problem. But again, why above popup appears? IMHO this is wrong!

Any suggestions? Thank you & Doswidania 🙂

Jan

@1575475 wrote:
Sdrastwuj Sdrawko,
I used to learn Russian at school, just about 50 years ago, but almost forgot everything 🙂 At least I'm still able to "decipher" cyrillic letters.
...

😁 Здравей Йан,

I have no idea where you decide from that I'm Russian. If the only reason are Cyrillic letters, what alphabet is in use in US for instance? Is it American or English alphabet? The same in Australia, some parts of Canada, etc. By the way, Cyrillic is so much Russian as English alphabet is US (i.e. it's just used there 😉). Go to the nearest big library (if you like "offline" confirmation) and ask staff there to direct you to historical documents about Cyrillic or just search online. 🙂 Did you find out where Cyrillic originates from? In addition, why € banknotes include Cyrillic name? Is this in favor of Russian? 😁 Maybe not.

On the actual question, You didn't still provided how actually you make calls to API end points. Seems like the software, you are using, gets confuse somehow and it does definitely not include official supported Dropbox SDK. Whatever is this software, it brings up the message you posted above - there is no way API itself to do the same. Read more carefully your tools documentation, how such calls can be performed in particular context. Most probably you have skipped something required by the platform you are working on.

@1575475 wrote:
...
This obviously is where I've to authorize myself as DBX/Team Admin. Unfortunately I wasn't able to find anything in the documentation that this particular authorization is needed at all, since I do provide a valid app "Bearer" token. So my question is: Is this the normal behavior?
...

This is definitely not a normal behavior. You are looking on wrong documentation! As I mentioned before, take a look on you tools documentation.

@1575475 wrote:
...
Authorization as a user is always done using "Basic" authorization method with "username:password" as Base64 string.
So, this might be the problem. But again, why above popup appears? IMHO this is wrong!
...

This is definitely problem! Seems your environment changes it. Read your environment documentation (or ask supplier for support) why that happens.

About the "rights":

@1575475 wrote:
...
The DBX app I created has all rights on the Dropbox, I'll revoke some of them after finishing development.
...

Did you confirmed your scopes (rights) on authorization? Alternatively you can skip this part which means "accept everything". If you pointed something and particular scope is not there, this means the same scope becomes inactive.

Надявам се, че горното дава насоки. 😉

@1575475 To confirm, I concur with that Здравко has helpfully shared here. The sharing/add_folder_member endpoint requires that an access token is sent as a "Bearer" token in the "Authorization" header, but it looks like your app is prompting for and sending a username and password as "Basic" authorization instead, which is incorrect. I can't offer support for your software/platform itself, so you'll need to troubleshoot it to see why it is attempting "Basic" authorization instead of "Bearer" authorization.

Hi Sdrawko, hi Greg,

@Sdrawko:
If you read my post carefully, I never meant that you're Russian 🙂 I just learned the cyrillic alphabet as side effect when learning Russian at school.
And, I know that some baltic countries (and maybe others) also use the cyrillic alphabet. But even in such country you have a chance to communicate using Russian.
Anyway I've to sincerely apologize for the confusion.

Back to business:
I'm using HTTP endpoints only (using REST calls) so no "real" SDK will apply.
The programming language I use is called "ABAP Objects", which is SAP only.

Example:
Endpoint https://api.dropboxapi.com/2/sharing/add_folder_member

In order to add a user to that folder I have to use the "Dropbox-API-Select-Admin: <TEAM_MEMBER_ID>" header parameter as stated here:
https://www.dropbox.com/developers/documentation/http/documentation#sharing-add_folder_member

curl example using the admin authorization is here:
https://www.dropbox.com/developers/reference/auth-types#admin-authentication

curl -X POST "https://api.dropboxapi.com/2/users/get_current_account" \
--header "Authorization: Bearer <OAUTH2_ACCESS_TOKEN>" \
--header "Dropbox-API-Select-Admin: <TEAM_MEMBER_ID>"

I'm performing the following steps:
- create REST API class instance
- open http connection
- fetch new oauth2 token using my secret refresh token (refresh token was generated when authorizing the app the first time) and set header field
->http header field = "Authorization: Bearer <oauth2 token>"
- create header field for admin authorization
->http header field = "Dropbox-API-Select-Admin: dbmid<my team member id>"
- create "request" class instance
- set "Content-Type" to "application/json" via request class (this actually generates the corresponding "Content-Type" header parameter)
- build json string with info about new user, team folder etc.
- set json as request data
- make POST request
- create "response" class instance
- get server response & status
- evaluate response & status
- close http connection

All these steps work flawlessly making REST calls to other endpoints (without admin auth.).
Unfortunately there seems to be no useful example in the documentation making use of the "Dropbox-API-Select-Admin" parameter.
At least I wasn't able to find one.

So, please understand: I cannot see any reason why I'm getting this popup, since I DO send a Bearer token.
Here's the ABAP-Objects code with some comments:
...
IF lo_rest_client IS BOUND. "check if class instance has been created
"lo_auth is an instance of a class which handles oauth2 tokens
lo_auth->get_bearer_auth_name_value( IMPORTING es_bearer_auth = ls_auth_bearer ). "fetch new oauth2 token (or use last token if not expired)
IF ls_auth_bearer IS NOT INITIAL.
lo_rest_client->set_request_header( iv_name = ls_auth_bearer-name "Authorization
iv_value = ls_auth_bearer-value ). "Bearer <oauth2 token>
lo_rest_client->set_request_header( iv_name = /karon/cl_dropbox_co=>mc_dbx_par_api_select_admin "Dropbox-API-Select-Admin
iv_value = lv_dbx_team_admin ). "dbmid:<team member id>
lo_rest_client->set_request_header( iv_name = /karon/cl_dropbox_co=>mc_url_par_request_uri "~request_uri
iv_value = `/2/sharing/share_folder` ).
lo_request_entity = lo_rest_client->create_request_entity( ).
lo_request_entity->set_content_type( iv_media_type = /karon/cl_dropbox_co=>mc_content_json ). "application/json
lo_request_entity->set_string_data( iv_data = lv_json ). "json string with parameters
lo_rest_client->post( io_entity = lo_request_entity ).
...

The only reason why I'm sending a Basic token is as response of the authorization popup I'm constantly getting.
IMHO the question is not why I'm getting an error (which is pretty much clear), but why this popup appears.

REST calls to endpoints which require the "Dropbox-API-Select-User" parameter also work without a hitch.

Best regards,
Jan

@1575475 wrote:
...
IMHO the question is not why I'm getting an error (which is pretty much clear), but why this popup appears.
...

Exactly, that's why you have to redirect your question to platform provider or read the documentation.

As a good troubleshooting step if possible, dump and evaluate raw communication between your client application and server. There might be a useful communication details you may ignored. You can compare the dump to expected format in API explorer (push "Show Code" and select "HTTP request"). You have to add "Dropbox-API-Select-Admin" header as a extra header (through "Show Headers"). I believe such info can be useful for your platform provider too, to figure out what's wrong with your HTTP request.

Good luck.

@1575475 It looks like you have the right idea. And for reference, here's a curl example of calling /2/sharing/share_folder with the 'Dropbox-Api-Select-Admin' header specified: (built using the API v2 Explorer)

curl -X POST https://api.dropboxapi.com/2/sharing/share_folder \
  --header 'Authorization: Bearer <ACCESS_TOKEN>' \
  --header 'Content-Type: application/json' \
  --header 'Dropbox-Api-Select-Admin: <TEAM_MEMBER_ID>' \
  --data '{"path":"<PATH>"}'

That works for me, when I plug in valid values.

The popup is presented by your platform though, so I can't offer insight on why that is being shown. As Здравко suggested, you'll want to enable more verbose output if possible to see what exactly the code is/isn't setting properly, and refer to your platform's support/documentation for information on controlling that.

If the issue is only occurring when you attempt to set the "Dropbox-API-Select-Admin" header, you may also want to try debugging that in particular, e.g., make sure that the header name and value are formed properly and don't contain any stray characters/whitespace, etc. Perhaps something like that is malforming the header values you're attempting to set and then causing your platform to default to prompting for basic credentials, or something to that effect.

Hi Greg, hi Sdrawko,

many thanks for your most valuable help. Indeed, the source of the popup was our SAP system and I was able to rectify the problem.

So, please excuse my ignorance by thinking that had been a DBX issue 🙂

But - as the API call seems to work in principle - I'm getting another error:

{"error_summary": "no_permission/
", "error": {"
tag": "no_permission"}, "user_message": {"locale": "de", "text": "Sie sind nicht berechtigt, diese Aktion durchzuf\u00fchren
"}}

Translation: Sie sind nicht berechtigt, diese Aktion durchzuf\u00fchren -> You're not authorized to perform this action

I've no clue why I'm getting this error. I'm admin and also have reauthorized my app after updating the app permissions. (BTW this wasn't mentioned in the documention, but I've found a thread in this forum regarding that issue.)

Also, since I've created this folder via REST call "/2/team/team_folder/create"

I should be owner of the folder and have all the rights. And, again, my app has all permission checkboxes ticked.

How should I proceed?

Thank you and best regards,

Jan

Hi @1575475,

The action, you are trying, seems not granted to you (your access token) for some reason. The translation "berechtigt"->"authorized" is not fairly correct. 😁 Once you get receiving this error message you application seems completely "authorized", otherwise you would not be able get to here. 😉

Possible reasons can be non confirmed scope on authorization and as a result particular scope stay inactive, in spite it has been selected, or you are doing something, that expect admin access, but you skipped represent yourself as admin (or specific team member).

Post exact request that results in such error, at least (with masked access token). May be useful to gets clear if you have some scopes entry in your authorization request and if so, how it looks like.

@1575475 As Здравко said, it would be helpful to see the actual request to troubleshoot this further. From your description though, are you trying to call /2/sharing/share_folder on the team folder itself, which you created using /2/team/team_folder/create? You don't need to "share" a team folder, since it is already "shared". (Team folders are essentially a type of shared folder.) You can use /2/sharing/add_folder_member to add members to it.

URL: https://api.dropboxapi.com/2/sharing/add_folder_member

Hi Greg, hi Sdrawko,

thank you again for your input. In the meantime I've created a Postman script which also fails. Here're the details:

Header parameters

Screenshot 2022-09-27 091901.jpg

The app token has been fetched a couple of minutes before and I've double checked my team member id. Since this id is used in various other calls it has to be ok.

JSON Body

{"custom_message":"Test","members":[{"access_level":"editor","member":{".tag":"email","email":"jan.buchholz@karon.de"}}],"quiet":true,"shared_folder_id":"3032413665"}

(Output of list team folders, just to check that the folder id is correct)

What I don't understand here is that the "team shared" flag is set to false. In ABAP space=false and "X"=true.

Response with status 409 (conflict)

{

"error_summary": "no_permission/..",

"error": {

".tag": "no_permission"

"user_message": {

"locale": "de",

"text": "Sie sind nicht berechtigt, diese Aktion durchzuführen."

}

App permission

After rectifying the ominous popup issue, I think that the API I've created is in a "mature state" and doesn't contain any more errors.

Any other calls (list folder, create folder, upload file, download file, delete file, get_metadata, list team members, list team namespaces, list team events, etc.) work flawlessly.

Now, as even the Postman script fails, IMHO the problem must be somewhere else. But, I'm running out of clues 😞

BTW, since I'm already member of the team folder, I'd expect some kind of error message, but not permission related at all.

Best regards,

Jan

@1575475 wrote:
...
(Output of list team folders, just to check that the folder id is correct)
What I don't understand here is that the "team shared" flag is set to false. In ABAP space=false and "X"=true.

...

There is not exactly "IS_TEAM_SHARED", so most probably your are referring to "is_team_shared_dropbox" (which means is this a team root or not 😉). In all cases it's a team folder.

There are different reasons (wide spread of such) that can lead to wrong result. Let's do one more step to clarifying. Execute something like following:

curl -X POST https://api.dropboxapi.com/2/sharing/get_folder_metadata \
  --header 'Authorization: Bearer sl.BQAwolS9uZkZOnfZtpVoQIbNSX...' \
  --header 'Dropbox-Api-Select-Admin: dbmid:AACAstOvwj3lJYBziCcpdksycjMM-...' \
  --header 'Content-Type: application/json' \
  --data '{"shared_folder_id":"3032413665","actions":[{".tag":"invite_editor"},{".tag":"invite_viewer"}]}'

...or represent the same request as you like (is easier to you). Can you post the result? 🧐 There can be some clue.

Hi Sdrawko,

thank you for your help.

Regarding the "IS_TEAM_SHARED" field: What you see is the SAP internal field, it is mapped correctly to the original metadata field.

I internally used some shorter name to spare horizontal space 🙂

I ran your script with Postman and got the following result:

{

"access_type": {

".tag": "owner"

"is_inside_team_folder": false,

"is_team_folder": true,

"owner_team": {

"id": "dbtid:AABm0erI_vc6S9THU9dZ32uHg68XlhP1TNM",

"name": "Karon Beratungsgesellschaft mbH IUL"

"name": "KARON_TEAM_ON_PRD_TEST_001",

"permissions": [

{

"action": {

".tag": "invite_editor"

"allow": true

{

"action": {

".tag": "invite_viewer"

"allow": true

}

"policy": {

"member_policy": {

".tag": "anyone"

"resolved_member_policy": {

".tag": "anyone"

"acl_update_policy": {

".tag": "editors"

"shared_link_policy": {

".tag": "anyone"

"viewer_info_policy": {

".tag": "enabled"

}

"preview_url": "https://www.dropbox.com/scl/fo/q6cjkqf1wgzzl8xxnork9/h?dl=0",

"shared_folder_id": "3032413665",

"time_invited": "2022-09-20T10:57:59Z",

"access_inheritance": {

".tag": "inherit"

}

Best regards,

Jan

Wow... that's going be something really strange. According to your last post you should be able add (invite) a member. 🤔🤷 I can't say something more.

You can try repeat execution of the failing request and catch the response header block. There should be a header 'x-dropbox-request-id'. Post this header's value and let's hope Greg will be able find out something more.

Good luck.

Hi Sdrawko,

just added some lines of code to my method to fetch the response header fields.

Here're the values straight out of the debugger 🙂

~response_line HTTP/1.0 409 Conflict
~server_protocol HTTP/1.0
~status_code 409
~status_reason Conflict
cache-control no-cache
content-security-policy sandbox allow-forms allow-scripts
x-content-type-options nosniff
content-type application/json
accept-encoding identity,gzip
date Tue, 27 Sep 2022 13:46:25 GMT
server envoy
content-encoding gzip
vary Accept-Encoding
x-dropbox-response-origin far_remote
x-dropbox-request-id 0b7745ec6a394c35861332368f0f641d
connection close

Best regards,

Jan

For example, you would set the "members" parameter like:

"members":[{"member":{".tag":"dropbox_id","dropbox_id":"GROUPIDHERE"}}]

You can get group IDs from /2/team/groups/list, etc.