Canva Connect API

openapi: 3.2.0
info:
  contact:
    name: Canva Developer Community
    url: https://community.canva.dev/
  description: API for building integrations with Canva via a REST api
  license:
    name: ©2023 All Rights Reserved
  termsOfService: https://www.canva.com/trust/legal/
  title: Canva Connect API
  version: 2024-06-18
servers:
- description: Canva Connect API
  url: https://api.canva.com/rest
tags:
- name: connect
paths:
  /v1/connect/keys:
    get:
      description: '<Warning>


        This API is currently provided as a preview. Be aware of the following:


        - There might be unannounced breaking changes.

        - Any breaking changes to preview APIs won''t produce a new [API version](https://www.canva.dev/docs/connect/versions/).

        - Public integrations that use preview APIs will not pass the review process, and can''t be made available to all Canva users.


        </Warning>


        The Keys API (`connect/keys`) is a security measure you can use to verify the authenticity

        of webhooks you receive from Canva Connect. The Keys API returns a

        [JSON Web Key (JWK)](https://www.rfc-editor.org/rfc/rfc7517#section-2), which you can use to

        decrypt the webhook signature and verify it came from Canva and not a potentially malicious

        actor. This helps to protect your systems from

        [Replay attacks](https://owasp.org/Top10/A08_2021-Software_and_Data_Integrity_Failures/).


        The keys returned by the Keys API can rotate. We recommend you cache the keys you receive

        from this API where possible, and only access this API when you receive a webhook signed

        with an unrecognized key. This allows you to verify webhooks quicker than accessing this API

        every time you receive a webhook.'
      operationId: getSigningPublicKeys
      responses:
        '200':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/GetSigningPublicKeysResponse'
          description: OK
        default:
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'
          description: Error Response
      tags:
      - connect
components:
  schemas:
    ErrorCode:
      description: 'A short string indicating what failed. This field can be used to handle errors programmatically.

        '
      enum:
      - internal_error
      - invalid_field
      - invalid_header_value
      - permission_denied
      - too_many_requests
      - not_found
      - bad_request_body
      - bad_http_method
      - bad_request_params
      - bad_query_params
      - user_role_required
      - endpoint_not_found
      - endpoint_gone
      - unsupported_version
      - invalid_access_token
      - revoked_access_token
      - missing_field
      - missing_scope
      - invalid_grant
      - invalid_request
      - invalid_client
      - unauthorized_client
      - unsupported_grant_type
      - invalid_scope
      - invalid_basic_header
      - invalid_file_format
      - quota_exceeded
      - ai_credit_quota_exceeded
      - ai_credit_quota_cooldown
      - unsupported_content_type
      - request_too_large
      - folder_not_found
      - item_in_multiple_folders
      - asset_not_found
      - max_limit_reached
      - permission_not_found
      - permission_exists
      - unauthorized_user
      - user_not_found
      - user_not_eligible
      - group_not_found
      - app_not_found
      - app_has_non_draft_versions
      - invalid_status_transition
      - translation_validation_failed
      - content_not_found
      - doctype_not_found
      - design_not_found
      - offset_too_large
      - page_not_found
      - design_or_comment_not_found
      - design_or_thread_not_found
      - review_dismissed
      - design_type_not_found
      - team_not_found
      - team_is_default
      - comment_not_found
      - too_many_comments
      - too_many_replies
      - message_too_long
      - thread_not_found
      - reply_not_found
      - design_not_fillable
      - autofill_data_invalid
      - feature_not_available
      - unsupported_design_type
      - design_generation_not_enabled
      - license_required
      - input_unsafe
      - display_name_unavailable
      - user_not_managed
      - saml_team_id_conflict
      - saml_name_id_not_available
      - user_email_unverified
      - user_not_active
      - user_pending_consent
      - account_exists
      type: string
    GetSigningPublicKeysResponse:
      properties:
        keys:
          description: 'A Json Web Key Set (JWKS) with public keys used for signing webhooks. You can use this JWKS

            to verify that a webhook was sent from Canva.'
          example:
          - kid: a418dc7d-ecc5-5c4b-85ce-e1104a8addbe
            kty: OKP
            crv: Ed25519
            x: aIQtqd0nDfB-ug0DrzZbwTum-1ITdXvKxGFak_1VB2j
          - kid: c8de5bec1-1b88-4ddaae04acc-ce415-5d7
            kty: OKP
            crv: Ed25519
            x: m2d1FT-gfBXxIzKwdQVTra0D-aBq_ubZ1jI0GuvkDtn
          items:
            $ref: '#/components/schemas/EdDsaJwk'
          type: array
      required:
      - keys
      type: object
    EdDsaJwk:
      description: 'A JSON Web Key Set (JWKS) using the Edwards-curve Digital Signature Algorithm (EdDSA), as

        described in [RFC-8037](https://www.rfc-editor.org/rfc/rfc8037.html#appendix-A).'
      properties:
        kid:
          description: 'The `kid` (key ID) is a unique identifier for a public key. When the keys used

            to sign webhooks are rotated, you can use this ID to select the correct key

            within a JWK Set during the key rollover. The `kid` value is case-sensitive.'
          type: string
        kty:
          description: 'The `kty` (key type) identifies the cryptographic algorithm family used with

            the key, such as "RSA" or "EC". Only Octet Key Pairs

            (`OKPs`) are supported.

            The `kty` value is case-sensitive. For more information on the `kty` property

            and OKPs, see [RFC-8037 — "kty" (Key Type)

            Parameter](https://www.rfc-editor.org/rfc/rfc8037.html#section-2).'
          type: string
        crv:
          description: 'The `crv` (curve) property identifies the curve used for elliptical curve

            encryptions. Only "Ed25519" is supported. For more information on the `crv`

            property, see [RFC-8037 — Key Type

            "OKP"](https://www.rfc-editor.org/rfc/rfc8037.html#section-2).'
          type: string
        x:
          description: 'The `x` property is the public key of an elliptical curve encryption. The key

            is Base64urlUInt-encoded. For more information on the `x` property, see

            [RFC-8037 — "x" (X Coordinate)

            Parameter](https://www.rfc-editor.org/rfc/rfc8037#section-2).'
          type: string
      required:
      - crv
      - kid
      - kty
      - x
      type: object
    Error:
      properties:
        code:
          $ref: '#/components/schemas/ErrorCode'
        message:
          description: A human-readable description of what went wrong.
          type: string
      required:
      - code
      - message
      type: object
  securitySchemes:
    basicAuth:
      scheme: basic
      type: http
    oauthAuthCode:
      flows:
        authorizationCode:
          authorizationUrl: https://www.canva.com/api/oauth/authorize
          scopes:
            design:content:read: View the contents of the user's designs.
            design:meta:read: View the metadata of the user's designs.
            design:content:write: Create designs on the user's behalf.
            folder:read: 'View the metadata and contents of the user''s folders, including their **Projects**

              folder.'
            folder:write: 'Add, move, or remove the user''s folders. It also lets you edit folder metadata,

              such as the folder''s name.'
            folder:permission:write: Set, update, or remove permissions assigned to the user's folders.
            asset:read: View the metadata for the user's assets, such as uploaded images.
            asset:write: Upload, update, or delete assets on the user's behalf.
            comment:read: View the comments on the user's designs, and the associated metadata.
            comment:write: Create comments and replies on the user's designs.
            collaboration:event: Receive webhook notifications about events relevant to the user.
            brandtemplate:meta:read: View the metadata of the brand templates associated with the user's brand.
            brandtemplate:content:read: Read the content of the brand templates associated with the user's brand.
            brandtemplate:content:write: Publish brand templates associated with the user's brand.
            profile:read: Read a user's profile and account information.
            openid: Read user information through Open ID Connect (OIDC).
            profile: Read user profile information through OIDC.
            email: Read user email address through OIDC.
          tokenUrl: https://api.canva.com/rest/v1/oauth/token
      type: oauth2