Canvas

Canvas Authentication Providers API

The Authentication Providers API from Canvas — 5 operation(s) for authentication providers.

GitHub OpenAPI

Operations 9

Each operation below carries the questions people ask an LLM about it and the instructions they give an agent to run it. Generated by API Evangelist overlay

GET /v1/accounts/{account_id}/authentication_providers List an account's login providers · List authentication providers #
Ask an LLM
“Which login methods are configured for a Canvas account?”
“How do I see all the SSO providers set up on an account?”
Tell an agent
List the authentication providers for account {account_id}.
Show every login provider configured on account {account_id}.
POST /v1/accounts/{account_id}/authentication_providers Add a login provider to an account · Add authentication provider #
Ask an LLM
“How do I add SAML single sign-on to an account?”
“Which authentication services can I add, such as LDAP, CAS or OpenID Connect?”
Tell an agent
Add a new authentication provider to account {account_id}.
Set up an SSO login provider on account {account_id}.
GET /v1/accounts/{account_id}/authentication_providers/{id} Get one login provider's configuration · Get authentication provider #
Ask an LLM
“How do I view the settings of one specific authentication provider?”
“What configuration does a single SSO provider on an account have?”
Tell an agent
Get authentication provider {id} on account {account_id}.
Show the configuration of login provider {id} in account {account_id}.
PUT /v1/accounts/{account_id}/authentication_providers/{id} Update a login provider's settings · Update authentication provider #
Ask an LLM
“How do I change the settings of an existing SSO provider?”
“Can I switch an existing provider to a different authentication type?”
Tell an agent
Update authentication provider {id} on account {account_id}.
Change the configuration of login provider {id} in account {account_id}.
DELETE /v1/accounts/{account_id}/authentication_providers/{id} Delete a login provider · Delete authentication provider #
Ask an LLM
“How do I remove an SSO provider from an account?”
“Can a deleted authentication provider be brought back later?”
Tell an agent destructive · confirm first
Delete authentication provider {id} from account {account_id}.
Remove login provider {id} from account {account_id}.
PUT /v1/accounts/{account_id}/authentication_providers/{id}/restore Restore a deleted login provider · Restore a deleted authentication provider #
Ask an LLM
“How do I undo the deletion of an authentication provider?”
“Who is allowed to restore a deleted SSO provider?”
Tell an agent
Restore deleted authentication provider {id} on account {account_id}.
Reactivate login provider {id} that was deleted from account {account_id}.
GET /v1/accounts/{account_id}/sso_settings View an account's SSO settings · Show account auth settings #
Ask an LLM
“What account-level single sign-on settings are currently in effect?”
“How do I check an account's login page and SSO configuration options?”
Tell an agent
Show the SSO settings for account {account_id}.
Get account {account_id}'s current auth settings.
PUT /v1/accounts/{account_id}/sso_settings Change an account's SSO settings · Update account auth settings #
Ask an LLM
“How do I change account-level settings for a mixed SSO setup?”
“Can I update the account's single sign-on settings in one request?”
Tell an agent
Update the SSO settings for account {account_id}.
Change account {account_id}'s auth settings.
POST /v1/accounts/{account_id}/authentication_providers/force_password_reset Force all users to reset passwords · Force password reset #
Ask an LLM
“How do I make every Canvas-login user in an account change their password?”
“Does forcing a password reset affect SSO users?”
Tell an agent
Force a password reset for all Canvas logins on account {account_id}.
Require everyone in account {account_id} to change their password on next login.

Documentation

📖
Documentation
https://canvas.instructure.com/doc/api/
📖
Authentication
https://canvas.instructure.com/doc/api/file.oauth.html
📖
APIReference
https://canvas.instructure.com/doc/api/
📖
RateLimits
https://raw.githubusercontent.com/api-evangelist/canvas/refs/heads/main/rate-limits/canvas-rate-limits.yml

Specifications

⚙
OpenAPI
https://raw.githubusercontent.com/api-evangelist/canvas/refs/heads/main/openapi/canvas-authentication-providers-api-openapi.yml

SDKs

📦
GitHubRepository
https://github.com/instructure/canvas-lms

Other Resources

🔗
Pagination
https://canvas.instructure.com/doc/api/file.pagination.html
🔗
Swagger
https://canvas.instructure.com/doc/api/api-docs.json
🔗
OAuthScopes
https://raw.githubusercontent.com/api-evangelist/canvas/refs/heads/main/scopes/canvas-scopes.yml
🔗
ErrorCatalog
https://raw.githubusercontent.com/api-evangelist/canvas/refs/heads/main/errors/canvas-problem-types.yml
🔗
DataModel
https://raw.githubusercontent.com/api-evangelist/canvas/refs/heads/main/data-model/canvas-data-model.yml

Work with this as data

Every API here is available over the APIs.io API and to AI agents over MCP.

MCP server

One button, every client — Claude, Cursor, VS Code and the rest.

https://apis.io/mcp

Tools for apis

7 MCP tools reach this
  • find_apisBrowse and filter every API in the catalog.
  • get_api_artifactsOne API's artifacts, grouped by type.
  • get_openapiThe primary OpenAPI for this API.
  • find_similar_apisAPIs that look like this one.
  • apis_io_searchSTART HERE — APIs, providers and tags for one query, each with its total.
  • resolveTurn a domain, URL or GitHub org into the provider it belongs to.
  • find_cohortsEvery scored population of providers in the catalog.
All 92 tools →

Call it yourself

curl for this page
This API 
curl "https://apis.io/api/v1/apis/canvas:canvas-authentication-providers-api"
All apis 
curl "https://apis.io/api/v1/apis?limit=25"

Discovery needs no key. Ratings and market analysis are Pro.

Get an API key

Free tier, no form to fill in. Signing in shares your email address with us — we store it to create your key and to recognise you if you sign in with another provider. See our Privacy Policy and Terms.

GitHub Google LinkedIn

A second provider on the same verified email joins the account you already have.

OpenAPI Specification

canvas-authentication-providers-api-openapi.yml Raw ↑ 
openapi: 3.2.0
info:
  title: Canvas LMS REST Authentication Providers API
  version: v1
  summary: The complete Canvas LMS REST API, converted from the Swagger 1.2 documents Instructure publishes under https://canvas.instructure.com/doc/api/.
  description: The Canvas LMS REST API covers courses, assignments, quizzes, grades, users, enrollments, accounts, files, modules, rubrics, submissions, SIS imports, LTI, analytics and account administration.
  contact:
    name: Instructure Canvas
    url: https://canvas.instructure.com/doc/api/
  license:
    name: AGPL-3.0
    url: https://github.com/instructure/canvas-lms/blob/master/LICENSE
servers:
- url: https://canvas.instructure.com/api
  description: Instructure-hosted Canvas (canvas.instructure.com)
- url: https://{canvas_host}/api
  description: Any Canvas instance; Canvas is multi-tenant and self-hostable, so the host is the institution's Canvas domain.
  variables:
    canvas_host:
      default: canvas.instructure.com
      description: Your institution's Canvas hostname, e.g. school.instructure.com
security:
- bearerAuth: []
- oauth2: []
tags:
- name: Authentication Providers
  x-resource: authentication_providers
  externalDocs:
    url: https://canvas.instructure.com/doc/api/authentication_providers.html
paths:
  /v1/accounts/{account_id}/authentication_providers:
    get:
      tags:
      - Authentication Providers
      operationId: list_authentication_providers
      summary: List authentication providers
      description: Returns a paginated list of authentication providers
      parameters:
      - name: account_id
        in: path
        schema:
          type: string
        required: true
        description: ID
      responses:
        '200':
          description: Success
          content:
            application/json:
              schema:
                type: array
                items:
                  $ref: '#/components/schemas/AuthenticationProvider'
      externalDocs:
        url: https://canvas.instructure.com/doc/api/authentication_providers.html
    post:
      tags:
      - Authentication Providers
      operationId: add_authentication_provider
      summary: Add authentication provider
      description: Add external authentication provider(s) for the account.
      parameters:
      - name: account_id
        in: path
        schema:
          type: string
        required: true
        description: ID
      responses:
        '200':
          description: Success
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/AuthenticationProvider'
      externalDocs:
        url: https://canvas.instructure.com/doc/api/authentication_providers.html
  /v1/accounts/{account_id}/authentication_providers/{id}:
    get:
      tags:
      - Authentication Providers
      operationId: get_authentication_provider
      summary: Get authentication provider
      description: Get the specified authentication provider
      parameters:
      - name: account_id
        in: path
        schema:
          type: string
        required: true
        description: ID
      - name: id
        in: path
        schema:
          type: string
        required: true
        description: ID
      responses:
        '200':
          description: Success
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/AuthenticationProvider'
      externalDocs:
        url: https://canvas.instructure.com/doc/api/authentication_providers.html
    put:
      tags:
      - Authentication Providers
      operationId: update_authentication_provider
      summary: Update authentication provider
      description: 'Update an authentication provider using the same options as the

        {api:AuthenticationProvidersController#create Add authentication provider} endpoint.

        You cannot update an existing provider to a new authentication type.'
      parameters:
      - name: account_id
        in: path
        schema:
          type: string
        required: true
        description: ID
      - name: id
        in: path
        schema:
          type: string
        required: true
        description: ID
      responses:
        '200':
          description: Success
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/AuthenticationProvider'
      externalDocs:
        url: https://canvas.instructure.com/doc/api/authentication_providers.html
    delete:
      tags:
      - Authentication Providers
      operationId: delete_authentication_provider
      summary: Delete authentication provider
      description: Delete the config
      parameters:
      - name: account_id
        in: path
        schema:
          type: string
        required: true
        description: ID
      - name: id
        in: path
        schema:
          type: string
        required: true
        description: ID
      responses:
        '200':
          description: Success, no content returned
      externalDocs:
        url: https://canvas.instructure.com/doc/api/authentication_providers.html
  /v1/accounts/{account_id}/authentication_providers/{id}/restore:
    put:
      tags:
      - Authentication Providers
      operationId: restore_deleted_authentication_provider
      summary: Restore a deleted authentication provider
      description: 'Restore an authentication provider back to active that was previously deleted. Only

        available to admins who can manage_authentication_provider for given root account.'
      parameters:
      - name: account_id
        in: path
        schema:
          type: string
        required: true
        description: ID
      - name: id
        in: path
        schema:
          type: string
        required: true
        description: ID
      responses:
        '200':
          description: Success
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/AuthenticationProvider'
      externalDocs:
        url: https://canvas.instructure.com/doc/api/authentication_providers.html
  /v1/accounts/{account_id}/sso_settings:
    get:
      tags:
      - Authentication Providers
      operationId: show_account_auth_settings
      summary: Show account auth settings
      description: 'The way to get the current state of each account level setting

        that''s relevant to Single Sign On configuration


        You can list the current state of each setting with "update_sso_settings"'
      parameters:
      - name: account_id
        in: path
        schema:
          type: string
        required: true
        description: ID
      responses:
        '200':
          description: Success
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/SSOSettings'
      externalDocs:
        url: https://canvas.instructure.com/doc/api/authentication_providers.html
    put:
      tags:
      - Authentication Providers
      operationId: update_account_auth_settings
      summary: Update account auth settings
      description: 'For various cases of mixed SSO configurations, you may need to set some

        configuration at the account level to handle the particulars of your

        setup.


        This endpoint accepts a PUT request to set several possible account

        settings. All setting are optional on each request, any that are not

        provided at all are simply retained as is. Any that provide the key but

        a null-ish value (blank string, null, undefined) will be UN-set.


        You can list the current state of each setting with "show_sso_settings"'
      parameters:
      - name: account_id
        in: path
        schema:
          type: string
        required: true
        description: ID
      responses:
        '200':
          description: Success
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/SSOSettings'
      externalDocs:
        url: https://canvas.instructure.com/doc/api/authentication_providers.html
  /v1/accounts/{account_id}/authentication_providers/force_password_reset:
    post:
      tags:
      - Authentication Providers
      operationId: force_password_reset
      summary: Force password reset
      description: 'Enqueues a job to set the must_reset_password flag on all active Canvas

        login pseudonyms for the account. Affected users will be required to

        change their password on next login. Only available for accounts that have

        Canvas authentication enabled.'
      parameters:
      - name: account_id
        in: path
        schema:
          type: string
        required: true
        description: ID
      responses:
        '200':
          description: Success, no content returned
      externalDocs:
        url: https://canvas.instructure.com/doc/api/authentication_providers.html
components:
  schemas:
    SSOSettings:
      type: object
      properties:
        login_handle_name:
          type: string
          example: Username
          description: The label used for unique login identifiers.
        change_password_url:
          type: string
          example: https://example.com/reset_password
          description: The url to redirect users to for password resets. Leave blank for default Canvas behavior
        auth_discovery_url:
          type: string
          example: https://example.com/which_account
          description: If a discovery url is set, canvas will forward all users to that URL when they need to be authenticated. That page will need to then help the user figure out where they need to go to log in. If no discovery url is configured, the first configuration will be used to attempt to authenticate the user.
        unknown_user_url:
          type: string
          example: https://example.com/register_for_canvas
          description: If an unknown user url is set, Canvas will forward to that url when a service authenticates a user, but that user does not exist in Canvas. The default behavior is to present an error.
        login_help_url:
          type: string
          example: https://example.com/login-help
          description: A login help URL shown as a 'Trouble logging in?' link on the login page and in failed login messages. Falls back to the global setting if not set.
        saml_entity_id:
          type: string
          example: http://example.com/saml2
          description: The SAML Service Provider entity ID Canvas presents to your IdP. May be a URL or a URN. Defaults to <host>/saml2 if not set. Only settable by site admins, and only returned when a SAML provider is configured.
      description: Settings that are applicable across an account's authentication configuration, even if there are multiple individual providers
    AuthenticationProvider:
      type: object
      properties:
        identifier_format:
          type: string
          example: urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress
          description: Valid for SAML providers.
        auth_type:
          type: string
          example: saml
          description: Valid for all providers.
        id:
          type: integer
          example: 1649
          description: Valid for all providers.
        log_out_url:
          type: string
          example: http://example.com/saml1/slo
          description: Valid for SAML providers.
        log_in_url:
          type: string
          example: http://example.com/saml1/sli
          description: Valid for SAML and CAS providers.
        certificate_fingerprint:
          type: string
          example: '111222'
          description: Valid for SAML providers.
        requested_authn_context:
          type: string
          description: Valid for SAML providers.
        auth_host:
          type: string
          example: 127.0.0.1
          description: Valid for LDAP providers.
        auth_filter:
          type: string
          example: filter1
          description: Valid for LDAP providers.
        auth_over_tls:
          type: integer
          description: Valid for LDAP providers.
        auth_base:
          type: string
          description: Valid for LDAP and CAS providers.
        auth_username:
          type: string
          example: username1
          description: Valid for LDAP providers.
        auth_port:
          type: integer
          description: Valid for LDAP providers.
        position:
          type: integer
          example: 1
          description: Valid for all providers.
        idp_entity_id:
          type: string
          example: http://example.com/saml1
          description: Valid for SAML providers.
        login_attribute:
          type: string
          example: nameid
          description: Valid for SAML providers.
        sig_alg:
          type: string
          example: http://www.w3.org/2001/04/xmldsig-more#rsa-sha256
          description: Valid for SAML providers.
        jit_provisioning:
          type: boolean
          description: Just In Time provisioning. Valid for all providers except Canvas (which has the similar in concept self_registration setting).
        federated_attributes:
          type: string
        mfa_required:
          type: boolean
          description: If multi-factor authentication is required when logging in with this authentication provider. The account must not have MFA disabled.
  securitySchemes:
    bearerAuth:
      type: http
      scheme: bearer
      description: 'Canvas OAuth2 access token sent as "Authorization: Bearer <token>". See https://canvas.instructure.com/doc/api/file.oauth.html'
    oauth2:
      type: oauth2
      description: Canvas OAuth2. See https://canvas.instructure.com/doc/api/file.oauth.html and https://canvas.instructure.com/doc/api/file.oauth_endpoints.html
      flows:
        authorizationCode:
          authorizationUrl: https://canvas.instructure.com/login/oauth2/auth
          tokenUrl: https://canvas.instructure.com/login/oauth2/token
          refreshUrl: https://canvas.instructure.com/login/oauth2/token
          scopes: {}
externalDocs:
  description: Canvas LMS REST API Documentation
  url: https://canvas.instructure.com/doc/api/
x-generated-from: https://canvas.instructure.com/doc/api/api-docs.json
x-provenance:
  method: derived
  derived_by: API Evangelist enrichment pipeline (Swagger 1.2 -> OpenAPI 3.1 conversion)
  source: openapi/_original/swagger-1.2/*.json (144 verbatim first-party Swagger 1.2 documents)
  source_url: https://canvas.instructure.com/doc/api/api-docs.json
  fetched: '2026-09-05'
  http_status: 200