interface BoxGenerateDownloadURLParamsCSPSandbox false serves the file with no CSP sandbox directive; omit to keep it.
CSPSandboxFlags loosen the CSP sandbox the file is served under; omit for the most restrictive policy.
CSPSourceBundles allow the served file to fetch from named third-party origins; omit to send no fetch directive.
ExpiresInSeconds is optional; a link with no expiry never expires.