{ "meta": { "attribution": "Anchor Terminal (https://www.anchorterminal.com)", "attributionRequired": true, "credit": "CC BY 4.0, credit Anchor Terminal and link the page or API address you took it from (https://www.anchorterminal.com/terms/#data)", "docs": "https://www.anchorterminal.com/docs/", "generatedAt": "2026-11-04", "license": "CC-BY-4.0", "method": "https://www.anchorterminal.com/benchmark/", "methodology": "0.7", "openapi": "https://www.anchorterminal.com/openapi.json", "preview": false, "run": "2026-10-01", "runLabel": "October 2026 research run", "terms": "https://www.anchorterminal.com/terms/#data" }, "tool": { "slug": "canvas-lms", "name": "Instructure Canvas", "vendor": "Instructure", "vendorUrl": "https://www.instructure.com", "kind": "http-api", "category": "learning", "summary": "Canvas is Instructure's learning management system for schools and universities. Its REST and GraphQL APIs read and change courses, assignments, quizzes, submissions and grades on an institution's Canvas domain, with OAuth2 developer keys its administrators issue and scope.", "url": "https://www.anchorterminal.com/tools/canvas-lms", "markdownUrl": "https://www.anchorterminal.com/tools/canvas-lms.md", "slimMarkdownUrl": "https://www.anchorterminal.com/tools/canvas-lms.min.md", "jsonUrl": "https://www.anchorterminal.com/api/v1/tools/canvas-lms.json", "dns": "canvas-lms.grade.anchorterminal.com", "repo": "https://github.com/instructure/canvas-lms", "license": "AGPL-3.0 (Canvas LMS source); hosted service proprietary", "transports": [ "http" ], "remoteUrl": "https://\u003cinstitution\u003e.instructure.com/api/v1", "packages": [], "auth": "oauth", "authNotes": "OAuth2 against the institution's Canvas domain. A developer key (client ID and secret) is created by a root account administrator, or by Instructure as a global key an administrator enables, and can be scoped to `url:\u003cverb\u003e|\u003cpath\u003e` endpoints; tokens for keys issued since October 2015 expire after 1 hour and are renewed with a refresh token. A person can also generate a manual access token in their profile for testing, and the API policy forbids asking other users to paste such tokens into an app. Tokens go in the Authorization header; passing `access_token` as a query parameter is supported but discouraged (https://developerdocs.instructure.com/services/canvas/oauth2/file.oauth.md).", "pricing": "paid", "pricingNotes": "No public price. Canvas is sold to institutions by contract through Instructure's sales team, with tiers compared on the Canvas tiers page. The free Canvas Lite account for individual educators (terms effective 30 September 2026) is limited to 500MB, five published courses and 50 students a course, and its terms say it does not include API token access (https://www.instructure.com/policies/canvas-lite-terms-conditions).", "priceSummary": "Paid", "where": "hosted", "x402": { "level": "no", "evidence": "No x402, MPP or L402 in the Canvas API docs, the API policy or the OAuth2 guide (checked 2026-11-03).", "endpoints": [] }, "toolCount": 0, "popularity": { "githubStars": null, "npmWeekly": null, "pypiWeekly": null, "asOf": "2026-11-03" }, "docsUrl": "https://developerdocs.instructure.com/services/canvas", "llmsTxt": "https://developerdocs.instructure.com/llms.txt", "capabilities": [ "learning.lms", "learning.courses", "learning.quiz", "learning.progress" ], "tags": [ "hosted", "official", "oauth", "open-source", "paid", "sales-led", "llms-txt", "graphql", "status-page", "security-txt", "bug-bounty" ], "lastRelease": "2026-10-27", "graded": true, "anchor": { "graded": true, "score": 59.5, "grade": "C", "agentReady": false, "rank": 622, "ranked": true, "rankOf": 1349, "categoryRank": 3, "methodology": "0.7", "run": "2026-10-01", "scores": { "ergonomics": 63, "maintenance": 72, "payments": 0, "reliability": 63, "schema": 77, "security": 61, "transparency": 82 }, "pending": [ "performance", "tasks" ], "breakdown": [ { "key": "reliability", "name": "Reliability", "weight": 16, "effectiveWeight": 20, "score": 63, "points": 12.6, "reason": "Read with the hosted lines on the hosted Canvas API. Statuspage at status.instructure.com with components and history (20). From 24 August to 30 October 2026 the feed lists 25 entries, most of them slow pages or errors for some users lasting under an hour, and four of an hour or more, MFA SMS delivery (2 hours 12 minutes, 24 August), a Portland-region heavy-load outage (5 hours 17 minutes, 31 August), a login failure for some users (1 hour 46 minutes, 15 October) and Canvas Data 2 errors (1 hour 48 minutes, 21 October). Each affected a region or a subset rather than the API for everyone, read as one major outage with many minor ones (10). Throttling is documented as a cost-based quota with headers but no bucket size or refill rate (8 of 15). A 429 is documented with \"retry later\", no Retry-After or backoff numbers and no idempotency keys for writes (7 of 15). The trust centre states 99.9 per cent annual uptime; contract SLAs sit behind the customer portal (8 of 10). The REST API is generally available (10). 20 + 10 + 8 + 7 + 8 + 10 = 63.", "checked": "2026-11-03" }, { "key": "performance", "name": "Performance", "weight": 10, "effectiveWeight": 0, "pending": true, "points": 0, "reason": "Pending. Latency is measured per call by our probes, which haven't run yet, so this run doesn't score it. Its weight is shared across the assessed categories until the first probe window closes." }, { "key": "schema", "name": "Schema \u0026 documentation", "weight": 13, "effectiveWeight": 16.25, "score": 77, "points": 12.51, "reason": "An OpenAPI 3.0 file is generated from the source with `rake doc:openapi`, and the reference is generated the same way, but no hosted copy of the file was found, so an agent has to build it from a repository whose public mirror ended in May 2026 (15 of 25). llms.txt on developerdocs.instructure.com indexes the Canvas resources and basics (10). Each resource page states what the endpoint does and its parameters, with little when-not-to-use guidance (16 of 20). Parameters are typed with allowed values and required flags in the resource pages (12 of 15). Request examples per endpoint, but no central error page, and the throttling page itself gives the status as \"429 Forbidden (Rate Limit Exceeded)\" (9 of 15). A change log dated by announcement and a written 90-day deprecation policy (15). 15 + 10 + 16 + 12 + 9 + 15 = 77.", "checked": "2026-11-03" }, { "key": "ergonomics", "name": "Agent ergonomics", "weight": 13, "effectiveWeight": 16.25, "score": 63, "points": 10.24, "reason": "include[] parameters and per_page size REST responses, and GraphQL selects fields (22 of 25). Link-header paging on every list, with filters such as enrollment_type and state on courses (20). Error bodies are a JSON errors array, documented per endpoint rather than centrally, and 401 with WWW-Authenticate for expired tokens is explained (10 of 20). No idempotency keys; reads are safe to repeat and writes are not addressed (5 of 20). Few required parameters per call, but no official REST SDK (community libraries only) and the official client is the DAP CLI for data exports (6 of 15). 22 + 20 + 10 + 5 + 6 = 63.", "checked": "2026-11-03" }, { "key": "security", "name": "Security \u0026 auth", "weight": 14, "effectiveWeight": 17.5, "score": 61, "points": 10.68, "reason": "OAuth2 with developer keys scoped to `url:\u003cverb\u003e|\u003cpath\u003e` endpoints, 1-hour tokens, refresh tokens, revocation on logout and replace_tokens, but `access_token` as a query parameter is a documented if discouraged option, so 30 less 10 (20 of 30). Scoped keys can be limited to GET endpoints and administrators grant and revoke scopes; masquerading needs a separate permission; no confirmation step for destructive calls (14 of 20). The API returns student submissions, discussion posts and messages with no guidance on treating them as untrusted (5 of 15). Administrators control keys and tokens, and Canvas keeps authentication and course audit logs, but per-call API visibility for a key was not confirmed (6 of 15). security.txt valid to 1 January 2027, a Bugcrowd disclosure form, a bounty programme joined on request, SOC and other reports behind the customer trust portal (16 of 20). 20 + 14 + 5 + 6 + 16 = 61.", "checked": "2026-11-03" }, { "key": "payments", "name": "Payments \u0026 pricing", "weight": 10, "effectiveWeight": 12.5, "score": 0, "points": 0, "reason": "Read with the hosted rubric. No x402, MPP or L402 (0). No price published; Canvas is sold by contract, and the tiers page compares access levels without prices (0). The only free account, Canvas Lite, excludes API token access per its terms of 30 September 2026, so there is no free tier for the API (0). A developer key or OAuth grant needs an institution's administrator (0). 0 + 0 + 0 + 0 = 0.", "checked": "2026-11-03" }, { "key": "tasks", "name": "Task success", "weight": 10, "effectiveWeight": 0, "pending": true, "points": 0, "reason": "Pending. Task success needs the category task suites run through each tool, which haven't run yet, so this run doesn't score it. Its weight is shared across the assessed categories until then. A data provider's data-quality score is published on its listing now and becomes half of this category when it's scored." }, { "key": "maintenance", "name": "Maintenance \u0026 community", "weight": 7, "effectiveWeight": 8.75, "score": 72, "points": 6.3, "reason": "Read for a closed hosted service. Change log entries announced 27 October 2026 and scheduled through 9 November (30). Entries on 2, 23 and 28 September and 9 and 27 October 2026, with deploys every two weeks (20). A dated community change log, community forums and Instructure support; replies on the public repository could not be read (12 of 15). No official REST SDK; the DAP client library for data exports is current on PyPI per the change log (6 of 15). The public canvas-lms mirror's master feed ends 30 April 2026 and its last release tag is release/2026-05-20, so package health and CI can't be read, though the hosted service keeps shipping (4 of 10). 30 + 20 + 12 + 6 + 4 = 72.", "checked": "2026-11-03" }, { "key": "transparency", "name": "Transparency \u0026 trust", "weight": 7, "effectiveWeight": 8.75, "score": 82, "points": 7.18, "note": "editorial 71, provenance 93", "reason": "Canvas LMS source under AGPL-3.0 with clear terms of use and an API policy for the hosted service (28 of 30). Privacy notice effective 10 July 2026 with a 30-day deletion commitment, an AI privacy notice (27 October 2025) saying student data does not train Instructure's models and naming Anthropic, Meta and Cohere models, but no retention periods and no subprocessor list (15 of 30). A written 90-day deprecation notice in the API policy, applied in a dated change log (20). Hosting in the United States stated for Canvas Lite and offices named, model providers named for the AI tools, no subprocessor list or regions for the main service (8 of 20). 28 + 15 + 20 + 8 = 71.", "checked": "2026-11-03" } ], "assessment": { "date": "2026-11-03", "basis": "public evidence", "confidence": "medium", "notes": { "ergonomics": "include[] parameters and per_page size REST responses, and GraphQL selects fields (22 of 25). Link-header paging on every list, with filters such as enrollment_type and state on courses (20). Error bodies are a JSON errors array, documented per endpoint rather than centrally, and 401 with WWW-Authenticate for expired tokens is explained (10 of 20). No idempotency keys; reads are safe to repeat and writes are not addressed (5 of 20). Few required parameters per call, but no official REST SDK (community libraries only) and the official client is the DAP CLI for data exports (6 of 15). 22 + 20 + 10 + 5 + 6 = 63.", "maintenance": "Read for a closed hosted service. Change log entries announced 27 October 2026 and scheduled through 9 November (30). Entries on 2, 23 and 28 September and 9 and 27 October 2026, with deploys every two weeks (20). A dated community change log, community forums and Instructure support; replies on the public repository could not be read (12 of 15). No official REST SDK; the DAP client library for data exports is current on PyPI per the change log (6 of 15). The public canvas-lms mirror's master feed ends 30 April 2026 and its last release tag is release/2026-05-20, so package health and CI can't be read, though the hosted service keeps shipping (4 of 10). 30 + 20 + 12 + 6 + 4 = 72.", "payments": "Read with the hosted rubric. No x402, MPP or L402 (0). No price published; Canvas is sold by contract, and the tiers page compares access levels without prices (0). The only free account, Canvas Lite, excludes API token access per its terms of 30 September 2026, so there is no free tier for the API (0). A developer key or OAuth grant needs an institution's administrator (0). 0 + 0 + 0 + 0 = 0.", "reliability": "Read with the hosted lines on the hosted Canvas API. Statuspage at status.instructure.com with components and history (20). From 24 August to 30 October 2026 the feed lists 25 entries, most of them slow pages or errors for some users lasting under an hour, and four of an hour or more, MFA SMS delivery (2 hours 12 minutes, 24 August), a Portland-region heavy-load outage (5 hours 17 minutes, 31 August), a login failure for some users (1 hour 46 minutes, 15 October) and Canvas Data 2 errors (1 hour 48 minutes, 21 October). Each affected a region or a subset rather than the API for everyone, read as one major outage with many minor ones (10). Throttling is documented as a cost-based quota with headers but no bucket size or refill rate (8 of 15). A 429 is documented with \"retry later\", no Retry-After or backoff numbers and no idempotency keys for writes (7 of 15). The trust centre states 99.9 per cent annual uptime; contract SLAs sit behind the customer portal (8 of 10). The REST API is generally available (10). 20 + 10 + 8 + 7 + 8 + 10 = 63.", "schema": "An OpenAPI 3.0 file is generated from the source with `rake doc:openapi`, and the reference is generated the same way, but no hosted copy of the file was found, so an agent has to build it from a repository whose public mirror ended in May 2026 (15 of 25). llms.txt on developerdocs.instructure.com indexes the Canvas resources and basics (10). Each resource page states what the endpoint does and its parameters, with little when-not-to-use guidance (16 of 20). Parameters are typed with allowed values and required flags in the resource pages (12 of 15). Request examples per endpoint, but no central error page, and the throttling page itself gives the status as \"429 Forbidden (Rate Limit Exceeded)\" (9 of 15). A change log dated by announcement and a written 90-day deprecation policy (15). 15 + 10 + 16 + 12 + 9 + 15 = 77.", "security": "OAuth2 with developer keys scoped to `url:\u003cverb\u003e|\u003cpath\u003e` endpoints, 1-hour tokens, refresh tokens, revocation on logout and replace_tokens, but `access_token` as a query parameter is a documented if discouraged option, so 30 less 10 (20 of 30). Scoped keys can be limited to GET endpoints and administrators grant and revoke scopes; masquerading needs a separate permission; no confirmation step for destructive calls (14 of 20). The API returns student submissions, discussion posts and messages with no guidance on treating them as untrusted (5 of 15). Administrators control keys and tokens, and Canvas keeps authentication and course audit logs, but per-call API visibility for a key was not confirmed (6 of 15). security.txt valid to 1 January 2027, a Bugcrowd disclosure form, a bounty programme joined on request, SOC and other reports behind the customer trust portal (16 of 20). 20 + 14 + 5 + 6 + 16 = 61.", "transparency": "Canvas LMS source under AGPL-3.0 with clear terms of use and an API policy for the hosted service (28 of 30). Privacy notice effective 10 July 2026 with a 30-day deletion commitment, an AI privacy notice (27 October 2025) saying student data does not train Instructure's models and naming Anthropic, Meta and Cohere models, but no retention periods and no subprocessor list (15 of 30). A written 90-day deprecation notice in the API policy, applied in a dated change log (20). Hosting in the United States stated for Canvas Lite and offices named, model providers named for the AI tools, no subprocessor list or regions for the main service (8 of 20). 28 + 15 + 20 + 8 = 71." }, "sources": [ { "what": "Canvas API docs landing (schema, auth, OpenAPI generation)", "url": "https://developerdocs.instructure.com/services/canvas", "seen": "2026-11-03" }, { "what": "OAuth2 guide", "url": "https://developerdocs.instructure.com/services/canvas/oauth2/file.oauth.md", "seen": "2026-11-03" }, { "what": "developer keys guide", "url": "https://developerdocs.instructure.com/services/canvas/oauth2/file.developer_keys.md", "seen": "2026-11-03" }, { "what": "API token scopes resource (beta)", "url": "https://developerdocs.instructure.com/services/canvas/resources/api_token_scopes.md", "seen": "2026-11-03" }, { "what": "throttling", "url": "https://developerdocs.instructure.com/services/canvas/basics/file.throttling", "seen": "2026-11-03" }, { "what": "pagination", "url": "https://developerdocs.instructure.com/services/canvas/basics/file.pagination", "seen": "2026-11-03" }, { "what": "GraphQL basics", "url": "https://developerdocs.instructure.com/services/canvas/basics/file.graphql", "seen": "2026-11-03" }, { "what": "llms.txt index", "url": "https://developerdocs.instructure.com/llms.txt", "seen": "2026-11-03" }, { "what": "API policy", "url": "https://www.instructure.com/policies/api-policy", "seen": "2026-11-03" }, { "what": "terms of use", "url": "https://www.instructure.com/policies/terms-of-use", "seen": "2026-11-03" }, { "what": "privacy notice", "url": "https://www.instructure.com/policies/privacy", "seen": "2026-11-03" }, { "what": "AI privacy notice", "url": "https://www.instructure.com/policies/artificial-intelligence-privacy", "seen": "2026-11-03" }, { "what": "Canvas Lite terms and conditions", "url": "https://www.instructure.com/policies/canvas-lite-terms-conditions", "seen": "2026-11-03" }, { "what": "Canvas Lite (free-for-teacher) page", "url": "https://www.instructure.com/canvas/free-for-teacher", "seen": "2026-11-03" }, { "what": "trust centre security page", "url": "https://www.instructure.com/security", "seen": "2026-11-03" }, { "what": "vulnerability disclosure", "url": "https://www.instructure.com/trust-center/vulnerability-disclosure", "seen": "2026-11-03" }, { "what": "security.txt", "url": "https://www.instructure.com/.well-known/security.txt", "seen": "2026-11-03" }, { "what": "status history feed", "url": "https://status.instructure.com/history.atom", "seen": "2026-11-03" }, { "what": "Canvas change log category (2026 API and CLI change log entries)", "url": "https://community.instructure.com/en/categories/canvas-lms-changelog", "seen": "2026-11-03" }, { "what": "IgniteAI page", "url": "https://www.instructure.com/igniteai", "seen": "2026-11-03" }, { "what": "about page (leadership, timeline, KKR)", "url": "https://www.instructure.com/about", "seen": "2026-11-03" }, { "what": "KKR and Dragoneer completion press release (SEC 8-K exhibit)", "url": "https://www.sec.gov/Archives/edgar/data/1841804/000119312524257230/d878225dex991.htm", "seen": "2026-11-03" }, { "what": "canvas-lms master commit feed and tags", "url": "https://github.com/instructure/canvas-lms/commits/master.atom", "seen": "2026-11-03" }, { "what": "official MCP registry search (third-party servers only)", "url": "https://registry.modelcontextprotocol.io/v0/servers?search=canvas", "seen": "2026-11-03" }, { "what": "RDAP for instructure.com", "url": "https://rdap.verisign.com/com/v1/domain/instructure.com", "seen": "2026-11-03" } ], "openQuestions": [ "unchecked: the canvas.instructure.com docs mirror and its generated OpenAPI file, since the host answered 503 on 3 November 2026; whether Instructure hosts canvas.openapi.yaml anywhere public is unknown.", "unchecked: the certifications (SOC 2 and others) and contract SLA, which sit behind the customer trust portal; the trust centre states 99.9 per cent annual uptime in public.", "unchecked: the titles of the 2026 change log entries beyond the announcement dates and the User-Agent requirement of 2 September 2026, since the community listing page is a large script-rendered page read only in part, and the developer docs' own change log page is a pointer.", "Why the public canvas-lms repository's master feed ends on 30 April 2026 and its tags at release/2026-05-20 while the service deploys fortnightly; a mirror change or a move to another branch wasn't found on first-hand pages.", "unchecked: per-call API audit visibility for a developer key and the live error envelope; both are taken from the docs' general statements.", "firstReleased is the year Instructure's timeline gives for the Canvas launch, 2011, written as 1 January 2011 because no day was found.", "Judgement call on reliability. Four hour-plus incidents in 90 days each hit a subset of users or one region; read as one major with the rest minor (10 of 30). A stricter reading of several majors would give 0.", "The audit's lead, \"REST API, institution permissions\", holds. The API policy's clause against unapproved MCP servers (effective 12 August 2025) is recorded as a fact, not deducted." ] }, "negative": 0, "verdict": "A wide REST and GraphQL API over an institution's courses, assignments, quizzes, submissions and grades, with scoped OAuth2 developer keys, Link-header paging, a 90-day deprecation policy and a dated change log. Access depends on an institution's administrator issuing a key, there is no public price or sandbox, and the API policy bars unapproved MCP connections.", "bestFor": "An agent acting for a teacher, student or administrator inside an institution that has issued a key, reading assignments and grades or creating course content.", "strengths": [ "REST API over courses, modules, assignments, quizzes, submissions, grades and users, plus a GraphQL endpoint with a GraphiQL explorer", "Developer keys scoped to `url:\u003cverb\u003e|\u003cpath\u003e` endpoints, 1-hour access tokens with refresh, and keys controlled by the institution's administrators", "API policy requires 90 days' notice before removing an endpoint or field, with a change log dated by announcement", "Statuspage with component history, llms.txt on the developer docs, and security.txt valid to 1 January 2027 with a Bugcrowd disclosure programme", "Canvas LMS source under AGPL-3.0, from which the API reference and an OpenAPI 3.0 file are generated" ], "weaknesses": [ "An agent needs a developer key or OAuth grant from the institution's root administrator; Canvas Lite's terms exclude API token access", "No public price, trial or sandbox for the API, and the 2026 API policy forbids connecting through MCP servers Instructure has not approved", "Throttling is cost-based with no published quota, 429s carry no Retry-After, and no idempotency keys are documented for writes", "25 status entries in 90 days, including hour-plus login, MFA and regional outages for some users", "No hosted OpenAPI file or official REST SDK found; the OpenAPI file has to be generated from the source, whose public mirror stopped in May 2026" ], "agentNotes": [ "Ask the institution's Canvas administrator for a scoped developer key, or run the OAuth2 flow on the institution's own domain; never ask users to paste manual access tokens", "Send the token only in the Authorization header, follow the opaque Link headers for paging and set per_page rather than guessing page counts", "Watch X-Request-Cost and X-Rate-Limit-Remaining, keep to one request at a time, and on 429 wait before retrying", "Check the API policy before wiring Canvas into an MCP server; it prohibits connections through MCP servers Instructure has not approved", "Use the GraphQL endpoint at /api/graphql when you need a few fields from many objects, since REST responses have no field selection" ], "metrics": { "kind": "remote", "measured": false }, "reviewCount": 0, "avgRating": 0, "history": [ { "basis": "public evidence", "confidence": "medium", "grade": "C", "methodology": "0.7", "pending": [ "performance", "tasks" ], "run": "2026-10-01", "runLabel": "October 2026 research run", "score": 59.5 } ], "editorialScores": { "ergonomics": 63, "maintenance": 72, "payments": 0, "reliability": 63, "schema": 77, "security": 61, "transparency": 71 }, "provenanceScore": 93, "checked": { "categories": { "ergonomics": "2026-11-03", "maintenance": "2026-11-03", "payments": "2026-11-03", "reliability": "2026-11-03", "schema": "2026-11-03", "security": "2026-11-03", "transparency": "2026-11-03" }, "last": "2026-11-03", "oldest": "2026-11-03", "stale": false, "staleAfterDays": 90 }, "scoreHistory": [ { "date": "2026-11-03", "grade": "C", "kind": "listed", "method": "0.7", "score": 59.5 } ] }, "connect": { "http": "curl -H \"Authorization: Bearer \u003cACCESS_TOKEN\u003e\" \"https://\u003cinstitution\u003e.instructure.com/api/v1/courses?per_page=50\"" }, "letme": { "capability": "https://letme.dev/learning.lms", "tool": "https://letme.dev/canvas-lms" }, "notable": [ "The API reference is generated from the Canvas source, and an OpenAPI 3.0 file can be generated with `bundle exec rake doc:openapi` into public/doc/openapi/canvas.openapi.yaml; no hosted copy of that file was found on developerdocs.instructure.com (https://developerdocs.instructure.com/services/canvas)", "Instructure's API policy (effective 12 August 2025) requires 90 days' notice before an endpoint or documented field is removed or its attributes changed, and prohibits connecting through model context protocol servers or other technologies Instructure has not approved, competitive use and acting on behalf of third parties (https://www.instructure.com/policies/api-policy)", "Throttling is cost-based per access token, with X-Request-Cost on every response and X-Rate-Limit-Remaining when throttled, a 429 on exhaustion and no published bucket size; a client making one request at a time is \"unlikely to be throttled\" (https://developerdocs.instructure.com/services/canvas/basics/file.throttling)", "Lists page 10 items by default with per_page and opaque Link headers (current, next, prev, first, last); the GraphQL endpoint at /api/graphql mirrors REST permissions with Relay-style paging and a GraphiQL explorer at /graphiql (https://developerdocs.instructure.com/services/canvas/basics/file.pagination)", "Developer keys are scoped or unscoped; a scoped key limits tokens to listed `url:GET|/api/v1/...` endpoints and returns 401 outside them, removing a scope invalidates derived tokens, and the scopes endpoint GET /api/v1/accounts/:account_id/scopes is marked beta (https://developerdocs.instructure.com/services/canvas/oauth2/file.developer_keys.md)", "Statuspage at status.instructure.com with 25 entries from 24 August to 30 October 2026, among them MFA SMS delivery (2 hours 12 minutes, 24 August), a Portland-region heavy-load outage (5 hours 17 minutes, 31 August), a login failure for some users (1 hour 46 minutes, 15 October) and Canvas Data 2 errors (1 hour 48 minutes, 21 October) (https://status.instructure.com/history.atom)", "The 2026 API and CLI change log on the Instructure Community dates entries by announcement, among them 2 September (a User-Agent header required on DAP and Learn Platform API requests), 23 September, 28 September, 9 October and 27 October 2026 (https://community.instructure.com/en/categories/canvas-lms-changelog)", "The public canvas-lms repository's master commit feed ends on 30 April 2026 and its newest release tag is release/2026-05-20, while the hosted service keeps deploying, so the mirror can't be read for current code (https://github.com/instructure/canvas-lms/commits/master.atom)", "KKR and Dragoneer completed their acquisition of Instructure Holdings, Inc. on 13 November 2024 at $23.60 a share, about $4.8 billion, and the shares left the New York Stock Exchange (https://www.sec.gov/Archives/edgar/data/1841804/000119312524257230/d878225dex991.htm)" ], "area": "everyday", "details": [ { "label": "Surface listed", "value": "The Canvas REST API (api/v1) and GraphQL API on an institution's Canvas domain, read from developerdocs.instructure.com, the API policy, the OAuth2 and developer key guides, the status feed, the community change log, instructure.com's legal and trust pages, the canvas-lms repository feeds and the SEC filing on 3 November 2026. No key was issued and no call was made" }, { "label": "Base URL", "value": "https://\u003cinstitution\u003e.instructure.com/api/v1 (self-hosted installs use their own domain); GraphQL at /api/graphql" }, { "label": "Access", "value": "A developer key from the root account administrator (scoped or unscoped), or a global key from Instructure that the administrator enables; manual access tokens from a user's profile are for testing only" }, { "label": "Rate limit", "value": "Cost-based quota per access token that refills over time, X-Request-Cost on every response, X-Rate-Limit-Remaining when throttled, 429 Rate Limit Exceeded; no bucket size published" }, { "label": "Deprecation", "value": "90 days' notice for removing endpoints or documented fields; undocumented fields, beta functionality and security fixes may change without notice" }, { "label": "MCP", "value": "No official MCP server found. Instructure's IgniteAI Agent is its own in-product agent, and the API policy prohibits connecting through MCP servers Instructure has not approved. Third-party Canvas MCP servers exist in the official registry under individual namespaces" }, { "label": "Free account", "value": "Canvas Lite for individual educators, 500MB, five published courses, 50 students a course, no API token access per its terms of 30 September 2026" }, { "label": "Security", "value": "security.txt at instructure.com valid to 1 January 2027, Bugcrowd disclosure form and security@instructure.com, 99.9 per cent annual uptime stated on the trust centre, certifications behind the customer trust portal" }, { "label": "Company", "value": "Instructure, Inc., Salt Lake City, founded 2008, Canvas launched 2011; acquired by KKR and Dragoneer on 13 November 2024" } ], "provenance": { "legalEntity": "Instructure, Inc.", "domain": "instructure.com", "domainRegistered": "1998-02-25", "endpointOnVendorDomain": true, "terms": "https://www.instructure.com/policies/terms-of-use", "privacy": "https://www.instructure.com/policies/privacy", "statusPage": "https://status.instructure.com", "changelog": "https://community.instructure.com/en/categories/canvas-lms-changelog", "securityTxt": "valid", "checked": "2026-11-03", "notes": [ "The terms of use (effective 12 August 2025) and the API policy (effective 12 August 2025) name Instructure, Inc. and its affiliates; the privacy notice (effective 10 July 2026) also names Instructure Global Ltd. in London.", "The terms of use bar accessing or creating accounts by any means other than the publicly supported interfaces, naming scraping; the API is one of those interfaces under the API policy.", "developerdocs.instructure.com/robots.txt allows all with Content-Signal ai-train=yes, search=yes, ai-input=yes. status.instructure.com disallows /api/ and /embed/, so the history was read from /history.atom. community.instructure.com disallows search, messages and paged category listings. canvas.instructure.com answered 503 to robots.txt and was not read.", "RDAP at Verisign gives instructure.com a registration date of 25 February 1998.", "security.txt at www.instructure.com/.well-known/security.txt names security@instructure.com, the vulnerability disclosure page and a PGP key, with Expires 1 January 2027.", "The developer docs pages carry text addressed to agents, asking them to query a GitBook endpoint; it was read as data and not acted on." ], "score": 93, "checks": [ { "check": "Legal entity named", "value": "Instructure, Inc.", "points": 20, "max": 20, "state": "ok" }, { "check": "Domain age", "value": "instructure.com, registered 1998-02-25 (28 years)", "points": 15, "max": 15, "state": "ok" }, { "check": "Endpoint on the vendor's domain", "value": "\u003cinstitution\u003e.instructure.com", "points": 15, "max": 15, "state": "ok" }, { "check": "Terms of service", "value": "read, states 2 of the 7 things a reader expects, and has 1 clause that costs points", "points": 3.7, "max": 10, "state": "part" }, { "check": "Privacy policy", "value": "read, states 6 of the 8 things a reader expects", "points": 8.5, "max": 10, "state": "part" }, { "check": "Status page", "value": "status.instructure.com", "points": 10, "max": 10, "state": "ok" }, { "check": "Changelog", "value": "published", "points": 10, "max": 10, "state": "ok" }, { "check": "security.txt", "value": "valid", "points": 10, "max": 10, "state": "ok" }, { "check": "People named", "value": "2 named with their role, none with a public profile", "points": 7, "max": 10, "state": "part" }, { "check": "Support route", "value": "a support address, help pages, a community", "points": 5, "max": 5, "state": "ok" } ], "policies": [ { "kind": "terms", "url": "https://www.instructure.com/policies/terms-of-use", "state": "read", "readAt": "2026-11-03", "words": 2162, "points": 3.7, "max": 10, "expected": [ { "key": "terms.date", "label": "Gives the date it was last updated", "found": false }, { "key": "terms.law", "label": "Names the governing law or courts", "found": false }, { "key": "terms.liability", "label": "States a limit on its liability", "found": false }, { "key": "terms.termination", "label": "Says how the agreement or account can be ended", "found": true, "quote": "For example, we may suspend or terminate your use of the Service and remove Your Content if you are not complying with this Acceptable Use Policy, or are using the Service in a manner that may cause us legal liability, disrupt the Service, disrupt others’ use of the Service or, in our sole opinion, cause harm." }, { "key": "terms.changes", "label": "Says how changes to the terms are announced", "found": false }, { "key": "terms.use", "label": "Lists what users may not do", "found": true, "quote": "You therefore agree that you will not copy, reproduce, create derivative works of, decompile, upload, download, share, or otherwise exploit third party content unless you have the right to do so." }, { "key": "terms.sla", "label": "Refers to a service level or uptime commitment", "found": false } ], "toKnow": [ { "key": "terms.automated", "label": "Restricts automated access", "found": true, "quote": "access, search, or create accounts for the Service by any means other than our publicly supported interfaces (for example, \"scraping\" or creating accounts in bulk);", "costsPoints": true }, { "key": "terms.cutoff", "label": "Says access can be ended without notice or for any reason", "found": true, "quote": "We also reserve the right to suspend your access or end the Service at any time at our discretion and without notice." } ], "notes": [ { "date": "2026-11-03", "text": "Users must not share API tokens, logins, passwords or other access credentials for the Service with any third party.", "quote": "share your API tokens, login, password, or other access credentials for the Service with any third party;" } ] }, { "kind": "privacy", "url": "https://www.instructure.com/policies/privacy", "state": "read", "readAt": "2026-11-03", "words": 4662, "points": 8.5, "max": 10, "expected": [ { "key": "privacy.date", "label": "Gives the date it was last updated", "found": false }, { "key": "privacy.collected", "label": "Says what personal data is collected", "found": true, "quote": "Please note that if we process personal information we collect for a purpose other than the purpose for which it was collected, we will provide you with notice in advance of the new processing and obtain consent if required." }, { "key": "privacy.retention", "label": "Says how long data is kept", "found": false }, { "key": "privacy.processors", "label": "Says who else receives the data", "found": true, "quote": "We may share personal information collected about you with authorized third-party service providers for the sole purpose of providing you with our Products." }, { "key": "privacy.sale", "label": "Says whether personal data is sold or shared for advertising", "found": true, "quote": "Additionally, we do not sell or rent personal information to third parties.", "says": "Says it does not sell personal data" }, { "key": "privacy.rights", "label": "Says what rights people have over their data", "found": true, "quote": "Residents of the EU, UK, and Switzerland have the right to access the personal data that Instructure maintains, and in some cases, have choices to limit the use and disclosure of personal data." }, { "key": "privacy.contact", "label": "Gives a privacy contact", "found": true, "quote": "Except for authorized users of Canvas LMS, Canvas Studio, Canvas Student Pathways, or the suite of Mastery products, if you learn that a child under thirteen years of age has provided us with personal information, please alert us at privacy@instructure.com.", "says": "privacy@instructure.com" }, { "key": "privacy.transfers", "label": "Says where data is transferred or stored", "found": true, "quote": "To learn more about the Data Privacy Framework (“DPF”) program, and to view our certification, please visit https://www.dataprivacyframework.gov/(opens in a new tab).", "says": "Relies on the Data Privacy Framework" } ] } ] }, "humans": { "slug": "canvas-lms", "checked": "2026-11-03", "company": "Instructure", "people": [ { "name": "Steve Daly", "role": "Chief Executive Officer", "bio": "Steve Daly is chief executive of Instructure, the Salt Lake City company behind Canvas, listed first on its leadership page. The company was founded in 2008, launched Canvas in 2011 and was acquired by KKR and Dragoneer in November 2024.", "bioSources": [ "https://www.instructure.com/about" ], "page": "/people/steve-daly/" }, { "name": "Shiren Vijiasingam", "role": "Chief Product Officer", "bio": "Shiren Vijiasingam is Instructure's chief product officer, responsible for the product line that includes Canvas, per the company's leadership page.", "bioSources": [ "https://www.instructure.com/about" ], "page": "/people/shiren-vijiasingam/" } ], "peopleNote": "Leaders from instructure.com/about, read 3 November 2026, which lists Steve Daly (CEO), Matt Kaminer (Chief People and Legal Officer), Audrey Zhao (CFO), Armin Molavi (President, Global Customer Organization), Shiren Vijiasingam (CPO), Rachel Orston, Melissa Loble, James Sutton, Brian Cully and Sidharth Oberoi. The page gives the founding year as 2008 but names no founder, so none is listed. No personal LinkedIn or X links appear on the page. Ownership from the SEC 8-K exhibit of the completion press release of 13 November 2024; as an acquired company no shareholders are listed.", "companySocial": { "linkedin": "https://www.linkedin.com/company/instructure-inc-", "x": "https://x.com/Instructure", "github": "https://github.com/instructure" }, "support": { "emails": [ "security@instructure.com", "privacy@instructure.com" ], "urls": [ "https://community.instructure.com/", "https://status.instructure.com/" ], "community": [ { "label": "Instructure Community", "url": "https://community.instructure.com/", "kind": "forum" } ] }, "sources": [ "https://www.instructure.com/about", "https://www.instructure.com/.well-known/security.txt", "https://www.instructure.com/policies/privacy", "https://developerdocs.instructure.com/services/canvas", "https://www.sec.gov/Archives/edgar/data/1841804/000119312524257230/d878225dex991.htm" ], "ownership": { "status": "acquired", "acquiredBy": "KKR and Dragoneer Investment Group", "acquiredDate": "2024-11-13", "valuation": { "amount": "$4.8 billion", "basis": "acquisition", "asOf": "2024-11-13", "source": "https://www.sec.gov/Archives/edgar/data/1841804/000119312524257230/d878225dex991.htm" }, "checked": "2026-11-03", "sources": [ "https://www.sec.gov/Archives/edgar/data/1841804/000119312524257230/d878225dex991.htm", "https://www.instructure.com/about" ] } }, "pageJsonUrl": "https://www.anchorterminal.com/tools/canvas-lms.json", "live": { "slug": "canvas-lms", "probe": { "target": "https://\u003cinstitution\u003e.instructure.com/api/v1", "method": "get", "lastAt": "2026-11-04T20:04:55.428923839Z", "lastOk": false, "lastStatus": 0, "lastMs": 0, "lastNote": "DNS lookup failed", "authRequired": false, "uptime24h": 0, "uptime30d": 0, "p50ms24h": 0, "p95ms24h": 0, "samples24h": 48, "samples30d": 48, "days": [ { "date": "2026-11-04", "probes": 48, "ok": 0 } ], "outages": [ { "start": "2026-11-04T15:25:14.852879587Z", "end": "0001-01-01T00:00:00Z", "note": "DNS lookup failed" } ] }, "vendorStatus": { "page": "https://status.instructure.com", "indicator": "minor", "summary": "Minor Service Outage", "checkedAt": "2026-11-04T20:04:43.28455121Z" }, "githubStars": 6902, "securityTxt": { "url": "https://instructure.com/.well-known/security.txt", "state": "valid", "expires": "2027-01-01T00:00:00z", "checkedAt": "2026-11-04T15:54:37.398266631Z" }, "updatedAt": "2026-11-04T20:04:55.428923839Z" } } }