---
title: "Create folder lock"
method: POST
path: "/folder_locks"
tags: ["Folder Locks"]
---

# Create folder lock

`POST /folder_locks`

Creates a folder lock on a folder, preventing it from being moved and/or
deleted.

You must be authenticated as the owner or co-owner of the folder to
use this endpoint.

## Request body

- object
  - `locked_operations` object — The operations to lock for the folder. If `locked_operations` is included in the request, both `move` and `delete` must also be included and both set to `true`.
    - `move` boolean, required — Whether moving the folder should be locked.
    - `delete` boolean, required — Whether deleting the folder should be locked.
  - `folder` object, required — The folder to apply the lock to.
    - `type` string, required — The content type the lock is being applied to. Only `folder` is supported.
    - `id` string, required — The ID of the folder.

## Response `200`

Returns the instance of the folder lock that was applied to the folder,
including the user that applied the lock and the operations set.

- FolderLock — Folder locks define access restrictions placed by folder owners to prevent specific folders from being moved or deleted.
  - `folder` object — The folder that the lock applies to.
    - `id` string, required — The unique identifier that represent a folder. The ID for any folder can be determined by visiting a folder in the web application and copying the ID from the URL. For example, for the URL `https://*.app.box.com/folders/123` the `folder_id` is `123`.
    - `etag` string, nullable — The HTTP `etag` of this folder. This can be used within some API endpoints in the `If-Match` and `If-None-Match` headers to only perform changes on the folder if (no) changes have happened.
    - `type` 'folder', required — The value will always be `folder`.
    - `sequence_id` string — A numeric identifier that represents the most recent user event that has been applied to this item. This can be used in combination with the `GET /events`-endpoint to filter out user events that would have occurred before this identifier was read. An example would be where a Box Drive-like application would fetch an item via the API, and then listen to incoming user events for changes to the item. The application would ignore any user events where the `sequence_id` in the event is smaller than or equal to the `sequence_id` in the originally fetched resource.
    - `name` string — The name of the folder.
  - `id` string — The unique identifier for this folder lock.
  - `type` string — The object type, always `folder_lock`.
  - `created_by` object — The user or group that created the lock.
    - `id` string, required — The unique identifier for this user.
    - `type` 'user', required — The value will always be `user`.
  - `created_at` string, date-time — When the folder lock object was created.
  - `locked_operations` object — The operations that have been locked. Currently the `move` and `delete` operations cannot be locked separately, and both need to be set to `true`.
    - `move` boolean, required — Whether moving the folder is restricted.
    - `delete` boolean, required — Whether deleting the folder is restricted.
  - `lock_type` string — The lock type, always `freeze`.

## Other responses

- `400` — Returns an error when the request body is not valid. * `schema_validation_failed` - The request body contains a value for a field that either does not exist, or for which the value or type does not match the expected field type. An example might be an unknown option for an `enum` or `multiSelect` field.
- `404` — Returns an error when the folder was not found. * `not_found` - The folder could not be found, the user does not have access to the folder, or the user making call is not an owner or co-owner of folder.
- `default` — An unexpected client error.

---

[API](https://skmtc.net/box/apis/platform-api.md) · [All operations](https://skmtc.net/box/apis/platform-api/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/box/platform-api/revisions/ba8f087e1a4d/schema)