Xbase++ Requires Chilkat v11.7.0+
Box: Resolve Folder and File IDs with the HttpCurl Dependency Engine

Download images/penguins.jpg using search-based HttpCurl dependencies and one DoYourThing call. Register search requests/output rules once, then supply names. Search results must each contain exactly one item; exact names and immediate parent IDs are checked before saving the downloaded bytes. The candidate content is downloaded into memory before validation, so this example is for small files. Multiple results are rejected instead of paginated or silently choosing a candidate. Search indexing can delay visibility of newly created or renamed items.
See the Box API guide for setup and the complete workflow.
Chilkat Xbase++ Downloads

Download Chilkat for Xbase++
Xbase++
LOCAL nSuccess
LOCAL oCurl
LOCAL oSetupCommand
LOCAL nSetupReplacements
LOCAL cFolderName
LOCAL cFileName
LOCAL oQueryText
LOCAL cLocalPath
LOCAL oPlan
LOCAL oAuthorizedCommand1
LOCAL nHeaderReplacement1
LOCAL oAuthorizedCommand2
LOCAL nHeaderReplacement2
LOCAL oContents

nSuccess := 0

//  Requires Chilkat 11.7.0 or later and a previously unlocked Chilkat bundle.
//  See Global Unlock Sample.
//  Guide: Box API Guide.

nSuccess := 0

//  BEGIN ONE-TIME SETUP
//  Requires Chilkat 11.7.0. Registration sends no requests.
//  Run this once and keep the SAME HttpCurl object for later downloads.
//  This focused setup searches for a root folder and a file directly inside it.
oCurl := CreateObject("Chilkat.HttpCurl")
oCurl:SetVar("access_token", "BOX_ACCESS_TOKEN")
oSetupCommand := CreateObject("Chilkat.StringBuilder")

//  searchFolder: Box searches names; quotes request a phrase match.
oSetupCommand:SetString('curl -X GET "https://api.box.com/2.0/search?query={{folder_query}}&type=folder&content_types=name&fields=id,type,name,parent&limit=2" -H "Authorization: Bearer ACCESS_TOKEN"')
nSetupReplacements := oSetupCommand:Replace("ACCESS_TOKEN", oCurl:GetVar("access_token"))
nSuccess := oCurl:AddFunction("searchFolder", oSetupCommand:GetAsString())
IF (nSuccess != 1)
    ? oCurl:LastErrorText
    oCurl:destroy()
    oSetupCommand:destroy()
    RETURN
ENDIF

//  Deferred selection: folder_name need not be set during setup.
nSuccess := oCurl:AddOutput2("searchFolder", "entries", "name", "{{folder_name}}", 1, "id", "folder_id")
IF (nSuccess != 1)
    ? oCurl:LastErrorText
    oCurl:destroy()
    oSetupCommand:destroy()
    RETURN
ENDIF

nSuccess := oCurl:AddOutput2("searchFolder", "entries", "name", "{{folder_name}}", 1, "name", "folder_result_name")
IF (nSuccess != 1)
    ? oCurl:LastErrorText
    oCurl:destroy()
    oSetupCommand:destroy()
    RETURN
ENDIF

nSuccess := oCurl:AddOutput2("searchFolder", "entries", "name", "{{folder_name}}", 1, "parent.id", "folder_parent_id")
IF (nSuccess != 1)
    ? oCurl:LastErrorText
    oCurl:destroy()
    oSetupCommand:destroy()
    RETURN
ENDIF

nSuccess := oCurl:AddOutput("searchFolder", "total_count", "folder_search_count")
IF (nSuccess != 1)
    ? oCurl:LastErrorText
    oCurl:destroy()
    oSetupCommand:destroy()
    RETURN
ENDIF

//  searchFile: Box searches names; quotes request a phrase match.
oSetupCommand:SetString('curl -X GET "https://api.box.com/2.0/search?query={{file_query}}&type=file&content_types=name&fields=id,type,name,parent&limit=2&ancestor_folder_ids={{folder_id}}" -H "Authorization: Bearer ACCESS_TOKEN"')
nSetupReplacements := oSetupCommand:Replace("ACCESS_TOKEN", oCurl:GetVar("access_token"))
nSuccess := oCurl:AddFunction("searchFile", oSetupCommand:GetAsString())
IF (nSuccess != 1)
    ? oCurl:LastErrorText
    oCurl:destroy()
    oSetupCommand:destroy()
    RETURN
ENDIF

//  Deferred selection: file_name need not be set during setup.
nSuccess := oCurl:AddOutput2("searchFile", "entries", "name", "{{file_name}}", 1, "id", "file_id")
IF (nSuccess != 1)
    ? oCurl:LastErrorText
    oCurl:destroy()
    oSetupCommand:destroy()
    RETURN
ENDIF

nSuccess := oCurl:AddOutput2("searchFile", "entries", "name", "{{file_name}}", 1, "name", "file_result_name")
IF (nSuccess != 1)
    ? oCurl:LastErrorText
    oCurl:destroy()
    oSetupCommand:destroy()
    RETURN
ENDIF

nSuccess := oCurl:AddOutput2("searchFile", "entries", "name", "{{file_name}}", 1, "parent.id", "file_parent_id")
IF (nSuccess != 1)
    ? oCurl:LastErrorText
    oCurl:destroy()
    oSetupCommand:destroy()
    RETURN
ENDIF

nSuccess := oCurl:AddOutput("searchFile", "total_count", "file_search_count")
IF (nSuccess != 1)
    ? oCurl:LastErrorText
    oCurl:destroy()
    oSetupCommand:destroy()
    RETURN
ENDIF

//  END ONE-TIME SETUP
//  Search is indexed: newly uploaded/renamed items may not appear immediately.
//  Search matches phrases, not exact strings, and ancestor filtering includes
//  subfolders. The operation validates counts, exact names, and immediate parents.
//  limit=2 is enough to demonstrate an ambiguous search; total_count covers all
//  results, not just this page. This introductory example requires exactly one
//  search result at each step and does not select among multiple candidates.

//  BEGIN OPERATION -- use the previously configured object.
//  Human-readable inputs. No resource IDs are supplied by the caller.
cFolderName := "images"
cFileName := "penguins.jpg"
//  Encode the quoted search queries separately from the literal output filters.
//  In this build, URL variable substitution does not encode '&' in a name.
oQueryText := CreateObject("Chilkat.StringBuilder")
oQueryText:SetString('"')
oQueryText:Append(cFolderName)
oQueryText:Append('"')
oCurl:SetVar("folder_query", oQueryText:GetEncoded("url", "utf-8"))
oQueryText:SetString('"')
oQueryText:Append(cFileName)
oQueryText:Append('"')
oCurl:SetVar("file_query", oQueryText:GetEncoded("url", "utf-8"))
IF (oCurl:GetVar("folder_name") != cFolderName)
    oCurl:ClearVar("folder_id")
    oCurl:ClearVar("folder_result_name")
    oCurl:ClearVar("folder_parent_id")
    oCurl:ClearVar("folder_search_count")
    oCurl:ClearVar("file_id")
    oCurl:ClearVar("file_result_name")
    oCurl:ClearVar("file_parent_id")
    oCurl:ClearVar("file_search_count")
    oCurl:SetVar("folder_name", cFolderName)
ENDIF

IF (oCurl:GetVar("file_name") != cFileName)
    oCurl:ClearVar("file_id")
    oCurl:ClearVar("file_result_name")
    oCurl:ClearVar("file_parent_id")
    oCurl:ClearVar("file_search_count")
    oCurl:SetVar("file_name", cFileName)
ENDIF

//  With unchanged names, cached IDs and validation fields can be reused.
//  Clear the corresponding cached fields to refresh after a remote rename/move.
cLocalPath := "qa_output/penguins.jpg"
//  A cold plan is searchFolder -> searchFile -> targetCurl.
//  No listing endpoint or manual search call is used.
oPlan := CreateObject("Chilkat.JsonObject")
oPlan:EmitCompact := 0
oAuthorizedCommand1 := CreateObject("Chilkat.StringBuilder")
oAuthorizedCommand1:SetString('curl -X GET "https://api.box.com/2.0/files/{{file_id}}/content" -H "Authorization: Bearer {{access_token}}" -L')
nHeaderReplacement1 := oAuthorizedCommand1:Replace("{{access_token}}", oCurl:GetVar("access_token"))
nSuccess := oCurl:ExaminePlan(oAuthorizedCommand1:GetAsString(), oPlan)
IF (nSuccess != 1)
    ? oCurl:LastErrorText
    oCurl:destroy()
    oSetupCommand:destroy()
    oQueryText:destroy()
    oPlan:destroy()
    oAuthorizedCommand1:destroy()
    RETURN
ENDIF

? oPlan:Emit()
//  Keep the candidate download in memory; do not write an unvalidated result.
oCurl:ResponseFilePath := ""
oCurl:ClearTargetOutput("*")
oAuthorizedCommand2 := CreateObject("Chilkat.StringBuilder")
oAuthorizedCommand2:SetString('curl -X GET "https://api.box.com/2.0/files/{{file_id}}/content" -H "Authorization: Bearer {{access_token}}" -L')
nHeaderReplacement2 := oAuthorizedCommand2:Replace("{{access_token}}", oCurl:GetVar("access_token"))
nSuccess := oCurl:DoYourThing(oAuthorizedCommand2:GetAsString())
IF ((nSuccess != 1) .OR. (oCurl:StatusCode != 200))
    ? "Box request failed. HTTP status: " + Str(oCurl:StatusCode)
    ? "Failure reason: " + Str(oCurl:FailReason)
    oCurl:destroy()
    oSetupCommand:destroy()
    oQueryText:destroy()
    oPlan:destroy()
    oAuthorizedCommand1:destroy()
    oAuthorizedCommand2:destroy()
    RETURN
ENDIF

//  AddOutput2 supplies candidate IDs. Box's phrase search and recursive
//  ancestor filter are not an exact path lookup, so validate before saving.
IF ((oCurl:GetVar("folder_search_count") != "1") .OR. (oCurl:GetVar("file_search_count") != "1"))
    ? "Search was ambiguous or incomplete. Expected exactly one result per search; no file was saved."
    ? "Folder results: " + oCurl:GetVar("folder_search_count") + " File results: " + oCurl:GetVar("file_search_count")
    oCurl:ClearVar("folder_id")
    oCurl:ClearVar("folder_result_name")
    oCurl:ClearVar("folder_parent_id")
    oCurl:ClearVar("folder_search_count")
    oCurl:ClearVar("file_id")
    oCurl:ClearVar("file_result_name")
    oCurl:ClearVar("file_parent_id")
    oCurl:ClearVar("file_search_count")
    oCurl:destroy()
    oSetupCommand:destroy()
    oQueryText:destroy()
    oPlan:destroy()
    oAuthorizedCommand1:destroy()
    oAuthorizedCommand2:destroy()
    RETURN
ENDIF

IF ((oCurl:GetVar("folder_result_name") != cFolderName) .OR. (oCurl:GetVar("folder_parent_id") != "0") .OR. (oCurl:GetVar("file_result_name") != cFileName) .OR. (oCurl:GetVar("file_parent_id") != oCurl:GetVar("folder_id")))
    ? "The search result is not the exact root-folder/filename requested; no file was saved."
    oCurl:ClearVar("folder_id")
    oCurl:ClearVar("folder_result_name")
    oCurl:ClearVar("folder_parent_id")
    oCurl:ClearVar("folder_search_count")
    oCurl:ClearVar("file_id")
    oCurl:ClearVar("file_result_name")
    oCurl:ClearVar("file_parent_id")
    oCurl:ClearVar("file_search_count")
    oCurl:destroy()
    oSetupCommand:destroy()
    oQueryText:destroy()
    oPlan:destroy()
    oAuthorizedCommand1:destroy()
    oAuthorizedCommand2:destroy()
    RETURN
ENDIF

//  Validation is after the network download but before writing the destination.
//  This in-memory example is intended for small files such as penguins.jpg.
//  Create qa_output before running it.
oContents := CreateObject("Chilkat.BinData")
nSuccess := oCurl:GetResponseBd(oContents)
IF (nSuccess != 1)
    ? oCurl:LastErrorText
    oCurl:destroy()
    oSetupCommand:destroy()
    oQueryText:destroy()
    oPlan:destroy()
    oAuthorizedCommand1:destroy()
    oAuthorizedCommand2:destroy()
    oContents:destroy()
    RETURN
ENDIF

nSuccess := oContents:WriteFile(cLocalPath)
IF (nSuccess != 1)
    ? oContents:LastErrorText
    oCurl:destroy()
    oSetupCommand:destroy()
    oQueryText:destroy()
    oPlan:destroy()
    oAuthorizedCommand1:destroy()
    oAuthorizedCommand2:destroy()
    oContents:destroy()
    RETURN
ENDIF

? "Downloaded to " + cLocalPath

oCurl:destroy()
oSetupCommand:destroy()
oQueryText:destroy()
oPlan:destroy()
oAuthorizedCommand1:destroy()
oAuthorizedCommand2:destroy()
oContents:destroy()