Canva Connect API

openapi: 3.2.0
info:
  contact:
    name: Canva Developer Community
    url: https://community.canva.dev/
  description: API for building integrations with Canva via a REST api
  license:
    name: ©2023 All Rights Reserved
  termsOfService: https://www.canva.com/trust/legal/
  title: Canva Connect API
  version: 2024-06-18
servers:
- description: Canva Connect API
  url: https://api.canva.com/rest
tags:
- name: Connect
paths:
  /v1/connect/keys:
    get:
      description: 'This API is currently provided as a preview. Be aware of the following:


        - There might be unannounced breaking changes.

        - Any breaking changes to preview APIs won''t produce a new API version.

        - Public integrations that use preview APIs will not pass the review process, and can''t be made available to all Canva users.


        The Keys API (`connect/keys`) is a security measure you can use to verify the authenticity

        of webhooks you receive from Canva Connect. The Keys API returns a

        JSON Web Key (JWK), which you can use to

        decrypt the webhook signature and verify it came from Canva and not a potentially malicious

        actor. This helps to protect your systems from

        Replay attacks.


        The keys returned by the Keys API can rotate. We recommend you cache the keys you receive

        from this API where possible, and only access this API when you receive a webhook signed

        with an unrecognized key. This allows you to verify webhooks quicker than accessing this API

        every time you receive a webhook.'
      operationId: getSigningPublicKeys
      responses:
        '200':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/GetSigningPublicKeysResponse'
          description: OK
        default:
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'
          description: Error Response
      tags:
      - Connect
      summary: Get signing public keys
      x-summary-source: derived
components:
  schemas:
    EdDsaJwk:
      description: 'A JSON Web Key Set (JWKS) using the Edwards-curve Digital Signature Algorithm (EdDSA), as

        described in [RFC-8037](https://www.rfc-editor.org/rfc/rfc8037.html#appendix-A).'
      properties:
        kid:
          description: 'The `kid` (key ID) is a unique identifier for a public key. When the keys used

            to sign webhooks are rotated, you can use this ID to select the correct key

            within a JWK Set during the key rollover. The `kid` value is case-sensitive.'
          type: string
        kty:
          description: 'The `kty` (key type) identifies the cryptographic algorithm family used with

            the key, such as "RSA" or "EC". Only Octet Key Pairs

            (`OKPs`) are supported.

            The `kty` value is case-sensitive. For more information on the `kty` property

            and OKPs, see [RFC-8037 — "kty" (Key Type)

            Parameter](https://www.rfc-editor.org/rfc/rfc8037.html#section-2).'
          type: string
        crv:
          description: 'The `crv` (curve) property identifies the curve used for elliptical curve

            encryptions. Only "Ed25519" is supported. For more information on the `crv`

            property, see [RFC-8037 — Key Type

            "OKP"](https://www.rfc-editor.org/rfc/rfc8037.html#section-2).'
          type: string
        x:
          description: 'The `x` property is the public key of an elliptical curve encryption. The key

            is Base64urlUInt-encoded. For more information on the `x` property, see

            [RFC-8037 — "x" (X Coordinate)

            Parameter](https://www.rfc-editor.org/rfc/rfc8037#section-2).'
          type: string
      required:
      - crv
      - kid
      - kty
      - x
      type: object
    ErrorCode:
      description: 'A short string indicating what failed. This field can be used to handle errors programmatically.

        '
      enum:
      - internal_error
      - invalid_field
      - invalid_header_value
      - permission_denied
      - too_many_requests
      - not_found
      - bad_request_body
      - bad_http_method
      - bad_request_params
      - bad_query_params
      - user_role_required
      - endpoint_not_found
      - endpoint_gone
      - unsupported_version
      - invalid_access_token
      - revoked_access_token
      - missing_field
      - missing_scope
      - invalid_grant
      - invalid_request
      - invalid_client
      - unauthorized_client
      - unsupported_grant_type
      - invalid_scope
      - invalid_basic_header
      - invalid_file_format
      - quota_exceeded
      - ai_credit_quota_exceeded
      - ai_credit_quota_cooldown
      - unsupported_content_type
      - request_too_large
      - folder_not_found
      - item_in_multiple_folders
      - asset_not_found
      - max_limit_reached
      - permission_not_found
      - permission_exists
      - unauthorized_user
      - user_not_found
      - user_not_eligible
      - group_not_found
      - app_not_found
      - app_has_non_draft_versions
      - invalid_status_transition
      - translation_validation_failed
      - content_not_found
      - doctype_not_found
      - design_not_found
      - offset_too_large
      - page_not_found
      - design_or_comment_not_found
      - design_or_thread_not_found
      - review_dismissed
      - design_type_not_found
      - team_not_found
      - team_is_default
      - comment_not_found
      - too_many_comments
      - too_many_replies
      - message_too_long
      - thread_not_found
      - reply_not_found
      - design_not_fillable
      - autofill_data_invalid
      - feature_not_available
      - unsupported_design_type
      - design_generation_not_enabled
      - license_required
      - input_unsafe
      - display_name_unavailable
      - user_not_managed
      - saml_team_id_conflict
      - saml_name_id_not_available
      - user_email_unverified
      - user_not_active
      - user_pending_consent
      - account_exists
      type: string
    Error:
      properties:
        code:
          $ref: '#/components/schemas/ErrorCode'
        message:
          description: A human-readable description of what went wrong.
          type: string
      required:
      - code
      - message
      type: object
    GetSigningPublicKeysResponse:
      properties:
        keys:
          description: 'A Json Web Key Set (JWKS) with public keys used for signing webhooks. You can use this JWKS

            to verify that a webhook was sent from Canva.'
          example:
          - kid: a418dc7d-ecc5-5c4b-85ce-e1104a8addbe
            kty: OKP
            crv: Ed25519
            x: aIQtqd0nDfB-ug0DrzZbwTum-1ITdXvKxGFak_1VB2j
          - kid: c8de5bec1-1b88-4ddaae04acc-ce415-5d7
            kty: OKP
            crv: Ed25519
            x: m2d1FT-gfBXxIzKwdQVTra0D-aBq_ubZ1jI0GuvkDtn
          items:
            $ref: '#/components/schemas/EdDsaJwk'
          type: array
      required:
      - keys
      type: object
  securitySchemes:
    basicAuth:
      scheme: basic
      type: http
    oauthAuthCode:
      flows:
        authorizationCode:
          authorizationUrl: https://www.canva.com/api/oauth/authorize
          scopes:
            design:content:read: View the contents of the user's designs.
            design:meta:read: View the metadata of the user's designs.
            design:content:write: Create designs on the user's behalf.
            folder:read: 'View the metadata and contents of the user''s folders, including their **Projects**

              folder.'
            folder:write: 'Add, move, or remove the user''s folders. It also lets you edit folder metadata,

              such as the folder''s name.'
            folder:permission:write: Set, update, or remove permissions assigned to the user's folders.
            asset:read: View the metadata for the user's assets, such as uploaded images.
            asset:write: Upload, update, or delete assets on the user's behalf.
            comment:read: View the comments on the user's designs, and the associated metadata.
            comment:write: Create comments and replies on the user's designs.
            collaboration:event: Receive webhook notifications about events relevant to the user.
            brandtemplate:meta:read: View the metadata of the brand templates associated with the user's brand.
            brandtemplate:content:read: Read the content of the brand templates associated with the user's brand.
            brandtemplate:content:write: Publish brand templates associated with the user's brand.
            profile:read: Read a user's profile and account information.
            openid: Read user information through Open ID Connect (OIDC).
            profile: Read user profile information through OIDC.
            email: Read user email address through OIDC.
          tokenUrl: https://api.canva.com/rest/v1/oauth/token
      type: oauth2