Canva Oidc API

openapi: 3.2.0
info:
  contact:
    name: Canva Developer Community
    url: https://community.canva.dev/
  description: API for building integrations with Canva via a REST api
  license:
    name: ©2023 All Rights Reserved
  termsOfService: https://www.canva.com/trust/legal/
  title: Canva Connect OIDC API
  version: 2024-06-18
servers:
- description: Canva Connect API
  url: https://api.canva.com/rest
tags:
- name: OIDC
paths:
  /v1/oidc/jwks:
    servers:
    - description: Canva Connect API
      url: https://api.canva.com/auth
    get:
      description: Gets the JSON Web Key Set (public keys) for OIDC. These keys are used to verify JWTs in OpenID Connect flows.
      operationId: getOidcJwks
      responses:
        '200':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/JsonWebKeySet'
          description: OK
        default:
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'
          description: Error Response
      security: []
      tags:
      - OIDC
      summary: Get oidc jwks
      x-summary-source: derived
  /v1/oidc/userinfo:
    servers:
    - description: Canva Connect API
      url: https://api.canva.com/auth
    get:
      description: 'Fetches the current UserInfo claims for the authorized user. This is the same fields

        returned by a id_token returns during authorization.


        The claims returned depend on the granted scopes: `profile` claims (`name`, `given_name`,

        `family_name`) are only returned when the `profile` scope is granted, and `email` claims

        (`email`, `email_verified`) are only returned when the `email` scope is granted. The

        `openid` scope is always required.'
      operationId: userInfo
      responses:
        '200':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/UserInfoResponse'
          description: OK
        '401':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'
          description: Unauthorized
        default:
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'
          description: Error Response
      security:
      - oauthAuthCode:
        - openid
        - profile
        - email
      - oauthAuthCode:
        - openid
        - profile
      - oauthAuthCode:
        - openid
        - email
      tags:
      - OIDC
      x-rate-limit-per-client-user: 10
      summary: User info
      x-summary-source: derived
components:
  schemas:
    JsonWebKeySet:
      properties:
        keys:
          description: An array of JSON Web Key values. The order of keys has no meaning.
          items:
            $ref: '#/components/schemas/JsonWebKey'
          type: array
      required:
      - keys
      type: object
    ErrorCode:
      description: 'A short string indicating what failed. This field can be used to handle errors programmatically.

        '
      enum:
      - internal_error
      - invalid_field
      - invalid_header_value
      - permission_denied
      - too_many_requests
      - not_found
      - bad_request_body
      - bad_http_method
      - bad_request_params
      - bad_query_params
      - user_role_required
      - endpoint_not_found
      - endpoint_gone
      - unsupported_version
      - invalid_access_token
      - revoked_access_token
      - missing_field
      - missing_scope
      - invalid_grant
      - invalid_request
      - invalid_client
      - unauthorized_client
      - unsupported_grant_type
      - invalid_scope
      - invalid_basic_header
      - invalid_file_format
      - quota_exceeded
      - ai_credit_quota_exceeded
      - ai_credit_quota_cooldown
      - unsupported_content_type
      - request_too_large
      - folder_not_found
      - item_in_multiple_folders
      - asset_not_found
      - max_limit_reached
      - permission_not_found
      - permission_exists
      - unauthorized_user
      - user_not_found
      - user_not_eligible
      - group_not_found
      - app_not_found
      - app_has_non_draft_versions
      - invalid_status_transition
      - translation_validation_failed
      - content_not_found
      - doctype_not_found
      - design_not_found
      - offset_too_large
      - page_not_found
      - design_or_comment_not_found
      - design_or_thread_not_found
      - review_dismissed
      - design_type_not_found
      - team_not_found
      - team_is_default
      - comment_not_found
      - too_many_comments
      - too_many_replies
      - message_too_long
      - thread_not_found
      - reply_not_found
      - design_not_fillable
      - autofill_data_invalid
      - feature_not_available
      - unsupported_design_type
      - design_generation_not_enabled
      - license_required
      - input_unsafe
      - display_name_unavailable
      - user_not_managed
      - saml_team_id_conflict
      - saml_name_id_not_available
      - user_email_unverified
      - user_not_active
      - user_pending_consent
      - account_exists
      type: string
    UserInfoResponse:
      example:
        sub: UAAAAAAAAA
        name: Alice Person
        given_name: Alice
        family_name: Person
        email: alice.person@example.com
        email_verified: true
      properties:
        sub:
          description: Identifier for the End-User at the Issuer.
          type: string
        name:
          description: 'End-User''s full name in displayable form including all name parts, possibly including

            titles and suffixes, ordered according to the End-User''s locale and preferences.'
          type: string
        given_name:
          description: 'Given name(s) or first name(s) of the End-User. Note that in some cultures, people can

            have multiple given names; all can be present, with the names being separated by space

            characters.'
          type: string
        family_name:
          description: 'Surname(s) or last name(s) of the End-User. Note that in some cultures, people can have

            multiple family names or no family name; all can be present, with the names being

            separated by space characters.'
          type: string
        email:
          description: 'End-User''s preferred e-mail address. Its value MUST conform to the RFC 5322 [RFC5322]

            addr-spec syntax. The RP MUST NOT rely upon this value being unique, as discussed in

            Section 5.7.'
          format: email
          type: string
        email_verified:
          description: 'True if the End-User''s e-mail address has been verified; otherwise false. When this

            Claim Value is true, this means that the OP took affirmative steps to ensure that this

            e-mail address was controlled by the End-User at the time the verification was

            performed. The means by which an e-mail address is verified is context specific,

            and dependent upon the trust framework or contractual agreements within which the

            parties are operating.'
          type: boolean
      required:
      - sub
      type: object
    Error:
      properties:
        code:
          $ref: '#/components/schemas/ErrorCode'
        message:
          description: A human-readable description of what went wrong.
          type: string
      required:
      - code
      - message
      type: object
    JsonWebKey:
      description: 'Standard Json Web Key specification following https://www.rfc-editor.org/rfc/rfc7517 and

        https://www.rfc-editor.org/rfc/rfc7518.html.'
      properties:
        alg:
          description: 'The "alg" (algorithm) parameter identifies the algorithm intended for

            use with the key.

            See https://www.rfc-editor.org/rfc/rfc7517#section-4'
          type: string
        kid:
          description: 'The "kid" (key ID) parameter is used to match a specific key.  This

            is used, for instance, to choose among a set of keys within a JWK Set

            during key rollover. When "kid" values are used within a JWK Set,

            different keys within the JWK Set SHOULD use distinct "kid" values.

            The "kid" value is a case-sensitive string.

            See https://www.rfc-editor.org/rfc/rfc7517#section-4'
          type: string
        kty:
          description: 'The "kty" (key type) parameter identifies the cryptographic algorithm

            family used with the key, such as "RSA" or "EC". The "kty" value is a

            case-sensitive string. At the moment, only "RSA" is supported.

            See https://www.rfc-editor.org/rfc/rfc7517#section-4'
          type: string
        n:
          description: "The \"n\" (modulus) parameter contains the modulus value for the RSA\n   public key.  It is represented as a Base64urlUInt-encoded value.\nSee https://www.rfc-editor.org/rfc/rfc7518.html#section-6.3"
          type: string
        e:
          description: "The \"e\" (exponent) parameter contains the exponent value for the RSA\n   public key.  It is represented as a Base64urlUInt-encoded value.\nSee https://www.rfc-editor.org/rfc/rfc7518.html#section-6.3"
          type: string
        use:
          description: 'The "use" (public key use) parameter identifies the intended use of

            the public key. The "use" parameter is employed to indicate whether

            a public key is used for encrypting data or verifying the signature

            on data. Values are commonly "sig" (signature) or "enc" (encryption).

            See https://www.rfc-editor.org/rfc/rfc7517#section-4'
          type: string
      required:
      - e
      - kid
      - kty
      - n
      type: object
  securitySchemes:
    basicAuth:
      scheme: basic
      type: http
    oauthAuthCode:
      flows:
        authorizationCode:
          authorizationUrl: https://www.canva.com/api/oauth/authorize
          scopes:
            design:content:read: View the contents of the user's designs.
            design:meta:read: View the metadata of the user's designs.
            design:content:write: Create designs on the user's behalf.
            folder:read: 'View the metadata and contents of the user''s folders, including their **Projects**

              folder.'
            folder:write: 'Add, move, or remove the user''s folders. It also lets you edit folder metadata,

              such as the folder''s name.'
            folder:permission:write: Set, update, or remove permissions assigned to the user's folders.
            asset:read: View the metadata for the user's assets, such as uploaded images.
            asset:write: Upload, update, or delete assets on the user's behalf.
            comment:read: View the comments on the user's designs, and the associated metadata.
            comment:write: Create comments and replies on the user's designs.
            collaboration:event: Receive webhook notifications about events relevant to the user.
            brandtemplate:meta:read: View the metadata of the brand templates associated with the user's brand.
            brandtemplate:content:read: Read the content of the brand templates associated with the user's brand.
            brandtemplate:content:write: Publish brand templates associated with the user's brand.
            profile:read: Read a user's profile and account information.
            openid: Read user information through Open ID Connect (OIDC).
            profile: Read user profile information through OIDC.
            email: Read user email address through OIDC.
          tokenUrl: https://api.canva.com/rest/v1/oauth/token
      type: oauth2