Every API here is available over the APIs.io API and to AI agents over MCP.
MCP server
One button, every client — Claude, Cursor, VS Code and the rest.
https://apis.io/mcp
Tools for apis
7 MCP tools reach this
find_apisBrowse and filter every API in the catalog.get_api_artifactsOne API's artifacts, grouped by type.get_openapiThe primary OpenAPI for this API.find_similar_apisAPIs that look like this one.apis_io_searchSTART HERE — APIs, providers and tags for one query, each with its total.resolveTurn a domain, URL or GitHub org into the provider it belongs to.find_cohortsEvery scored population of providers in the catalog.
All 92 tools →
Call it yourself
curl for this page
This API
curl "https://apis.io/api/v1/apis/canvas-developer-keys-api"
All apis
curl "https://apis.io/api/v1/apis?limit=25"
Discovery needs no key. Ratings and market analysis are Pro.
Get an API key
Free tier, no form to fill in. Signing in shares your email address with us — we
store it to create your key and to recognise you if you sign in with another
provider. See our Privacy Policy and
Terms.
A second provider on the same verified email joins the account you already have.
openapi: 3.2.0
info:
title: Canvas LMS REST Developer Keys API
version: v1
summary: The complete Canvas LMS REST API, converted from the Swagger 1.2 documents Instructure publishes under https://canvas.instructure.com/doc/api/.
description: The Canvas LMS REST API covers courses, assignments, quizzes, grades, users, enrollments, accounts, files, modules, rubrics, submissions, SIS imports, LTI, analytics and account administration.
contact:
name: Instructure Canvas
url: https://canvas.instructure.com/doc/api/
license:
name: AGPL-3.0
url: https://github.com/instructure/canvas-lms/blob/master/LICENSE
servers:
- url: https://canvas.instructure.com/api
description: Instructure-hosted Canvas (canvas.instructure.com)
- url: https://{canvas_host}/api
description: Any Canvas instance; Canvas is multi-tenant and self-hostable, so the host is the institution's Canvas domain.
variables:
canvas_host:
default: canvas.instructure.com
description: Your institution's Canvas hostname, e.g. school.instructure.com
security:
- bearerAuth: []
- oauth2: []
tags:
- name: Developer Keys
x-resource: developer_keys
externalDocs:
url: https://canvas.instructure.com/doc/api/developer_keys.html
paths:
/v1/accounts/{account_id}/developer_keys:
get:
tags:
- Developer Keys
operationId: list_developer_keys
summary: List Developer Keys
description: List all developer keys created in the current account.
parameters:
- name: account_id
in: path
schema:
type: string
required: true
description: ID
- name: inherited
in: query
schema:
type: boolean
required: false
description: 'Defaults to false. If true, lists keys inherited from
Site Admin (and consortium parent account, if applicable).'
responses:
'200':
description: Success
content:
application/json:
schema:
type: array
items:
$ref: '#/components/schemas/DeveloperKey'
externalDocs:
url: https://canvas.instructure.com/doc/api/developer_keys.html
post:
tags:
- Developer Keys
operationId: create_developer_key
summary: Create a Developer Key
description: 'Create a new Canvas API key. Creating an LTI 1.3 registration is not supported here and
should be done via the LTI Registration API.'
parameters:
- name: account_id
in: path
schema:
type: string
required: true
description: ID
requestBody:
required: false
content:
application/json:
schema:
type: object
properties:
developer_key:
type: object
additionalProperties: true
description: no description
developer_key[auto_expire_tokens]:
type: boolean
description: 'Defaults to false. If true, access tokens
generated by this key will expire after 1 hour.'
developer_key[email]:
type: string
description: Contact email for the key.
developer_key[icon_url]:
type: string
description: URL for a small icon to display in key list.
developer_key[name]:
type: string
description: The display name.
developer_key[notes]:
type: string
description: User-provided notes about the key.
developer_key[redirect_uri]:
type: string
description: Deprecated in favor of redirect_uris. Do not use.
developer_key[redirect_uris]:
type: array
items: {}
description: 'List of URLs used during OAuth2 flow to validate
given redirect URI.'
developer_key[vendor_code]:
type: string
description: User-specified code representing the vendor that uses the key.
developer_key[visible]:
type: boolean
description: Defaults to true. If false, key will not be visible in the UI.
developer_key[test_cluster_only]:
type: boolean
description: 'Defaults to false. If true, key is only usable in
non-production environments (test, beta). Avoids problems with beta refresh.'
developer_key[client_credentials_audience]:
type: string
description: 'Used in OAuth2 client credentials flow to
specify the audience for the access token.'
developer_key[allowed_audiences]:
type: array
items: {}
description: 'The registered audiences this key may request tokens
for. Each value must appear in the environment''s configured list of registered audiences.'
developer_key[authorized_flows]:
type: array
items: {}
description: 'Additional OAuth2 flows this key is authorized to
use. Allowed values: token_exchange, service_user_client_credentials.'
developer_key[client_type]:
type: string
description: 'Whether this is a confidential or public client.
Public clients (SPAs, mobile apps) require PKCE in the authorization code flow, cannot use the
client_credentials flow, and receive short-lived access tokens with rotating refresh tokens.
Allowed values: confidential (default), public.
Not applicable to LTI keys. Immutable after creation.'
developer_key[scopes]:
type: array
items: {}
description: List of API endpoints key is allowed to access.
developer_key[require_scopes]:
type: boolean
description: If true, then token requests with this key must include scopes.
developer_key[allow_includes]:
type: boolean
description: 'If true, allows `includes` parameters in API requests that
match the scopes of this key.'
required:
- developer_key
application/x-www-form-urlencoded:
schema:
type: object
properties:
developer_key:
type: object
additionalProperties: true
description: no description
developer_key[auto_expire_tokens]:
type: boolean
description: 'Defaults to false. If true, access tokens
generated by this key will expire after 1 hour.'
developer_key[email]:
type: string
description: Contact email for the key.
developer_key[icon_url]:
type: string
description: URL for a small icon to display in key list.
developer_key[name]:
type: string
description: The display name.
developer_key[notes]:
type: string
description: User-provided notes about the key.
developer_key[redirect_uri]:
type: string
description: Deprecated in favor of redirect_uris. Do not use.
developer_key[redirect_uris]:
type: array
items: {}
description: 'List of URLs used during OAuth2 flow to validate
given redirect URI.'
developer_key[vendor_code]:
type: string
description: User-specified code representing the vendor that uses the key.
developer_key[visible]:
type: boolean
description: Defaults to true. If false, key will not be visible in the UI.
developer_key[test_cluster_only]:
type: boolean
description: 'Defaults to false. If true, key is only usable in
non-production environments (test, beta). Avoids problems with beta refresh.'
developer_key[client_credentials_audience]:
type: string
description: 'Used in OAuth2 client credentials flow to
specify the audience for the access token.'
developer_key[allowed_audiences]:
type: array
items: {}
description: 'The registered audiences this key may request tokens
for. Each value must appear in the environment''s configured list of registered audiences.'
developer_key[authorized_flows]:
type: array
items: {}
description: 'Additional OAuth2 flows this key is authorized to
use. Allowed values: token_exchange, service_user_client_credentials.'
developer_key[client_type]:
type: string
description: 'Whether this is a confidential or public client.
Public clients (SPAs, mobile apps) require PKCE in the authorization code flow, cannot use the
client_credentials flow, and receive short-lived access tokens with rotating refresh tokens.
Allowed values: confidential (default), public.
Not applicable to LTI keys. Immutable after creation.'
developer_key[scopes]:
type: array
items: {}
description: List of API endpoints key is allowed to access.
developer_key[require_scopes]:
type: boolean
description: If true, then token requests with this key must include scopes.
developer_key[allow_includes]:
type: boolean
description: 'If true, allows `includes` parameters in API requests that
match the scopes of this key.'
required:
- developer_key
responses:
'200':
description: Success
content:
application/json:
schema:
$ref: '#/components/schemas/DeveloperKey'
externalDocs:
url: https://canvas.instructure.com/doc/api/developer_keys.html
/v1/developer_keys/{id}:
put:
tags:
- Developer Keys
operationId: update_developer_key
summary: Update a Developer Key
description: 'Update an existing Canvas API key. Updating an LTI 1.3 registration is not supported here and should
be done via the LTI Registration API.'
parameters:
- name: id
in: path
schema:
type: string
required: true
description: ID
requestBody:
required: false
content:
application/json:
schema:
type: object
properties:
developer_key:
type: object
additionalProperties: true
description: no description
developer_key[auto_expire_tokens]:
type: boolean
description: 'Defaults to false. If true, access tokens
generated by this key will expire after 1 hour.'
developer_key[email]:
type: string
description: Contact email for the key.
developer_key[icon_url]:
type: string
description: URL for a small icon to display in key list.
developer_key[name]:
type: string
description: The display name.
developer_key[notes]:
type: string
description: User-provided notes about the key.
developer_key[redirect_uri]:
type: string
description: Deprecated in favor of redirect_uris. Do not use.
developer_key[redirect_uris]:
type: array
items: {}
description: 'List of URLs used during OAuth2 flow to validate
given redirect URI.'
developer_key[vendor_code]:
type: string
description: User-specified code representing the vendor that uses the key.
developer_key[visible]:
type: boolean
description: Defaults to true. If false, key will not be visible in the UI.
developer_key[test_cluster_only]:
type: boolean
description: 'Defaults to false. If true, key is only usable in
non-production environments (test, beta). Avoids problems with beta refresh.'
developer_key[client_credentials_audience]:
type: string
description: 'Used in OAuth2 client credentials flow to
specify the audience for the access token.'
developer_key[allowed_audiences]:
type: array
items: {}
description: 'The registered audiences this key may request tokens
for. Each value must appear in the environment''s configured list of registered audiences.'
developer_key[authorized_flows]:
type: array
items: {}
description: 'Additional OAuth2 flows this key is authorized to
use. Allowed values: token_exchange, service_user_client_credentials.'
developer_key[scopes]:
type: array
items: {}
description: List of API endpoints key is allowed to access.
developer_key[require_scopes]:
type: boolean
description: If true, then token requests with this key must include scopes.
developer_key[allow_includes]:
type: boolean
description: 'If true, allows `includes` parameters in API requests that
match the scopes of this key.'
required:
- developer_key
application/x-www-form-urlencoded:
schema:
type: object
properties:
developer_key:
type: object
additionalProperties: true
description: no description
developer_key[auto_expire_tokens]:
type: boolean
description: 'Defaults to false. If true, access tokens
generated by this key will expire after 1 hour.'
developer_key[email]:
type: string
description: Contact email for the key.
developer_key[icon_url]:
type: string
description: URL for a small icon to display in key list.
developer_key[name]:
type: string
description: The display name.
developer_key[notes]:
type: string
description: User-provided notes about the key.
developer_key[redirect_uri]:
type: string
description: Deprecated in favor of redirect_uris. Do not use.
developer_key[redirect_uris]:
type: array
items: {}
description: 'List of URLs used during OAuth2 flow to validate
given redirect URI.'
developer_key[vendor_code]:
type: string
description: User-specified code representing the vendor that uses the key.
developer_key[visible]:
type: boolean
description: Defaults to true. If false, key will not be visible in the UI.
developer_key[test_cluster_only]:
type: boolean
description: 'Defaults to false. If true, key is only usable in
non-production environments (test, beta). Avoids problems with beta refresh.'
developer_key[client_credentials_audience]:
type: string
description: 'Used in OAuth2 client credentials flow to
specify the audience for the access token.'
developer_key[allowed_audiences]:
type: array
items: {}
description: 'The registered audiences this key may request tokens
for. Each value must appear in the environment''s configured list of registered audiences.'
developer_key[authorized_flows]:
type: array
items: {}
description: 'Additional OAuth2 flows this key is authorized to
use. Allowed values: token_exchange, service_user_client_credentials.'
developer_key[scopes]:
type: array
items: {}
description: List of API endpoints key is allowed to access.
developer_key[require_scopes]:
type: boolean
description: If true, then token requests with this key must include scopes.
developer_key[allow_includes]:
type: boolean
description: 'If true, allows `includes` parameters in API requests that
match the scopes of this key.'
required:
- developer_key
responses:
'200':
description: Success
content:
application/json:
schema:
$ref: '#/components/schemas/DeveloperKey'
externalDocs:
url: https://canvas.instructure.com/doc/api/developer_keys.html
delete:
tags:
- Developer Keys
operationId: delete_developer_key
summary: Delete a Developer Key
description: Delete an existing Canvas API key. Deleting an LTI 1.3 registration should be done via the LTI Registration API.
parameters:
- name: id
in: path
schema:
type: string
required: true
description: ID
responses:
'200':
description: Success
content:
application/json:
schema:
$ref: '#/components/schemas/DeveloperKey'
externalDocs:
url: https://canvas.instructure.com/doc/api/developer_keys.html
/v1/developer_keys/{id}/regenerate_secret:
post:
tags:
- Developer Keys
operationId: regenerate_developer_key_secret
summary: Regenerate Developer Key Secret
description: 'Regenerate the secret (api_key) for an existing Canvas API key. This invalidates
the existing secret. Any applications using the old secret will stop working.
Regenerating a secret for an LTI key is not supported.
This endpoint requires the developer_key_regenerate_secret feature flag to be enabled.
This feature flag can only be turned on by Site Admins'
parameters:
- name: id
in: path
schema:
type: string
required: true
description: ID
responses:
'200':
description: Success
content:
application/json:
schema:
$ref: '#/components/schemas/DeveloperKey'
externalDocs:
url: https://canvas.instructure.com/doc/api/developer_keys.html
components:
schemas:
DeveloperKey:
type: object
properties:
id:
type: integer
example: 1
description: The Canvas ID of the DeveloperKey object
name:
type: string
example: Test Key
description: The display name
created_at:
type: string
format: date-time
example: '2025-05-30T17:09:18Z'
description: Timestamp of the key's creation
updated_at:
type: string
format: date-time
example: '2025-05-30T17:09:18Z'
description: Timestamp of the key's last update
workflow_state:
type: string
example: active
description: The state of the key
enum:
- active
- deleted
is_lti_key:
type: boolean
example: false
description: True if key represents an LTI 1.3 Registration. False for Canvas API keys
email:
type: string
example: test@example.com
description: Contact email configured for key
icon_url:
type: string
example: https://example.com/icon.png
description: URL for a small icon to display in key list
notes:
type: string
example: this key is for testing
description: User-provided notes about key
vendor_code:
type: string
example: Google
description: User-specified code representing the vendor that uses the key
account_name:
type: string
example: Test Account
description: The name of the account that owns the key
visible:
type: boolean
example: true
description: True for all keys except Site Admin-level keys, which default to false. Controls visibility in the Inherited tab.
scopes:
type: array
items:
type: string
example:
- url:GET|/api/v1/accounts
description: List of API endpoints key is allowed to access (API keys), or LTI 1.3 scopes (LTI keys)
redirect_uri:
type: string
example: 'no'
description: Deprecated in favor of redirect_uris. Do not use.
redirect_uris:
type: array
items:
type: string
example:
- https://mytool.com/oauth2/redirect
- https://mytool.com/1_3/launch
description: List of URLs used during OAuth2 flow to validate given redirect URI (API keys), or to redirect to after login (LTI keys)
all_redirect_uris:
type: array
items:
type: object
additionalProperties: true
example:
- redirect_uri: https://mytool.com/redirect
last_used_at: '2024-01-15T12:00:00Z'
workflow_state: active
description: All redirect URIs associated with the key, including any that have been automatically deactivated due to inactivity, along with their last-used timestamp and workflow_state (one of 'active' or 'inactive')
access_token_count:
type: integer
example: '42'
description: (API keys only) The number of active access tokens associated with the key
last_used_at:
type: string
format: date-time
example: '2025-05-30T17:09:18Z'
description: (API keys only) The last time an access token for this key was used in an API request
test_cluster_only:
type: boolean
example: false
description: (API keys only) If true, key is only usable in non-production environments (test, beta). Avoids problems with beta refresh.
allow_includes:
type: boolean
example: true
description: (API keys only) If true, allows `includes` parameters in API requests that match the scopes of this key
require_scopes:
type: boolean
example: false
description: (API keys only) If true, then token requests with this key must include scopes
client_credentials_audience:
type: string
example: external
description: (API keys only) Used in OAuth2 client credentials flow to specify the audience for the access token
allowed_audiences:
type: array
items:
type: string
example:
- cedar-api-production.us-east-1.temp.prod.inseng.io
description: (API keys only) The registered audiences this key may request tokens for. Each value must appear in the environment's configured list of registered audiences.
authorized_flows:
type: array
items:
type: string
example:
- token_exchange
description: '(API keys only) Additional OAuth2 flows this key is authorized to use. Allowed values: token_exchange, service_user_client_credentials.'
client_type:
type: string
example: confidential
description: '(API keys only) Whether this is a confidential or public client. Public clients (SPAs, mobile apps) require PKCE, cannot use client_credentials, and receive short-lived rotating tokens. Allowed values: confidential, public. Defaults to confidential. Immutable after creation.'
api_key:
type: string
example: sd45fg64....
description: (API keys only) The client secret used in the OAuth authorization_code flow.
tool_configuration:
type: string
example:
type: Lti::ToolConfiguration
description: (LTI keys only) The Canvas-style tool configuration for this key.
public_jwk:
type: object
additionalProperties: true
example:
e: AQAB
etc: etc
description: (LTI keys only) The tool's public JWK in JSON format. Discouraged in favor of a url hosting a JWK set.
public_jwk_url:
type: string
example: https://mytool.com/1_3/jwks
description: (LTI keys only) The tool-hosted URL containing its public JWK keyset. Canvas may cache JWKs up to 5 minutes.
lti_registration:
type: object
additionalProperties: true
example:
type: TODO Lti::IMS::Registration
description: (LTI keys only) The LTI IMS Registration object for this key, if key was created via Dynamic Registration.
is_lti_registration:
type: boolean
example: false
description: (LTI keys only) Returns true if key was created via Dynamic Registration.
user_name:
type: string
example: ''
description: Unused.
user_id:
type: string
example: ''
description: Unused.
unified_tool_id:
type: string
example: 6ba7b810-9dad-11d1-80b4-00c04fd430c8
description: Correlates an API key to a product configuration.
description: a Canvas API key (or LTI 1.3 registration)
securitySchemes:
bearerAuth:
type: http
scheme: bearer
description: 'Canvas OAuth2 access token sent as "Authorization: Bearer <token>". See https://canvas.instructure.com/doc/api/file.oauth.html'
oauth2:
type: oauth2
description: Canvas OAuth2. See https://canvas.instructure.com/doc/api/file.oauth.html and https://canvas.instructure.com/doc/api/file.oauth_endpoints.html
flows:
authorizationCode:
authorizationUrl: https://canvas.instructure.com/login/oauth2/auth
tokenUrl: https://canvas.instructure.com/login/oauth2/token
refreshUrl: https://canvas.instructure.com/login/oauth2/token
scopes: {}
externalDocs:
description: Canvas LMS REST API Documentation
url: https://canvas.instructure.com/doc/api/
x-generated-from: https://canvas.instructure.com/doc/api/api-docs.json
x-provenance:
method: derived
derived_by: API Evangelist enrichment pipeline (Swagger 1.2 -> OpenAPI 3.1 conversion)
source: openapi/_original/swagger-1.2/*.json (144 verbatim first-party Swagger 1.2 documents)
source_url: https://canvas.instructure.com/doc/api/api-docs.json
fetched: '2026-09-05'
http_status: 200