Canva OAUTH API

openapi: 3.2.0
info:
  contact:
    name: Canva Developer Community
    url: https://community.canva.dev/
  description: API for building integrations with Canva via a REST api
  license:
    name: ©2023 All Rights Reserved
  termsOfService: https://www.canva.com/trust/legal/
  title: Canva Connect OAUTH API
  version: 2024-06-18
servers:
- description: Canva Connect API
  url: https://api.canva.com/rest
tags:
- name: oauth
paths:
  /v1/oauth/token:
    servers:
    - description: Canva Connect API
      url: https://api.canva.com/auth
    - description: Canva Connect API (deprecated)
      url: https://api.canva.com/rest
    post:
      description: 'This endpoint implements the OAuth 2.0 `token` endpoint, as part of the Authorization Code flow with Proof Key for Code Exchange (PKCE). For more information, see [Authentication](https://www.canva.dev/docs/connect/authentication/).


        To generate an access token, you must provide one of the following:


        - An authorization code

        - A refresh token


        Generating a token using either an authorization code or a refresh token allows your integration to act on behalf of a user. You must first [obtain user authorization and get an authorization code](https://www.canva.dev/docs/connect/authentication/#obtain-user-authorization).


        Access tokens may be up to 4 KB in size, and are only valid for a specified period of time. The expiry time (currently 4 hours) is shown in the endpoint response and is subject to change.


        **Endpoint authentication**


        Requests to this endpoint require authentication with your client ID and client secret, using _one_ of the following methods:


        - **Basic access authentication** (Recommended): For [basic access authentication](https://en.wikipedia.org/wiki/Basic_access_authentication), the `{credentials}` string must be a Base64 encoded value of `{client id}:{client secret}`.

        - **Body parameters**: Provide your integration''s credentials using the `client_id` and `client_secret` body parameters.


        This endpoint can''t be called from a user''s web-browser client because it uses client authentication with client secrets. Requests must come from your integration''s backend, otherwise they''ll be blocked by Canva''s [Cross-Origin Resource Sharing (CORS)](https://developer.mozilla.org/en-US/docs/Web/HTTP/CORS) policy.


        **Generate an access token using an authorization code**


        To generate an access token with an authorization code, you must:


        - Set `grant_type` to `authorization_code`.

        - Provide the `code_verifier` value that you generated when creating the user authorization URL.

        - Provide the authorization code you received after the user authorized the integration.


        **Generate an access token using a refresh token**


        Using the `refresh_token` value from a previous user token request, you can get a new access token with the same or smaller scope as the previous one, but with a refreshed expiry time. You will also receive a new refresh token that you can use to refresh the access token again.


        To refresh an existing access token, you must:


        - Set `grant_type` to `refresh_token`.

        - Provide the `refresh_token` from a previous token request.'
      operationId: exchangeAccessToken
      requestBody:
        content:
          application/x-www-form-urlencoded:
            schema:
              $ref: '#/components/schemas/ExchangeAccessTokenRequest'
        required: true
      responses:
        '200':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ExchangeAccessTokenResponse'
          description: OK
        '400':
          content:
            application/json:
              examples:
                client_id_body_param_multiple_values:
                  $ref: '#/components/examples/ClientIdBodyParamMultipleValues'
                client_id_body_param_blank:
                  $ref: '#/components/examples/ClientIdBodyParamBlank'
                client_secret_body_param_multiple_values:
                  $ref: '#/components/examples/ClientSecretBodyParamMultipleValues'
                client_id_basic_auth_param_blank:
                  $ref: '#/components/examples/ClientIdBasicAuthParamBlank'
                secret_basic_auth_param_blank:
                  $ref: '#/components/examples/SecretBasicAuthParamBlank'
                bad_request_body_too_large:
                  $ref: '#/components/examples/BadRequestBodyTooLarge'
                invalid_refresh_token:
                  $ref: '#/components/examples/InvalidRefreshToken'
                unauthorized_client:
                  $ref: '#/components/examples/UnauthorizedClientError'
                token_exchange_invalid_request:
                  $ref: '#/components/examples/TokenExchangeInvalidRequest'
                token_exchange_invalid_grant:
                  $ref: '#/components/examples/TokenExchangeInvalidGrant'
                token_exchange_unauthorized_client:
                  $ref: '#/components/examples/TokenExchangeUnauthorizedClient'
                token_exchange_unsupported_grant_type:
                  $ref: '#/components/examples/TokenExchangeUnsupportedGrantType'
                token_exchange_invalid_scope:
                  $ref: '#/components/examples/TokenExchangeInvalidScope'
              schema:
                $ref: '#/components/schemas/Error'
          description: Bad Request
        '401':
          content:
            application/json:
              examples:
                client_secret_invalid:
                  $ref: '#/components/examples/ClientSecretInvalid'
                access_token_missing:
                  $ref: '#/components/examples/AccessTokenMissing'
                token_exchange_invalid_client:
                  $ref: '#/components/examples/TokenExchangeInvalidClient'
                token_exchange_unauthorized_user:
                  $ref: '#/components/examples/TokenExchangeUnauthorizedUser'
              schema:
                $ref: '#/components/schemas/Error'
          description: Unauthorized
        '429':
          content:
            application/json:
              examples:
                too_many_token_exchange_requests:
                  $ref: '#/components/examples/TooManyTokenExchangeRequests'
              schema:
                $ref: '#/components/schemas/Error'
          description: Too Many Requests
        default:
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/OauthError'
          description: Error Response
      security:
      - {}
      - basicAuth: []
      tags:
      - oauth
  /v1/oauth/introspect:
    servers:
    - description: Canva Connect API
      url: https://api.canva.com/auth
    - description: Canva Connect API (deprecated)
      url: https://api.canva.com/rest
    post:
      description: 'Introspect an access token to see whether it is valid and active. You can also verify some token properties, such as its claims, scopes, and validity times.


        Requests to this endpoint require authentication with your client ID and client secret, using _one_ of the following methods:


        - **Basic access authentication** (Recommended): For [basic access authentication](https://en.wikipedia.org/wiki/Basic_access_authentication), the `{credentials}` string must be a Base64 encoded value of `{client id}:{client secret}`.

        - **Body parameters**: Provide your integration''s credentials using the `client_id` and `client_secret` body parameters.


        This endpoint can''t be called from a user''s web-browser client because it uses client authentication with client secrets. Requests must come from your integration''s backend, otherwise they''ll be blocked by Canva''s [Cross-Origin Resource Sharing (CORS)](https://developer.mozilla.org/en-US/docs/Web/HTTP/CORS) policy.'
      operationId: introspectToken
      requestBody:
        content:
          application/x-www-form-urlencoded:
            schema:
              $ref: '#/components/schemas/IntrospectTokenRequest'
        required: true
      responses:
        '200':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/IntrospectTokenResponse'
          description: OK
        '400':
          content:
            application/json:
              examples:
                client_id_body_param_multiple_values:
                  $ref: '#/components/examples/ClientIdBodyParamMultipleValues'
                client_id_body_param_blank:
                  $ref: '#/components/examples/ClientIdBodyParamBlank'
                client_secret_body_param_multiple_values:
                  $ref: '#/components/examples/ClientSecretBodyParamMultipleValues'
                client_id_basic_auth_param_blank:
                  $ref: '#/components/examples/ClientIdBasicAuthParamBlank'
                secret_basic_auth_param_blank:
                  $ref: '#/components/examples/SecretBasicAuthParamBlank'
                bad_request_body_too_large:
                  $ref: '#/components/examples/BadRequestBodyTooLarge'
              schema:
                $ref: '#/components/schemas/Error'
          description: Bad Request
        '401':
          content:
            application/json:
              examples:
                client_secret_invalid:
                  $ref: '#/components/examples/ClientSecretInvalid'
                access_token_missing:
                  $ref: '#/components/examples/AccessTokenMissing'
              schema:
                $ref: '#/components/schemas/Error'
          description: Unauthorized
        default:
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/OauthError'
          description: Error Response
      security:
      - {}
      - basicAuth: []
      tags:
      - oauth
  /v1/oauth/revoke:
    servers:
    - description: Canva Connect API
      url: https://api.canva.com/auth
    - description: Canva Connect API (deprecated)
      url: https://api.canva.com/rest
    post:
      description: 'Revoke an access token or a refresh token.


        If you revoke a _refresh token_, be aware that:


        - The refresh token''s lineage is also revoked. This means that access tokens created from that refresh token are also revoked.

        - The user''s consent for your integration is also revoked. This means that the user must go through the OAuth process again to use your integration.


        Requests to this endpoint require authentication with your client ID and client secret, using _one_ of the following methods:


        - **Basic access authentication** (Recommended): For [basic access authentication](https://en.wikipedia.org/wiki/Basic_access_authentication), the `{credentials}` string must be a Base64 encoded value of `{client id}:{client secret}`.

        - **Body parameters**: Provide your integration''s credentials using the `client_id` and `client_secret` body parameters.


        This endpoint can''t be called from a user''s web-browser client because it uses client authentication with client secrets. Requests must come from your integration''s backend, otherwise they''ll be blocked by Canva''s [Cross-Origin Resource Sharing (CORS)](https://developer.mozilla.org/en-US/docs/Web/HTTP/CORS) policy.'
      operationId: revokeTokens
      requestBody:
        content:
          application/x-www-form-urlencoded:
            schema:
              $ref: '#/components/schemas/RevokeTokensRequest'
        required: true
      responses:
        '200':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/RevokeTokensResponse'
          description: OK
        '400':
          content:
            application/json:
              examples:
                client_id_body_param_multiple_values:
                  $ref: '#/components/examples/ClientIdBodyParamMultipleValues'
                client_id_body_param_blank:
                  $ref: '#/components/examples/ClientIdBodyParamBlank'
                client_secret_body_param_multiple_values:
                  $ref: '#/components/examples/ClientSecretBodyParamMultipleValues'
                client_id_basic_auth_param_blank:
                  $ref: '#/components/examples/ClientIdBasicAuthParamBlank'
                secret_basic_auth_param_blank:
                  $ref: '#/components/examples/SecretBasicAuthParamBlank'
                bad_request_body_too_large:
                  $ref: '#/components/examples/BadRequestBodyTooLarge'
                invalid_token:
                  $ref: '#/components/examples/InvalidTokenError'
                invalid_request:
                  $ref: '#/components/examples/InvalidRequestError'
              schema:
                $ref: '#/components/schemas/Error'
          description: Bad Request
        '401':
          content:
            application/json:
              examples:
                client_secret_invalid:
                  $ref: '#/components/examples/ClientSecretInvalid'
                access_token_missing:
                  $ref: '#/components/examples/AccessTokenMissing'
              schema:
                $ref: '#/components/schemas/Error'
          description: Unauthorized
        default:
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/OauthError'
          description: Error Response
      security:
      - {}
      - basicAuth: []
      tags:
      - oauth
components:
  examples:
    ClientIdBasicAuthParamBlank:
      summary: client_id basic auth parameter is blank or empty
      value:
        code: invalid_field
        message: client_id basic auth parameter must not be blank or empty
    InvalidRequestError:
      summary: The request is invalid.
      value:
        code: invalid_request
        message: Invalid request
    ClientIdBodyParamBlank:
      summary: client_id body parameter is blank or empty
      value:
        code: invalid_field
        message: client_id body param must not be blank or empty
    TokenExchangeUnauthorizedUser:
      summary: The user is not authorized.
      value:
        code: unauthorized_user
        message: '{description}'
    TokenExchangeUnauthorizedClient:
      summary: The client is not authorized to use this grant type.
      value:
        code: unauthorized_client
        message: '{description}'
    InvalidRefreshToken:
      summary: The refresh token is invalid.
      value:
        code: invalid_grant
        message: Invalid refresh token
    ClientSecretBodyParamMultipleValues:
      summary: client_secret body parameter has multiple values
      value:
        code: invalid_field
        message: client_secret body param must have a single value
    SecretBasicAuthParamBlank:
      summary: secret basic auth parameter is blank or empty
      value:
        code: invalid_field
        message: secret basic auth parameter must not be blank or empty
    InvalidTokenError:
      summary: The token supplied is neither an access token nor a refresh token.
      value:
        code: bad_request_params
        message: Token is neither an access or refresh token
    BadRequestBodyTooLarge:
      summary: Request body too large
      value:
        code: bad_request_body
        message: Request body too large
    ClientSecretInvalid:
      summary: Client secret is invalid (Unauthorized)
      value:
        code: invalid_access_token
        message: Client secret is invalid for {clientAppId}
    AccessTokenMissing:
      summary: Access token is missing
      value:
        code: invalid_access_token
        message: Access token is missing
    TooManyTokenExchangeRequests:
      summary: Too many token exchange requests.
      value:
        code: too_many_requests
        message: Too many {grantType} requests
    TokenExchangeUnsupportedGrantType:
      summary: The grant type is not supported.
      value:
        code: unsupported_grant_type
        message: '{description}'
    TokenExchangeInvalidRequest:
      summary: The token exchange request is invalid.
      value:
        code: invalid_request
        message: '{description}'
    ClientIdBodyParamMultipleValues:
      summary: client_id body parameter has multiple values
      value:
        code: invalid_field
        message: client_id body param must have a single value
    TokenExchangeInvalidGrant:
      summary: The provided authorization grant is invalid, expired, or revoked.
      value:
        code: invalid_grant
        message: '{description}'
    TokenExchangeInvalidClient:
      summary: The client credentials are invalid.
      value:
        code: invalid_client
        message: '{description}'
    UnauthorizedClientError:
      summary: The client must be authenticated using basic auth or body parameters.
      value:
        code: unauthorized_client
        message: The client must either be authenticated using basic auth or body parameters.
    TokenExchangeInvalidScope:
      summary: The requested scope is invalid, unknown, or malformed.
      value:
        code: invalid_scope
        message: '{description}'
  schemas:
    ExchangeAccessTokenRequest:
      discriminator:
        mapping:
          authorization_code: '#/components/schemas/ExchangeAuthCodeRequest'
          refresh_token: '#/components/schemas/ExchangeRefreshTokenRequest'
        propertyName: grant_type
      oneOf:
      - $ref: '#/components/schemas/ExchangeAuthCodeRequest'
      - $ref: '#/components/schemas/ExchangeRefreshTokenRequest'
      type: object
    ExchangeAccessTokenResponse:
      description: Exchange auth token to access token.
      properties:
        access_token:
          description: The bearer access token to use to authenticate to Canva Connect API endpoints. If requested using a `authorization_code` or `refresh_token`, this allows you to act on behalf of a user.
          example: JagALLazU0i2ld9WW4zTO4kaG0lkvP8Y5sSO206ZwxNF4E1y3xKJKF7TzN17BXTfaNOeY0P88AeRCE6cRF7SJzvf3Sx97rA80sGHtFplFo
          type: string
        refresh_token:
          description: The token that you can use to refresh the access token.
          example: JABix5nolsk9k8n2r0f8nq1gw4zjo40ht6sb4i573wgdzmkwdmiy6muh897hp0bxyab276wtgqkvtob2mg9aidt5d6rcltcbcgs101
          type: string
        token_type:
          description: The token type returned. This is always `Bearer`.
          example: Bearer
          type: string
        expires_in:
          description: The expiry time (in seconds) for the access token.
          example: 14400
          format: int64
          type: integer
        scope:
          description: The [scopes](https://www.canva.dev/docs/connect/appendix/scopes/) that the token has been granted.
          example: asset:read design:meta:read design:permission:read folder:read
          type: string
      required:
      - access_token
      - expires_in
      - refresh_token
      - token_type
      type: object
    Error:
      properties:
        code:
          $ref: '#/components/schemas/ErrorCode'
        message:
          description: A human-readable description of what went wrong.
          type: string
      required:
      - code
      - message
      type: object
    RevokeTokensResponse:
      description: The response on a successful token revocation.
      type: object
    IntrospectTokenResponse:
      description: Introspection result of access or refresh tokens
      properties:
        active:
          description: 'Whether the access token is active.


            If `true`, the access token is valid and active. If `false`, the access token is invalid.

            '
          example: true
          type: boolean
        scope:
          description: The [scopes](https://www.canva.dev/docs/connect/appendix/scopes/) that the token has been granted.
          example: asset:read design:meta:read design:permission:read folder:read
          type: string
        client:
          description: The ID of the client that requested the token.
          example: OC-FAB12-AbCdEf
          type: string
        exp:
          description: The expiration time of the token, as a [Unix timestamp](https://en.wikipedia.org/wiki/Unix_time) in seconds.
          example: 1712216144
          format: int64
          type: integer
        iat:
          description: When the token was issued, as a [Unix timestamp](https://en.wikipedia.org/wiki/Unix_time) in seconds.
          example: 1712201744
          format: int64
          type: integer
        nbf:
          description: The "not before" time of the token, which specifies the time before which the access token most not be accepted, as a [Unix timestamp](https://en.wikipedia.org/wiki/Unix_time) in seconds.
          example: 1712201744
          format: int64
          type: integer
        jti:
          description: A unique ID for the access token.
          example: AbC1d-efgHIJKLMN2oPqrS
          type: string
        sub:
          description: 'The subject of the claim. This is the ID of the Canva user that the access token acts on behalf of.


            This is an obfuscated value, so a single user has a unique ID for each integration. If the same user authorizes another integration, their ID in that other integration is different.

            '
          example: oBCdEF1Gh2i3jkLmno-pq
          type: string
      required:
      - active
      type: object
    ErrorCode:
      description: 'A short string indicating what failed. This field can be used to handle errors programmatically.

        '
      enum:
      - internal_error
      - invalid_field
      - invalid_header_value
      - permission_denied
      - too_many_requests
      - not_found
      - bad_request_body
      - bad_http_method
      - bad_request_params
      - bad_query_params
      - user_role_required
      - endpoint_not_found
      - endpoint_gone
      - unsupported_version
      - invalid_access_token
      - revoked_access_token
      - missing_field
      - missing_scope
      - invalid_grant
      - invalid_request
      - invalid_client
      - unauthorized_client
      - unsupported_grant_type
      - invalid_scope
      - invalid_basic_header
      - invalid_file_format
      - quota_exceeded
      - ai_credit_quota_exceeded
      - ai_credit_quota_cooldown
      - unsupported_content_type
      - request_too_large
      - folder_not_found
      - item_in_multiple_folders
      - asset_not_found
      - max_limit_reached
      - permission_not_found
      - permission_exists
      - unauthorized_user
      - user_not_found
      - user_not_eligible
      - group_not_found
      - app_not_found
      - app_has_non_draft_versions
      - invalid_status_transition
      - translation_validation_failed
      - content_not_found
      - doctype_not_found
      - design_not_found
      - offset_too_large
      - page_not_found
      - design_or_comment_not_found
      - design_or_thread_not_found
      - review_dismissed
      - design_type_not_found
      - team_not_found
      - team_is_default
      - comment_not_found
      - too_many_comments
      - too_many_replies
      - message_too_long
      - thread_not_found
      - reply_not_found
      - design_not_fillable
      - autofill_data_invalid
      - feature_not_available
      - unsupported_design_type
      - design_generation_not_enabled
      - license_required
      - input_unsafe
      - display_name_unavailable
      - user_not_managed
      - saml_team_id_conflict
      - saml_name_id_not_available
      - user_email_unverified
      - user_not_active
      - user_pending_consent
      - account_exists
      type: string
    OauthError:
      properties:
        error:
          $ref: '#/components/schemas/ErrorCode'
        error_description:
          description: A human-readable description of what went wrong.
          type: string
      required:
      - error
      - error_description
      type: object
    RevokeTokensRequest:
      description: Supply an access token or refresh token to have its lineage revoked.
      properties:
        token:
          description: The token to revoke.
          example: agALLazU0i2ld9WW4zTO4kaG0lkvP8Y5sSO206ZwxNF4E1y3xKJKF7TzN17BXTfaNOeY0P88AeRCE6cRF7SJzvf3Sx97rA80sGHtFplFo
          type: string
        client_id:
          description: 'Your integration''s unique ID, for authenticating the request.


            NOTE: We recommend that you use basic access authentication instead of specifying `client_id` and `client_secret` as body parameters.

            '
          example: OC-FAB12-AbCdEf
          type: string
        client_secret:
          description: 'Your integration''s client secret, for authenticating the request. Begins with `cnvca`.


            NOTE: We recommend that you use basic access authentication instead of specifying `client_id` and `client_secret` as body parameters.

            '
          example: cnvcaAbcdefg12345_hijklm6789
          type: string
      required:
      - token
      type: object
    ExchangeAuthCodeRequest:
      properties:
        grant_type:
          description: For exchanging an authorization code for an access token.
          enum:
          - authorization_code
          example: authorization_code
          type: string
        code_verifier:
          description: The `code_verifier` value that you generated when creating the user authorization URL.
          example: i541qdcfkb4htnork0w92lnu43en99ls5a48ittv6udqgiflqon8vusojojakbq4
          type: string
        code:
          description: The authorization code you received after the user authorized the integration.
          example: kp8nnroja7qnx00.opyc1p76rcbyflsxbycjqfp3ub8vzsvltpzwafy9q5l45dn5fxzhe7i7a6mg1i2t8jpsa6sebdeumkzzhicskabgevrxsssec4dvjwfvhq4gs3ugghguar0voiqpfb7axsapiojoter8v3w2s5s3st84jpv2l06h667iw241xngy9c8=vu1tnjp7sz
          type: string
        client_id:
          description: 'Your integration''s unique ID, for authenticating the request.


            NOTE: We recommend that you use basic access authentication instead of specifying `client_id` and `client_secret` as body parameters.

            '
          example: OC-FAB12-AbCdEf
          type: string
        client_secret:
          description: 'Your integration''s client secret, for authenticating the request. Begins with `cnvca`.


            NOTE: We recommend that you use basic access authentication instead of specifying `client_id` and `client_secret` as body parameters.

            '
          example: cnvcaAbcdefg12345_hijklm6789
          type: string
        redirect_uri:
          description: 'Only required if a redirect URL was supplied when you [created the user authorization URL](https://www.canva.dev/docs/connect/authentication/#create-the-authorization-url).


            Must be one of those already specified by the client. If not supplied, the first redirect_uri defined for the client will be used by default.

            '
          example: https://example.com/process-auth
          type: string
      required:
      - code
      - code_verifier
      - grant_type
      type: object
    IntrospectTokenRequest:
      properties:
        token:
          description: The token to introspect.
          example: JagALLazU0i2ld9WW4zTO4kaG0lkvP8Y5sSO206ZwxNF4E1y3xKJKF7TzN17BXTfaNOeY0P88AeRCE6cRF7SJzvf3Sx97rA80sGHtFplFo
          type: string
        client_id:
          description: 'Your integration''s unique ID, for authenticating the request.


            NOTE: We recommend that you use basic access authentication instead of specifying `client_id` and `client_secret` as body parameters.

            '
          example: OC-FAB12-AbCdEf
          type: string
        client_secret:
          description: 'Your integration''s client secret, for authenticating the request. Begins with `cnvca`.


            NOTE: We recommend that you use basic access authentication instead of specifying `client_id` and `client_secret` as body parameters.

            '
          example: cnvcaAbcdefg12345_hijklm6789
          type: string
      required:
      - token
      type: object
    ExchangeRefreshTokenRequest:
      properties:
        grant_type:
          description: For generating an access token using a refresh token.
          enum:
          - refresh_token
          example: refresh_token
          type: string
        client_id:
          description: 'Your integration''s unique ID, for authenticating the request.


            NOTE: We recommend that you use basic access authentication instead of specifying `client_id` and `client_secret` as body parameters.

            '
          example: OC-FAB12-AbCdEf
          type: string
        client_secret:
          description: 'Your integration''s client secret, for authenticating the request. Begins with `cnvca`.


            NOTE: We recommend that you use basic access authentication instead of specifying `client_id` and `client_secret` as body parameters.

            '
          example: cnvcaAbcdefg12345_hijklm6789
          type: string
        refresh_token:
          description: The refresh token to be exchanged. You can copy this value from the successful response received when generating an access token.
          example: JABix5nolsk9k8n2r0f8nq1gw4zjo40ht6sb4i573wgdzmkwdmiy6muh897hp0bxyab276wtgqkvtob2mg9aidt5d6rcltcbcgs101
          type: string
        scope:
          description: 'Optional scope value when refreshing an access token. Separate multiple [scopes](https://www.canva.dev/docs/connect/appendix/scopes/) with a single space between each scope.


            The requested scope cannot include any permissions not already granted, so this parameter allows you to limit the scope when refreshing a token. If omitted, the scope for the token remains unchanged.

            '
          example: design:meta:read
          type: string
      required:
      - grant_type
      - refresh_token
      type: object
  securitySchemes:
    basicAuth:
      scheme: basic
      type: http
    oauthAuthCode:
      flows:
        authorizationCode:
          authorizationUrl: https://www.canva.com/api/oauth/authorize
          scopes:
            design:content:read: View the contents of the user's designs.
            design:meta:read: View the metadata of the user's designs.
            design:content:write: Create designs on the user's behalf.
            folder:read: 'View the metadata and contents of the user''s folders, including their **Projects**

              folder.'
            folder:write: 'Add, move, or remove the user''s folders. It also lets you edit folder metadata,

              such as the folder''s name.'
            folder:permission:write: Set, update, or remove permissions assigned to the user's folders.
            asset:read: View the metadata for the user's assets, such as uploaded images.
            asset:write: Upload, update, or delete assets on the user's behalf.
            comment:read: View the comments on the user's designs, and the associated metadata.
            comment:write: Create comments and replies on the user's designs.
            collaboration:event: Receive webhook notifications about events relevant to the user.
            brandtemplate:meta:read: View the metadata of the brand templates associated with the user's brand.
            brandtemplate:content:read: Read the content of the brand templates associated with the user's brand.
            brandtemplate:content:write: Publish brand templates associated with the user's brand.
            profile:read: Read a user's profile and account information.
            openid: Read user information through Open ID Connect (OIDC).
            profile: Read user profile information through OIDC.
            email: Read user email address through OIDC.
          tokenUrl: https://api.canva.com/rest/v1/oauth/token
      type: oauth2