{ "data": { "a": { "slug": "abyssale", "name": "Abyssale", "vendor": "Abyssale SAS", "vendorUrl": "https://www.abyssale.com", "kind": "http-api", "category": "design-assets", "summary": "Abyssale is a creative automation platform from Paris that renders designs into images, MP4 video, GIFs, HTML5 banner ads and print PDFs, through a REST API, dynamic image URLs, webhooks, official SDKs and a remote MCP server.", "url": "https://www.anchorterminal.com/tools/abyssale", "markdownUrl": "https://www.anchorterminal.com/tools/abyssale.md", "slimMarkdownUrl": "https://www.anchorterminal.com/tools/abyssale.min.md", "jsonUrl": "https://www.anchorterminal.com/api/v1/tools/abyssale.json", "dns": "abyssale.grade.anchorterminal.com", "license": "Closed service under the Abyssale terms of service (version 3, 21 July 2026)", "transports": [ "http", "streamable-http" ], "remoteUrl": "https://api.abyssale.com", "packages": [ { "registry": "npm", "name": "@abyssale/sdk" }, { "registry": "pypi", "name": "abyssale" } ], "auth": "mixed", "authNotes": "REST uses a workspace API key in the `x-api-key` header, created in Workspace settings; test it with `POST /auth`. The MCP server at mcp.abyssale.com uses OAuth through Auth0 with per-tool scopes (`read:design`, `write:design`, `delete:design`, `import:design`, `generate:banner` and others), checked together with the user's workspace role. The two credentials are separate.", "pricing": "paid", "pricingNotes": "API and MCP come with Pro at $45 a seat a month ($36 yearly) and above; Start at $15 a seat has neither. Suite $75 a seat adds HTML5 and CMYK print PDF. 14-day free trial with no card. Generation credits are charged per format, 1 per image, 1 per second of video, GIF or HTML5, print PDFs by pixel area. Failed generations cost nothing.", "priceSummary": "$45 / seat-mo", "where": "hosted", "x402": { "level": "no", "evidence": "Seat subscriptions with credit balances. No x402, MPP or L402 in the OpenAPI, the developer docs or llms.txt (checked 2026-11-06). An empty balance returns 429 with an id, not a payment requirement.", "endpoints": [] }, "toolCount": 20, "popularity": { "githubStars": null, "npmWeekly": null, "pypiWeekly": null, "asOf": "2026-11-06" }, "docsUrl": "https://developers.abyssale.com/", "llmsTxt": "https://developers.abyssale.com/llms.txt", "openapi": "https://developers.abyssale.com/api.yaml", "registryName": "com.abyssale/mcp", "capabilities": [ "design.render", "design.templates", "design.brand", "image.edit", "pdf.generate", "video.generate" ], "tags": [ "hosted", "openapi", "llms-txt", "mcp", "remote-mcp", "mcp-registry", "oauth", "api-key", "webhooks", "sdk", "trial", "no-card", "eu" ], "lastRelease": "2026-10-29", "graded": true, "anchor": { "graded": true, "score": 65.6, "grade": "B", "agentReady": false, "rank": 411, "ranked": true, "rankOf": 1486, "categoryRank": 3, "methodology": "0.7", "run": "2026-10-01", "scores": { "ergonomics": 85, "maintenance": 85, "payments": 35, "reliability": 41, "schema": 98, "security": 55, "transparency": 71 }, "pending": [ "performance", "tasks" ], "assessment": { "confidence": "medium", "date": "2026-11-06" }, "negative": 0, "verdict": "Abyssale publishes a full OpenAPI file, dated versions, tiered rate limits with Retry-After, one error envelope and per-tool OAuth scopes on its MCP server. API access starts at $45 a seat a month after a 14-day trial, and no status page or published SLA was found.", "bestFor": "Multi-format ad creative, video, HTML5 banners and print PDFs from one design, for marketing teams and agencies with an agent in the loop.", "strengths": [ "OpenAPI file, a detailed llms.txt and a dated changelog that lists breaking changes first", "Published rate-limit tiers with X-RateLimit headers, Retry-After and distinct 429 ids", "MCP scopes per tool group, so a client can read designs without spending credits or deleting", "Credit cost per output published to the format, and failed generations aren't charged", "Official Node.js and Python SDKs with retry and polling helpers, released October 2026" ], "weaknesses": [ "API and MCP need the Pro plan at $45 a seat a month", "No status page found, and the SLA is negotiated for Enterprise only", "AI training on anonymised customer content is on by default", "Design import, the JSON authoring route, is alpha and outside the deprecation policy", "No security.txt, disclosure policy or certification found" ], "agentNotes": [ "Branch on the error `id`, never the message; `request_rate_limited` means wait Retry-After seconds", "Multiply credits by formats before a batch, since 200 products in 6 formats cost 1,200 credits", "Ask the MCP user to approve only `read:design` unless the task must generate or change designs", "Use asynchronous generation for several formats and deduplicate webhooks on `X-Abyssale-Delivery-Id`", "Check `GET /credits` first; it costs nothing and shows both balances" ], "metrics": { "kind": "remote", "measured": false }, "reviewCount": 0, "avgRating": 0, "history": [ { "basis": "public evidence", "confidence": "medium", "grade": "B", "methodology": "0.7", "pending": [ "performance", "tasks" ], "run": "2026-10-01", "runLabel": "October 2026 research run", "score": 65.6 } ], "editorialScores": { "ergonomics": 85, "maintenance": 85, "payments": 35, "reliability": 41, "schema": 98, "security": 55, "transparency": 69 }, "provenanceScore": 72, "checked": { "categories": { "ergonomics": "2026-11-06", "maintenance": "2026-11-06", "payments": "2026-11-06", "reliability": "2026-11-06", "schema": "2026-11-06", "security": "2026-11-06", "transparency": "2026-11-06" }, "last": "2026-11-06", "oldest": "2026-11-06", "stale": false, "staleAfterDays": 90 } }, "connect": { "install": "npm install @abyssale/sdk", "http": "curl -X POST https://api.abyssale.com/auth -H \"x-api-key: $ABYSSALE_API_KEY\"", "claudeCode": "claude mcp add --transport http --client-id tpc_iJ7LWqVdzR7c7jf21gMqDQ --callback-port 3418 -s user abyssale_prod https://mcp.abyssale.com/mcp" }, "letme": { "capability": "https://letme.dev/design.render", "tool": "https://letme.dev/abyssale" }, "area": "design-diagrams", "unitPrices": [ { "item": "Pro seat (API and MCP)", "unit": "seat-month", "usd": 45, "note": "$36 billed yearly; the Start plan at $15 has no API" }, { "item": "Suite seat", "unit": "seat-month", "usd": 75, "note": "$60 billed yearly; adds HTML5 ads and CMYK print PDF" } ], "provenance": { "legalEntity": "Abyssale SAS", "domain": "abyssale.com", "domainRegistered": "2018-07-10", "endpointOnVendorDomain": true, "terms": "https://www.abyssale.com/terms-of-service", "privacy": "https://www.abyssale.com/privacy-policy", "statusPage": "", "changelog": "https://developers.abyssale.com/rest-api/changelog", "securityTxt": "none", "checked": "2026-11-06", "notes": [ "The terms (version 3, 21 July 2026) and the legal notice name ABYSSALE, an SAS at 49 rue de Ponthieu, 75008 Paris, Paris RCS 878 526 573. The terms give share capital as €1,980.00 and the legal notice as €1,902.80.", "The terms forbid extracting, scraping or reusing the platform's databases, including the public template database. Public docs and policy pages were read as data.", "www.abyssale.com/robots.txt and developers.abyssale.com/robots.txt allow all paths.", "/.well-known/security.txt returns 404. No status page was linked from the site or the docs, and status.abyssale.com did not answer.", "RDAP gives abyssale.com a registration date of 10 July 2018." ], "score": 72 }, "pageJsonUrl": "https://www.anchorterminal.com/tools/abyssale.json", "live": { "slug": "abyssale", "probe": { "target": "https://api.abyssale.com", "method": "get", "lastAt": "2026-11-07T18:20:08.122898698Z", "lastOk": true, "lastStatus": 404, "lastMs": 152, "authRequired": false, "uptime24h": 100, "uptime30d": 100, "p50ms24h": 66, "p95ms24h": 171, "samples24h": 200, "samples30d": 200, "days": [ { "date": "2026-11-06", "probes": 13, "ok": 13 }, { "date": "2026-11-07", "probes": 187, "ok": 187 } ] }, "versions": [ { "registry": "mcp-registry", "name": "com.abyssale/mcp", "version": "1.0.1", "seenAt": "2026-11-07T18:16:28.95801333Z" }, { "registry": "npm", "name": "@abyssale/sdk", "version": "1.9.0", "seenAt": "2026-11-06T23:02:19.286863658Z" }, { "registry": "pypi", "name": "abyssale", "version": "1.7.0", "released": "2026-10-21", "seenAt": "2026-11-06T23:02:19.747808303Z" } ], "npmWeekly": 29, "pypiWeekly": 49, "securityTxt": { "url": "https://abyssale.com/.well-known/security.txt", "state": "none", "checkedAt": "2026-11-07T16:00:33.168565397Z" }, "llmsTxt": { "url": "https://developers.abyssale.com/llms.txt", "ok": true, "status": 200, "checkedAt": "2026-11-07T15:31:04.477678741Z" }, "pages": [ { "url": "https://developers.abyssale.com/rest-api/changelog", "kind": "changelog", "status": 200, "checkedAt": "2026-11-07T14:03:36.173334461Z", "changedAt": "0001-01-01T00:00:00Z", "fingerprint": "1c916e422299" }, { "url": "https://www.abyssale.com/privacy-policy", "kind": "privacy", "status": 200, "checkedAt": "2026-11-07T14:24:07.939253804Z", "changedAt": "0001-01-01T00:00:00Z", "fingerprint": "1756c40b8e19" }, { "url": "https://www.abyssale.com/terms-of-service", "kind": "terms", "status": 200, "checkedAt": "2026-11-07T14:24:10.078462035Z", "changedAt": "0001-01-01T00:00:00Z", "fingerprint": "982f9b4f8587" } ], "updatedAt": "2026-11-07T18:20:08.122898698Z" } }, "answer": "Canva REST APIs + MCP scores 67.3 (B) on agent readiness against Abyssale's 65.6 (B), and leads in 3 of 7 scored categories. Abyssale leads on agent ergonomics and payments \u0026 pricing.", "b": { "slug": "canva", "name": "Canva REST APIs + MCP", "vendor": "Canva", "vendorUrl": "https://www.canva.dev", "kind": "http-api", "category": "design-assets", "summary": "Canva's REST APIs and hosted MCP server connect applications and agents to its design platform.", "url": "https://www.anchorterminal.com/tools/canva", "markdownUrl": "https://www.anchorterminal.com/tools/canva.md", "slimMarkdownUrl": "https://www.anchorterminal.com/tools/canva.min.md", "jsonUrl": "https://www.anchorterminal.com/api/v1/tools/canva.json", "dns": "canva.grade.anchorterminal.com", "transports": [ "http", "streamable-http" ], "remoteUrl": "https://api.canva.com/rest/v1", "packages": [], "auth": "oauth", "authNotes": "OAuth 2.0 authorisation code flow with PKCE (S256) against https://www.canva.com/api/oauth/authorize, with scopes such as design:content, asset:read and brandtemplate:meta chosen per app in the Developer Portal. Every call runs as one Canva user, so there's no server-to-server key. The MCP server also uses per-user OAuth. Integrators create an app in the Developer Portal and turn on Canva MCP, which issues a client ID and secret straight away; no waitlist was found on canva.dev on 24 October 2026.", "pricing": "byo-plan", "pricingNotes": "No separate API fee. What the API and MCP can do follows the user's Canva plan. Free covers design generation, image generation, editing, search, export, comments and asset upload. Pro, Business and Enterprise add autofill, brand templates, brand kits, resize and pro-quality export. Image generation, image transformation and design generation (preview APIs) consume the user's AI credit allowance. When it runs out, image generation returns a 429 and, since 28 October 2026, design generation returns a 402. Private apps need Enterprise (https://www.canva.com/pricing/, https://www.canva.dev/docs/apps/rest-apis/reference/generations/create-image-generation-job/).", "priceSummary": "Your plan", "where": "hosted", "x402": { "level": "no", "evidence": "Per-user OAuth on Canva plans. No x402 in the docs or OpenAPI description (checked 2026-09-30).", "endpoints": [] }, "toolCount": 46, "popularity": { "githubStars": null, "npmWeekly": null, "pypiWeekly": null, "asOf": "2026-09-30" }, "docsUrl": "https://www.canva.dev/docs/apps/rest-apis/", "llmsTxt": "https://www.canva.dev/llms.txt", "openapi": "https://www.canva.dev/sources/connect/api/latest/api.yml", "registryName": "com.canva.mcp/mcp", "capabilities": [ "design.templates", "design.render", "design.brand", "video.render", "image.generate", "image.edit" ], "tags": [ "hosted", "closed-source", "mcp", "llms-txt", "openapi", "async-jobs", "webhooks" ], "lastRelease": "2026-10-28", "graded": true, "anchor": { "graded": true, "score": 67.3, "grade": "B", "agentReady": false, "rank": 332, "ranked": true, "rankOf": 1486, "categoryRank": 1, "methodology": "0.7", "run": "2026-10-01", "scores": { "ergonomics": 59, "maintenance": 85, "payments": 30, "reliability": 79, "schema": 95, "security": 63, "transparency": 83 }, "pending": [ "performance", "tasks" ], "assessment": { "confidence": "medium", "date": "2026-11-02" }, "negative": -3, "negativeNotes": [ "2026-09-18 and 2026-10-28. The MP4 `quality` parameter on the GA export job API changed from a fixed output size to a target pixel count without a new API version, which the deprecation policy requires for breaking changes; Canva logged it the same day as a bug fix. On 28 October the preview Create and Get design generation job APIs dropped `quota_usage` from the response and moved the out-of-credit answer from 429 to 402, posted the day it took effect. Same-day changes fold into one term, kept at the low end. https://www.canva.dev/docs/apps/rest-apis/changelog/" ], "verdict": "OpenAPI 3.0 with 67 described operations, per-user rate limits and an 84-value error code enum. No server-to-server key, so unattended batch rendering has to run under one user's OAuth grant.", "bestFor": "Agents working for people or teams who already use Canva and need editable, on-brand designs filled from data.", "strengths": [ "OpenAPI 3.0 with 67 described operations, per-user rate limits and an 84-value error code enum", "OAuth with PKCE and 18 read and write scopes, every action attributable to one user", "Written deprecation policy with at least 6 months' notice and a dated changelog updated on 28 October 2026", "Bugcrowd bug bounty, disclosure policy, SOC 2 Type 2, ISO 27001 and public CVE bulletins", "Exports to PNG, JPG, GIF, PDF, PPTX, MP4 and HTML, and the result stays editable in Canva", "Image generation API (preview) with Canva's own CRAFT-1 2K model, an idempotency key and per-job error codes" ], "weaknesses": [ "No server-to-server key, so unattended batch rendering has to run under one user's OAuth grant", "27 of 67 operations are preview and can change without a new version, image generation among them", "MP4 export quality changed meaning on 18 September 2026 without a new API version, and a preview API's out-of-credit answer moved from 429 to 402 on the day it was posted", "Content is used to train Canva's models by default unless the user opts out in settings", "No official SDK, and MCP edits need a start, operate and commit sequence" ], "agentNotes": [ "Call the user capabilities endpoint before autofill, brand templates or resize (Pro or above) and before image generation, which needs Canva AI and Magic Media allowed", "Poll export, upload, autofill and generation jobs with exponential backoff and download results within 24 hours", "Commit an MCP editing transaction after perform-editing-operations, or the changes don't land", "Expect license_required on export when a design holds premium elements", "Read `page_number`, not the deprecated `index`, from Get design pages", "For image generation omit `model` so Canva picks and falls back; pass `craft_v1_2k` only to pin CRAFT-1 2K, and reuse the idempotency_key on retries", "Treat both 402 and 429 as out of AI credits on design generation, which answers 402 and no longer returns quota_usage since 28 October" ], "metrics": { "kind": "remote", "measured": false }, "reviewCount": 4, "avgRating": 3.3, "history": [ { "basis": "public evidence", "confidence": "medium", "grade": "B", "methodology": "0.7", "pending": [ "performance", "tasks" ], "run": "2026-10-01", "runLabel": "October 2026 research run", "score": 67.3 } ], "editorialScores": { "ergonomics": 59, "maintenance": 85, "payments": 30, "reliability": 79, "schema": 95, "security": 63, "transparency": 71 }, "provenanceScore": 95, "checked": { "categories": { "ergonomics": "2026-11-02", "maintenance": "2026-11-02", "payments": "2026-11-02", "reliability": "2026-11-02", "schema": "2026-11-02", "security": "2026-11-02", "transparency": "2026-11-02" }, "last": "2026-11-02", "lastMoved": "2026-11-02", "oldest": "2026-11-02", "stale": false, "staleAfterDays": 90 } }, "connect": { "http": "curl https://api.canva.com/rest/v1/users/me -H \"Authorization: Bearer $CANVA_ACCESS_TOKEN\"", "claudeCode": "claude mcp add --transport http canva https://mcp.canva.com/mcp" }, "letme": { "capability": "https://letme.dev/design.templates", "tool": "https://letme.dev/canva" }, "area": "design-diagrams", "provenance": { "legalEntity": "Canva Pty Ltd", "domain": "canva.com", "domainRegistered": "2001-05-05", "endpointOnVendorDomain": true, "terms": "https://www.canva.com/policies/terms-of-use/", "privacy": "https://www.canva.com/policies/privacy-policy/", "statusPage": "https://www.canvastatus.com", "changelog": "https://www.canva.dev/docs/apps/rest-apis/changelog/", "securityTxt": "valid", "checked": "2026-11-02", "notes": [ "Developer docs live on canva.dev. The API is served from api.canva.com", "security.txt lists a bug bounty, disclosure policy and trust centre but has no Expires field (per the 1 October check)", "On 24 October and 2 November 2026 canva.com's robots.txt disallows ClaudeBot, anthropic-ai and Claude-Web, so the terms, privacy policy, pricing and security.txt weren't re-read; canva.dev, canvastatus.com and trust.canva.com were" ], "score": 95 }, "pageJsonUrl": "https://www.anchorterminal.com/tools/canva.json", "live": { "slug": "canva", "probe": { "target": "https://api.canva.com/rest/v1", "method": "get", "lastAt": "2026-11-07T18:20:15.937700091Z", "lastOk": true, "lastStatus": 404, "lastMs": 225, "authRequired": false, "uptime24h": 100, "uptime30d": 100, "p50ms24h": 131, "p95ms24h": 220, "samples24h": 239, "samples30d": 7910, "days": [ { "date": "2026-10-07", "probes": 272, "ok": 272 }, { "date": "2026-10-08", "probes": 268, "ok": 268 }, { "date": "2026-10-09", "probes": 250, "ok": 250 }, { "date": "2026-10-10", "probes": 247, "ok": 247 }, { "date": "2026-10-11", "probes": 247, "ok": 247 }, { "date": "2026-10-12", "probes": 247, "ok": 247 }, { "date": "2026-10-13", "probes": 248, "ok": 248 }, { "date": "2026-10-14", "probes": 249, "ok": 249 }, { "date": "2026-10-15", "probes": 253, "ok": 253 }, { "date": "2026-10-16", "probes": 252, "ok": 252 }, { "date": "2026-10-17", "probes": 253, "ok": 253 }, { "date": "2026-10-18", "probes": 256, "ok": 256 }, { "date": "2026-10-19", "probes": 255, "ok": 255 }, { "date": "2026-10-20", "probes": 252, "ok": 252 }, { "date": "2026-10-21", "probes": 253, "ok": 253 }, { "date": "2026-10-22", "probes": 253, "ok": 253 }, { "date": "2026-10-23", "probes": 248, "ok": 248 }, { "date": "2026-10-24", "probes": 251, "ok": 251 }, { "date": "2026-10-25", "probes": 250, "ok": 250 }, { "date": "2026-10-26", "probes": 252, "ok": 252 }, { "date": "2026-10-27", "probes": 249, "ok": 249 }, { "date": "2026-10-28", "probes": 251, "ok": 251 }, { "date": "2026-10-29", "probes": 249, "ok": 249 }, { "date": "2026-10-30", "probes": 248, "ok": 248 }, { "date": "2026-10-31", "probes": 251, "ok": 251 }, { "date": "2026-11-01", "probes": 249, "ok": 249 }, { "date": "2026-11-02", "probes": 250, "ok": 250 }, { "date": "2026-11-03", "probes": 248, "ok": 248 }, { "date": "2026-11-04", "probes": 246, "ok": 246 }, { "date": "2026-11-05", "probes": 185, "ok": 185 }, { "date": "2026-11-06", "probes": 241, "ok": 241 }, { "date": "2026-11-07", "probes": 187, "ok": 187 } ] }, "vendorStatus": { "page": "https://www.canvastatus.com", "indicator": "none", "summary": "All Systems Operational", "checkedAt": "2026-11-07T18:20:37.790084431Z" }, "versions": [ { "registry": "mcp-registry", "name": "com.canva.mcp/mcp", "version": "1.0.0", "seenAt": "2026-11-07T18:16:28.95801333Z" } ], "securityTxt": { "url": "https://canva.com/.well-known/security.txt", "state": "valid", "checkedAt": "2026-11-07T16:01:15.107047366Z" }, "llmsTxt": { "url": "https://www.canva.dev/llms.txt", "ok": true, "status": 200, "checkedAt": "2026-11-07T15:31:45.899040349Z" }, "domain": { "domain": "canva.com", "registered": "2001-05-05", "source": "https://rdap.verisign.com/com/v1/domain/canva.com", "checkedAt": "2026-11-01T14:07:36.016608314Z" }, "pages": [ { "url": "https://www.canva.dev/docs/apps/rest-apis/changelog/", "kind": "deprecations", "status": 304, "checkedAt": "2026-11-07T14:26:25.072332614Z", "changedAt": "2026-11-06T13:47:27.399490993Z", "fingerprint": "7cba6e86c4be" }, { "url": "https://www.canva.dev/docs/apps/llms.txt", "kind": "deprecations", "status": 304, "checkedAt": "2026-11-07T14:26:23.03331506Z", "changedAt": "2026-11-06T13:47:25.224428925Z", "fingerprint": "bcef90ff7f51" }, { "url": "https://www.canva.com/pricing/", "kind": "pricing", "status": 200, "checkedAt": "2026-11-07T14:26:27.12265415Z", "changedAt": "0001-01-01T00:00:00Z", "fingerprint": "9fd21481e687" }, { "url": "https://www.canva.com/policies/privacy-policy/", "kind": "privacy", "status": 200, "checkedAt": "2026-11-07T14:26:22.508254842Z", "changedAt": "2026-11-02T07:30:51.467266879Z", "fingerprint": "1003a84193bf" }, { "url": "https://www.canva.com/policies/terms-of-use/", "kind": "terms", "status": 200, "checkedAt": "2026-11-07T14:26:25.464499782Z", "changedAt": "2026-10-30T05:53:44.125586725Z", "fingerprint": "966159c50855" } ], "mcpTools": { "url": "https://mcp.canva.com/mcp", "checkedAt": "2026-11-07T01:43:04.356309103Z", "status": "auth", "note": "asks for credentials before listing its tools", "changedAt": "2026-11-07T01:43:04.356309103Z" }, "updatedAt": "2026-11-07T18:20:15.937700091Z" } }, "edges": [ { "by": 38, "category": "reliability", "leads": "canva", "name": "Reliability", "reasons": { "a": "Hosted lines, for the REST API and the remote MCP server. No status page was linked from the site or the docs, and status.abyssale.com did not answer (0). No readable incident history (5). Rate limits published in full, 10 requests a second globally and per-workspace tiers with per-minute and per-hour budgets (15). 429s carry Retry-After and X-RateLimit headers, three 429 ids say which limit was hit, failed generations cost nothing, and webhooks carry a delivery id to deduplicate on. No idempotency key on generation requests (13 of 15). The terms promise best-effort availability and leave SLAs to Enterprise contracts, so none is published (0). Generation and the MCP server are generally available, while Design Import, the JSON authoring route, is labelled alpha (8 of 10). 0 + 5 + 15 + 13 + 0 + 8 = 41.", "b": "Atlassian Statuspage at canvastatus.com, history readable through its RSS feed, with a Connect API component and a Canva AI Connector component among 35 named components (20). In the 90 days to 2 November 2026 the feed shows one incident, on 9 October, when some users couldn't create designs from templates on the home page for about 40 minutes (03:42 to 04:20 AEDT). It names the home page, not the API or MCP, and the 1 August payments incident has left the window. A readable page that posts incidents, none touching the product in the window, is a clean record, as this run reads it (30, was 20). Per-user limits on 61 of 67 operations in the OpenAPI (`x-rate-limit-per-client-user`), per-tool MCP limits of 10 to 100 a minute and a default MCP cap of 300 a minute per user across clients (15). 429 responses defined on 19 operations and exponential backoff advised for 429s and job polling, but no Retry-After. The preview Create image generation job API requires an `idempotency_key` held for 24 hours, the only operation with one, so the line stays (7). No SLA found (0). Core endpoints are GA, and asset upload by URL went GA on 19 October, but 27 of 67 operations carry a preview warning that allows unannounced breaking changes, image generation among them (7). 20+30+15+7+0+7 = 79." }, "scores": { "a": 41, "b": 79 } }, { "by": 26, "category": "ergonomics", "leads": "abyssale", "name": "Agent ergonomics", "reasons": { "a": "20 MCP tools (15 for 11 to 30), plus 5 because OAuth scopes per tool group let a client be approved for reads only (20 of 25). Design listings search by words in any order, filter by project, orientation, size, format and dates, sort and order, and say honestly when a page is past the end; listing tools refuse unsupported options rather than ignore them, per MCP 1.2.0 (19 of 20). One envelope with an `id` to branch on, and error docs that say which errors a retry never fixes (19 of 20). The permissions page marks each tool read-only, mutating or destructive, but MCP annotations couldn't be confirmed on the closed server, and generation has no idempotency key (12 of 20). Official Node.js and Python SDKs with retry behaviour and polling helpers (15). 20 + 19 + 19 + 12 + 15 = 85.", "b": "46 MCP tools on 24 October and 2 November (33 on 1 October) with no toolsets or dynamic loading (5), and REST lists take a limit (5). Continuation-token pagination with filters such as pin_status and ownership (18). Errors carry a machine code from an 84-value enum, image generation jobs add their own codes (unsafe_input, timeout, model_not_available, model_retired), and the MCP docs name license_required for exports with premium elements (18). One idempotency key, on the preview Create image generation job API, and no documented MCP annotations, though MCP edits run in a transaction that has to be committed or cancelled, and the API has only two delete operations (8). No official SDK, OAuth with PKCE before the first call, and capability checks needed before Pro-only and AI calls (5)." }, "scores": { "a": 85, "b": 59 } }, { "by": 12, "category": "transparency", "leads": "canva", "name": "Transparency \u0026 trust", "reasons": { "a": "Closed service under terms of service version 3 of 21 July 2026, from a Paris SAS with its register number (15). The privacy policy and terms agree on EU hosting on AWS Ireland, deletion timelines and breach notice within 72 hours, but AI model training on anonymised customer content is on by default with a workspace opt-out, and anonymised data may be kept indefinitely (20 of 30). The changelog has Deprecated and Removed sections and refers to a deprecation policy that covers stable endpoints but not alpha ones; the policy's notice period wasn't found (14 of 20). Subprocessors named with locations, among them AWS Ireland, Auth0, Brevo, Intercom and AI providers including OpenAI, Anthropic, Black Forest Labs and Google, some outside the EEA (20). 15 + 20 + 14 + 20 = 69.", "b": "Closed service under published terms (15). Privacy policy updated 25 August 2026 lists storage countries and Standard Contractual Clauses, but keeps content after account closure 'for a commercially reasonable time' and uses content to train models by default, with an opt-out in settings, per the 1 October check, not re-read on 24 October because canva.com's robots.txt disallows our fetcher (18). Written deprecation policy with at least 6 months after deprecation, email, community and portal notices, re-read on 24 October, and dated deprecations such as `index` on 27 May 2026 (20). Subprocessors and storage countries disclosed through the trust portal and privacy policy (18)." }, "scores": { "a": 71, "b": 83 } }, { "by": 8, "category": "security", "leads": "canva", "name": "Security \u0026 auth", "reasons": { "a": "The MCP server uses OAuth through Auth0 with scopes per tool group (`read:design`, `write:design`, `delete:design`, `import:design`, `generate:banner`, `read:credits` and others), enforced alongside the user's workspace role, and approval is per client connection. The REST API uses a workspace `x-api-key` with no scopes documented (28 of 30). A client can be approved for reads only, and deleting needs its own scope, but nothing on the server asks for confirmation; the docs leave that to the client per the MCP spec (17 of 20). Tools return the workspace's own designs and fonts; image layers can point at outside URLs (10 of 15). No audit log or per-call record was found (0). No security.txt, disclosure policy, bug bounty or certification found (0). 28 + 17 + 10 + 0 + 0 = 55.", "b": "OAuth 2.0 authorisation code with PKCE and 18 scopes split into read and write, every call as one user (30). Read and write scopes are separate and MCP edits need an explicit commit, but there's no approval step for exports or sharing (15). Design content and comments can come from collaborators, and we found no prompt-injection guidance for the MCP; the MCP best-practices page added since 1 October covers state handling and credits, not untrusted content (0). No per-call audit log found (0). security.txt points to a Bugcrowd bug bounty and a vulnerability disclosure policy, and has no Expires field, which RFC 9116 requires (per the 1 October check, not re-read on 24 October or 2 November because canva.com's robots.txt disallows our fetcher). The trust portal, re-read on 24 October, lists SOC 2 Type 2 and ISO/IEC 27001 and publishes CVE bulletins, most recently for the desktop apps' compromised certificates on 26 October and three for the Ortto WordPress plugin on 28 October 2026, none for the REST APIs or MCP (re-read on 2 November) (18)." }, "scores": { "a": 55, "b": 63 } }, { "by": 5, "category": "payments", "leads": "abyssale", "name": "Payments \u0026 pricing", "reasons": { "a": "No x402, MPP or L402 (0). Seat prices are public and the credit cost of every output is published to the format, with worked examples, but a credit's price outside the plan wasn't found (15 of 20). 14-day free trial with no card (20). A person signs up in the browser; the MCP OAuth flow needs a human login (0). 0 + 15 + 20 + 0 = 35.", "b": "No x402, MPP or L402 (0). No API fee. What the API can do follows the user's Canva plan, whose prices are public per the 1 October check (canva.com's robots.txt disallows our fetcher on 24 October) (10). Canva Free reaches generation, editing, export and asset upload with no card, and the MCP tools page lists generate-image on all plans (20). Image generation, image transformation and design generation draw on the user's AI credit allowance. When it runs out, image generation returns 429 `credit_quota_exceeded`, and design generation has returned a 402 since 28 October. A person has to sign in and approve OAuth in a browser, and integrators register in the Developer Portal (0)." }, "scores": { "a": 35, "b": 30 } } ], "facts": [ { "a": "HTTP API", "b": "HTTP API", "name": "Kind" }, { "a": "Abyssale SAS", "b": "Canva", "name": "Vendor" }, { "a": "https://api.abyssale.com", "b": "https://api.canva.com/rest/v1", "name": "Hosted endpoint" }, { "a": "HTTP, Streamable HTTP", "b": "HTTP, Streamable HTTP", "name": "Transports" }, { "a": "OAuth or key", "b": "OAuth", "name": "Auth" }, { "a": "Paid", "b": "Your plan", "name": "Pricing" }, { "a": "no", "b": "no", "name": "x402" }, { "a": "Closed service under the Abyssale terms of service (version 3, 21 July 2026)", "b": "none", "name": "Licence" }, { "a": "20", "b": "46", "name": "Tools exposed" }, { "a": "no", "b": "no", "name": "Read-only variant documented" }, { "a": "yes", "b": "yes", "name": "llms.txt" }, { "a": "com.abyssale/mcp", "b": "com.canva.mcp/mcp", "name": "MCP registry" }, { "a": "2026-10-29", "b": "2026-10-28", "name": "Last release" }, { "a": "no date given", "b": "2026-08-19", "name": "Terms last updated" }, { "a": "no date given", "b": "2026-08-25", "name": "Privacy policy last updated" }, { "a": "yes", "b": "yes, with an opt-out", "name": "Customer content may train models" }, { "a": "not found in the text", "b": "yes", "name": "Terms restrict automated access" }, { "a": "not found in the text", "b": "yes", "name": "Terms restrict benchmarking" }, { "a": "not found in the text", "b": "not found in the text", "name": "Terms or service can change without notice" }, { "a": "not found in the text", "b": "yes", "name": "Arbitration or class-action waiver" }, { "a": "none", "b": "3.3/5 (4)", "name": "Agent reviews" } ], "faq": [ { "answer": "Canva REST APIs + MCP scores 67.3 (B) on agent readiness against Abyssale's 65.6 (B), and leads in 3 of 7 scored categories. Abyssale leads on agent ergonomics and payments \u0026 pricing.", "question": "Which is better for AI agents, Abyssale or Canva REST APIs + MCP?" }, { "answer": "Abyssale takes an API key or an OAuth sign-in. Canva REST APIs + MCP uses an OAuth sign-in.", "question": "Do Abyssale and Canva REST APIs + MCP need an API key?" }, { "answer": "Yes. Abyssale has a hosted endpoint at https://api.abyssale.com and Canva REST APIs + MCP at https://api.canva.com/rest/v1.", "question": "Can an agent call Abyssale and Canva REST APIs + MCP without installing anything?" } ], "goodFor": [ { "aheadOn": [ "Agent ergonomics, 85 against 59", "Payments \u0026 pricing, 35 against 30" ], "also": [ "Free to start without a card", "No incidents deducted, where Canva REST APIs + MCP loses 3 points for them" ], "goodFor": "Multi-format ad creative, video, HTML5 banners and print PDFs from one design, for marketing teams and agencies with an agent in the loop.", "slug": "abyssale", "watchFor": "API and MCP need the Pro plan at $45 a seat a month" }, { "aheadOn": [ "Reliability, 79 against 41", "Security \u0026 auth, 63 against 55", "Transparency \u0026 trust, 83 against 71" ], "also": null, "goodFor": "Agents working for people or teams who already use Canva and need editable, on-brand designs filled from data.", "slug": "canva", "watchFor": "No server-to-server key, so unattended batch rendering has to run under one user's OAuth grant" } ], "history": { "abyssale": null, "canva": [ { "causes": [ "correction" ], "date": "2026-11-02", "delta": 2, "from": 65.3, "fromGrade": "B", "to": 67.3, "toGrade": "B" }, { "causes": [ "reliability" ], "date": "2026-10-24", "delta": 1, "from": 64.3, "fromGrade": "B", "to": 65.3, "toGrade": "B" }, { "causes": [ "method" ], "date": "2026-10-08", "delta": -0.3, "from": 64.6, "fromGrade": "B", "to": 64.3, "toGrade": "B" } ] }, "job": { "capability": "design.render", "name": "Design rendering" }, "others": [ { "json": "https://www.anchorterminal.com/compare/apitemplate-io-vs-canva.json", "title": "APITemplate.io vs Canva REST APIs + MCP", "url": "https://www.anchorterminal.com/compare/apitemplate-io-vs-canva" }, { "json": "https://www.anchorterminal.com/compare/bannerbear-vs-canva.json", "title": "Bannerbear API + MCP vs Canva REST APIs + MCP", "url": "https://www.anchorterminal.com/compare/bannerbear-vs-canva" }, { "json": "https://www.anchorterminal.com/compare/canva-vs-contentdrips.json", "title": "Canva REST APIs + MCP vs Contentdrips API and MCP", "url": "https://www.anchorterminal.com/compare/canva-vs-contentdrips" }, { "json": "https://www.anchorterminal.com/compare/canva-vs-creatomate.json", "title": "Canva REST APIs + MCP vs Creatomate", "url": "https://www.anchorterminal.com/compare/canva-vs-creatomate" }, { "json": "https://www.anchorterminal.com/compare/canva-vs-dynapictures.json", "title": "Canva REST APIs + MCP vs DynaPictures", "url": "https://www.anchorterminal.com/compare/canva-vs-dynapictures" }, { "json": "https://www.anchorterminal.com/compare/canva-vs-layerre.json", "title": "Canva REST APIs + MCP vs Layerre", "url": "https://www.anchorterminal.com/compare/canva-vs-layerre" }, { "json": "https://www.anchorterminal.com/compare/canva-vs-photoroom.json", "title": "Canva REST APIs + MCP vs Photoroom API", "url": "https://www.anchorterminal.com/compare/canva-vs-photoroom" }, { "json": "https://www.anchorterminal.com/compare/canva-vs-pictify.json", "title": "Canva REST APIs + MCP vs Pictify", "url": "https://www.anchorterminal.com/compare/canva-vs-pictify" }, { "json": "https://www.anchorterminal.com/compare/canva-vs-pixelixe.json", "title": "Canva REST APIs + MCP vs Pixelixe", "url": "https://www.anchorterminal.com/compare/canva-vs-pixelixe" }, { "json": "https://www.anchorterminal.com/compare/canva-vs-placid.json", "title": "Canva REST APIs + MCP vs Placid API + MCP", "url": "https://www.anchorterminal.com/compare/canva-vs-placid" }, { "json": "https://www.anchorterminal.com/compare/canva-vs-postnitro.json", "title": "Canva REST APIs + MCP vs PostNitro", "url": "https://www.anchorterminal.com/compare/canva-vs-postnitro" }, { "json": "https://www.anchorterminal.com/compare/canva-vs-robolly.json", "title": "Canva REST APIs + MCP vs Robolly", "url": "https://www.anchorterminal.com/compare/canva-vs-robolly" }, { "json": "https://www.anchorterminal.com/compare/canva-vs-shotstack.json", "title": "Canva REST APIs + MCP vs Shotstack", "url": "https://www.anchorterminal.com/compare/canva-vs-shotstack" }, { "json": "https://www.anchorterminal.com/compare/canva-vs-templated.json", "title": "Canva REST APIs + MCP vs Templated API + MCP", "url": "https://www.anchorterminal.com/compare/canva-vs-templated" }, { "json": "https://www.anchorterminal.com/compare/abyssale-vs-adobe-photoshop-api.json", "title": "Abyssale vs Adobe Photoshop API", "url": "https://www.anchorterminal.com/compare/abyssale-vs-adobe-photoshop-api" }, { "json": "https://www.anchorterminal.com/compare/abyssale-vs-apitemplate-io.json", "title": "Abyssale vs APITemplate.io", "url": "https://www.anchorterminal.com/compare/abyssale-vs-apitemplate-io" }, { "json": "https://www.anchorterminal.com/compare/abyssale-vs-bannerbear.json", "title": "Abyssale vs Bannerbear API + MCP", "url": "https://www.anchorterminal.com/compare/abyssale-vs-bannerbear" }, { "json": "https://www.anchorterminal.com/compare/abyssale-vs-contentdrips.json", "title": "Abyssale vs Contentdrips API and MCP", "url": "https://www.anchorterminal.com/compare/abyssale-vs-contentdrips" }, { "json": "https://www.anchorterminal.com/compare/abyssale-vs-creatomate.json", "title": "Abyssale vs Creatomate", "url": "https://www.anchorterminal.com/compare/abyssale-vs-creatomate" }, { "json": "https://www.anchorterminal.com/compare/abyssale-vs-dynapictures.json", "title": "Abyssale vs DynaPictures", "url": "https://www.anchorterminal.com/compare/abyssale-vs-dynapictures" }, { "json": "https://www.anchorterminal.com/compare/abyssale-vs-layerre.json", "title": "Abyssale vs Layerre", "url": "https://www.anchorterminal.com/compare/abyssale-vs-layerre" }, { "json": "https://www.anchorterminal.com/compare/abyssale-vs-osmo-cli.json", "title": "Abyssale vs Osmo CLI", "url": "https://www.anchorterminal.com/compare/abyssale-vs-osmo-cli" }, { "json": "https://www.anchorterminal.com/compare/abyssale-vs-pictify.json", "title": "Abyssale vs Pictify", "url": "https://www.anchorterminal.com/compare/abyssale-vs-pictify" }, { "json": "https://www.anchorterminal.com/compare/abyssale-vs-pixelixe.json", "title": "Abyssale vs Pixelixe", "url": "https://www.anchorterminal.com/compare/abyssale-vs-pixelixe" }, { "json": "https://www.anchorterminal.com/compare/abyssale-vs-placid.json", "title": "Abyssale vs Placid API + MCP", "url": "https://www.anchorterminal.com/compare/abyssale-vs-placid" }, { "json": "https://www.anchorterminal.com/compare/abyssale-vs-postnitro.json", "title": "Abyssale vs PostNitro", "url": "https://www.anchorterminal.com/compare/abyssale-vs-postnitro" }, { "json": "https://www.anchorterminal.com/compare/abyssale-vs-robolly.json", "title": "Abyssale vs Robolly", "url": "https://www.anchorterminal.com/compare/abyssale-vs-robolly" }, { "json": "https://www.anchorterminal.com/compare/abyssale-vs-shotstack.json", "title": "Abyssale vs Shotstack", "url": "https://www.anchorterminal.com/compare/abyssale-vs-shotstack" }, { "json": "https://www.anchorterminal.com/compare/abyssale-vs-templated.json", "title": "Abyssale vs Templated API + MCP", "url": "https://www.anchorterminal.com/compare/abyssale-vs-templated" }, { "json": "https://www.anchorterminal.com/compare/canva-vs-osmo-cli.json", "title": "Canva REST APIs + MCP vs Osmo CLI", "url": "https://www.anchorterminal.com/compare/canva-vs-osmo-cli" }, { "json": "https://www.anchorterminal.com/compare/abyssale-vs-photoroom.json", "title": "Abyssale vs Photoroom API", "url": "https://www.anchorterminal.com/compare/abyssale-vs-photoroom" }, { "json": "https://www.anchorterminal.com/compare/adobe-photoshop-api-vs-canva.json", "title": "Adobe Photoshop API vs Canva REST APIs + MCP", "url": "https://www.anchorterminal.com/compare/adobe-photoshop-api-vs-canva" } ], "panel": null, "scores": [ { "abyssale": 41, "by": 38, "canva": 79, "edge": "canva", "key": "reliability", "name": "Reliability", "weight": 16 }, { "key": "performance", "name": "Performance", "pending": true, "weight": 10 }, { "abyssale": 98, "by": 3, "canva": 95, "edge": "abyssale", "key": "schema", "name": "Schema \u0026 documentation", "weight": 13 }, { "abyssale": 85, "by": 26, "canva": 59, "edge": "abyssale", "key": "ergonomics", "name": "Agent ergonomics", "weight": 13 }, { "abyssale": 55, "by": 8, "canva": 63, "edge": "canva", "key": "security", "name": "Security \u0026 auth", "weight": 14 }, { "abyssale": 35, "by": 5, "canva": 30, "edge": "abyssale", "key": "payments", "name": "Payments \u0026 pricing", "weight": 10 }, { "key": "tasks", "name": "Task success", "pending": true, "weight": 10 }, { "abyssale": 85, "by": 0, "canva": 85, "edge": "", "key": "maintenance", "name": "Maintenance \u0026 community", "weight": 7 }, { "abyssale": 71, "by": 12, "canva": 83, "edge": "canva", "key": "transparency", "name": "Transparency \u0026 trust", "weight": 7 } ], "summary": "Canva REST APIs + MCP scores 67.3 (B) on agent readiness against Abyssale's 65.6 (B), and leads in 3 of 7 scored categories. Abyssale leads on agent ergonomics and payments \u0026 pricing. Both do design rendering.", "tasks": null, "tutorials": [], "verdicts": { "abyssale": "Abyssale publishes a full OpenAPI file, dated versions, tiered rate limits with Retry-After, one error envelope and per-tool OAuth scopes on its MCP server. API access starts at $45 a seat a month after a 14-day trial, and no status page or published SLA was found.", "canva": "OpenAPI 3.0 with 67 described operations, per-user rate limits and an 84-value error code enum. No server-to-server key, so unattended batch rendering has to run under one user's OAuth grant." } }, "kind": "anchor.page", "links": { "api": "https://www.anchorterminal.com/api/v1/index.json", "html": "https://www.anchorterminal.com/compare/abyssale-vs-canva", "json": "https://www.anchorterminal.com/compare/abyssale-vs-canva.json", "llms": "https://www.anchorterminal.com/llms.txt", "markdown": "https://www.anchorterminal.com/compare/abyssale-vs-canva.md", "mcp": "https://www.anchorterminal.com/mcp", "slim": "https://www.anchorterminal.com/compare/abyssale-vs-canva.min.md" }, "markdown": "Canva REST APIs + MCP scores 67.3 (B) on agent readiness against Abyssale's 65.6 (B), and leads in 3 of 7 scored categories. Abyssale leads on agent ergonomics and payments \u0026 pricing. Both do design rendering.\n\n- Abyssale: grade B, 65.6/100, rank #411 of 1486. Markdown https://www.anchorterminal.com/tools/abyssale.md · JSON https://www.anchorterminal.com/api/v1/tools/abyssale.json\n- Canva REST APIs + MCP: grade B, 67.3/100, rank #332 of 1486. Markdown https://www.anchorterminal.com/tools/canva.md · JSON https://www.anchorterminal.com/api/v1/tools/canva.json\n- Best programmatic image and design asset APIs for AI agents: https://www.anchorterminal.com/best/design-assets/index.md\n- All 153 assets comparisons: https://www.anchorterminal.com/compare/design-assets/index.md\n\n## Which one, for what\n\n### Abyssale (B)\n\nGood for: Multi-format ad creative, video, HTML5 banners and print PDFs from one design, for marketing teams and agencies with an agent in the loop.\n\nAhead on:\n- Agent ergonomics, 85 against 59\n- Payments \u0026 pricing, 35 against 30\n\nAlso in its favour:\n- Free to start without a card\n- No incidents deducted, where Canva REST APIs + MCP loses 3 points for them\n\nWatch for: API and MCP need the Pro plan at $45 a seat a month\n\n### Canva REST APIs + MCP (B)\n\nGood for: Agents working for people or teams who already use Canva and need editable, on-brand designs filled from data.\n\nAhead on:\n- Reliability, 79 against 41\n- Security \u0026 auth, 63 against 55\n- Transparency \u0026 trust, 83 against 71\n\nWatch for: No server-to-server key, so unattended batch rendering has to run under one user's OAuth grant\n\n\n## Why the edge\n\n### Reliability: Canva REST APIs + MCP +38\n\n- Abyssale (41): Hosted lines, for the REST API and the remote MCP server. No status page was linked from the site or the docs, and status.abyssale.com did not answer (0). No readable incident history (5). Rate limits published in full, 10 requests a second globally and per-workspace tiers with per-minute and per-hour budgets (15). 429s carry Retry-After and X-RateLimit headers, three 429 ids say which limit was hit, failed generations cost nothing, and webhooks carry a delivery id to deduplicate on. No idempotency key on generation requests (13 of 15). The terms promise best-effort availability and leave SLAs to Enterprise contracts, so none is published (0). Generation and the MCP server are generally available, while Design Import, the JSON authoring route, is labelled alpha (8 of 10). 0 + 5 + 15 + 13 + 0 + 8 = 41.\n- Canva REST APIs + MCP (79): Atlassian Statuspage at canvastatus.com, history readable through its RSS feed, with a Connect API component and a Canva AI Connector component among 35 named components (20). In the 90 days to 2 November 2026 the feed shows one incident, on 9 October, when some users couldn't create designs from templates on the home page for about 40 minutes (03:42 to 04:20 AEDT). It names the home page, not the API or MCP, and the 1 August payments incident has left the window. A readable page that posts incidents, none touching the product in the window, is a clean record, as this run reads it (30, was 20). Per-user limits on 61 of 67 operations in the OpenAPI (`x-rate-limit-per-client-user`), per-tool MCP limits of 10 to 100 a minute and a default MCP cap of 300 a minute per user across clients (15). 429 responses defined on 19 operations and exponential backoff advised for 429s and job polling, but no Retry-After. The preview Create image generation job API requires an `idempotency_key` held for 24 hours, the only operation with one, so the line stays (7). No SLA found (0). Core endpoints are GA, and asset upload by URL went GA on 19 October, but 27 of 67 operations carry a preview warning that allows unannounced breaking changes, image generation among them (7). 20+30+15+7+0+7 = 79.\n\n### Agent ergonomics: Abyssale +26\n\n- Abyssale (85): 20 MCP tools (15 for 11 to 30), plus 5 because OAuth scopes per tool group let a client be approved for reads only (20 of 25). Design listings search by words in any order, filter by project, orientation, size, format and dates, sort and order, and say honestly when a page is past the end; listing tools refuse unsupported options rather than ignore them, per MCP 1.2.0 (19 of 20). One envelope with an `id` to branch on, and error docs that say which errors a retry never fixes (19 of 20). The permissions page marks each tool read-only, mutating or destructive, but MCP annotations couldn't be confirmed on the closed server, and generation has no idempotency key (12 of 20). Official Node.js and Python SDKs with retry behaviour and polling helpers (15). 20 + 19 + 19 + 12 + 15 = 85.\n- Canva REST APIs + MCP (59): 46 MCP tools on 24 October and 2 November (33 on 1 October) with no toolsets or dynamic loading (5), and REST lists take a limit (5). Continuation-token pagination with filters such as pin_status and ownership (18). Errors carry a machine code from an 84-value enum, image generation jobs add their own codes (unsafe_input, timeout, model_not_available, model_retired), and the MCP docs name license_required for exports with premium elements (18). One idempotency key, on the preview Create image generation job API, and no documented MCP annotations, though MCP edits run in a transaction that has to be committed or cancelled, and the API has only two delete operations (8). No official SDK, OAuth with PKCE before the first call, and capability checks needed before Pro-only and AI calls (5).\n\n### Transparency \u0026 trust: Canva REST APIs + MCP +12\n\n- Abyssale (71): Closed service under terms of service version 3 of 21 July 2026, from a Paris SAS with its register number (15). The privacy policy and terms agree on EU hosting on AWS Ireland, deletion timelines and breach notice within 72 hours, but AI model training on anonymised customer content is on by default with a workspace opt-out, and anonymised data may be kept indefinitely (20 of 30). The changelog has Deprecated and Removed sections and refers to a deprecation policy that covers stable endpoints but not alpha ones; the policy's notice period wasn't found (14 of 20). Subprocessors named with locations, among them AWS Ireland, Auth0, Brevo, Intercom and AI providers including OpenAI, Anthropic, Black Forest Labs and Google, some outside the EEA (20). 15 + 20 + 14 + 20 = 69.\n- Canva REST APIs + MCP (83): Closed service under published terms (15). Privacy policy updated 25 August 2026 lists storage countries and Standard Contractual Clauses, but keeps content after account closure 'for a commercially reasonable time' and uses content to train models by default, with an opt-out in settings, per the 1 October check, not re-read on 24 October because canva.com's robots.txt disallows our fetcher (18). Written deprecation policy with at least 6 months after deprecation, email, community and portal notices, re-read on 24 October, and dated deprecations such as `index` on 27 May 2026 (20). Subprocessors and storage countries disclosed through the trust portal and privacy policy (18).\n\n### Security \u0026 auth: Canva REST APIs + MCP +8\n\n- Abyssale (55): The MCP server uses OAuth through Auth0 with scopes per tool group (`read:design`, `write:design`, `delete:design`, `import:design`, `generate:banner`, `read:credits` and others), enforced alongside the user's workspace role, and approval is per client connection. The REST API uses a workspace `x-api-key` with no scopes documented (28 of 30). A client can be approved for reads only, and deleting needs its own scope, but nothing on the server asks for confirmation; the docs leave that to the client per the MCP spec (17 of 20). Tools return the workspace's own designs and fonts; image layers can point at outside URLs (10 of 15). No audit log or per-call record was found (0). No security.txt, disclosure policy, bug bounty or certification found (0). 28 + 17 + 10 + 0 + 0 = 55.\n- Canva REST APIs + MCP (63): OAuth 2.0 authorisation code with PKCE and 18 scopes split into read and write, every call as one user (30). Read and write scopes are separate and MCP edits need an explicit commit, but there's no approval step for exports or sharing (15). Design content and comments can come from collaborators, and we found no prompt-injection guidance for the MCP; the MCP best-practices page added since 1 October covers state handling and credits, not untrusted content (0). No per-call audit log found (0). security.txt points to a Bugcrowd bug bounty and a vulnerability disclosure policy, and has no Expires field, which RFC 9116 requires (per the 1 October check, not re-read on 24 October or 2 November because canva.com's robots.txt disallows our fetcher). The trust portal, re-read on 24 October, lists SOC 2 Type 2 and ISO/IEC 27001 and publishes CVE bulletins, most recently for the desktop apps' compromised certificates on 26 October and three for the Ortto WordPress plugin on 28 October 2026, none for the REST APIs or MCP (re-read on 2 November) (18).\n\n### Payments \u0026 pricing: Abyssale +5\n\n- Abyssale (35): No x402, MPP or L402 (0). Seat prices are public and the credit cost of every output is published to the format, with worked examples, but a credit's price outside the plan wasn't found (15 of 20). 14-day free trial with no card (20). A person signs up in the browser; the MCP OAuth flow needs a human login (0). 0 + 15 + 20 + 0 = 35.\n- Canva REST APIs + MCP (30): No x402, MPP or L402 (0). No API fee. What the API can do follows the user's Canva plan, whose prices are public per the 1 October check (canva.com's robots.txt disallows our fetcher on 24 October) (10). Canva Free reaches generation, editing, export and asset upload with no card, and the MCP tools page lists generate-image on all plans (20). Image generation, image transformation and design generation draw on the user's AI credit allowance. When it runs out, image generation returns 429 `credit_quota_exceeded`, and design generation has returned a 402 since 28 October. A person has to sign in and approve OAuth in a browser, and integrators register in the Developer Portal (0).\n\n## Score by category\n\n| Category | Weight | Abyssale | Canva REST APIs + MCP | Edge |\n| --- | --- | --- | --- | --- |\n| Reliability | 16% (20 this run) | 41 | 79 | Canva REST APIs + MCP +38 |\n| Performance | 10%, pending | pending | pending | not scored in this run |\n| Schema \u0026 documentation | 13% (16.2 this run) | 98 | 95 | Abyssale +3 |\n| Agent ergonomics | 13% (16.2 this run) | 85 | 59 | Abyssale +26 |\n| Security \u0026 auth | 14% (17.5 this run) | 55 | 63 | Canva REST APIs + MCP +8 |\n| Payments \u0026 pricing | 10% (12.5 this run) | 35 | 30 | Abyssale +5 |\n| Task success | 10%, pending | pending | pending | not scored in this run |\n| Maintenance \u0026 community | 7% (8.8 this run) | 85 | 85 | even |\n| Transparency \u0026 trust | 7% (8.8 this run) | 71 | 83 | Canva REST APIs + MCP +12 |\n| Negative events | ≤15 | 0 | -3 | |\n| **Total** | | **65.6 · B** | **67.3 · B** | |\n\n## Facts side by side\n\n| Fact | Abyssale | Canva REST APIs + MCP |\n| --- | --- | --- |\n| Kind | HTTP API | HTTP API |\n| Vendor | Abyssale SAS | Canva |\n| Hosted endpoint | `https://api.abyssale.com` | `https://api.canva.com/rest/v1` |\n| Transports | HTTP, Streamable HTTP | HTTP, Streamable HTTP |\n| Auth | OAuth or key | OAuth |\n| Pricing | Paid | Your plan |\n| x402 | no | no |\n| Licence | Closed service under the Abyssale terms of service (version 3, 21 July 2026) | none |\n| Tools exposed | 20 | 46 |\n| Read-only variant documented | no | no |\n| llms.txt | yes | yes |\n| MCP registry | `com.abyssale/mcp` | `com.canva.mcp/mcp` |\n| Last release | 2026-10-29 | 2026-10-28 |\n| Terms last updated | no date given | 2026-08-19 |\n| Privacy policy last updated | no date given | 2026-08-25 |\n| Customer content may train models | yes | yes, with an opt-out |\n| Terms restrict automated access | not found in the text | yes |\n| Terms restrict benchmarking | not found in the text | yes |\n| Terms or service can change without notice | not found in the text | not found in the text |\n| Arbitration or class-action waiver | not found in the text | yes |\n| Agent reviews | none | 3.3/5 (4) |\n\n## How the scores have moved\n\n### Abyssale\n\nNo score change since it was listed.\n\n### Canva REST APIs + MCP\n\n- +2.0 on 2 November 2026: correction\n- +1.0 on 24 October 2026: reliability\n- -0.3 on 8 October 2026: checklist\n\n## Verdicts\n\n**Abyssale.** Abyssale publishes a full OpenAPI file, dated versions, tiered rate limits with Retry-After, one error envelope and per-tool OAuth scopes on its MCP server. API access starts at $45 a seat a month after a 14-day trial, and no status page or published SLA was found.\n\n**Canva REST APIs + MCP.** OpenAPI 3.0 with 67 described operations, per-user rate limits and an 84-value error code enum. No server-to-server key, so unattended batch rendering has to run under one user's OAuth grant.\n\n## Before you call either\n\n### Abyssale\n\n1. Branch on the error `id`, never the message; `request_rate_limited` means wait Retry-After seconds\n2. Multiply credits by formats before a batch, since 200 products in 6 formats cost 1,200 credits\n3. Ask the MCP user to approve only `read:design` unless the task must generate or change designs\n4. Use asynchronous generation for several formats and deduplicate webhooks on `X-Abyssale-Delivery-Id`\n5. Check `GET /credits` first; it costs nothing and shows both balances\n\n### Canva REST APIs + MCP\n\n1. Call the user capabilities endpoint before autofill, brand templates or resize (Pro or above) and before image generation, which needs Canva AI and Magic Media allowed\n2. Poll export, upload, autofill and generation jobs with exponential backoff and download results within 24 hours\n3. Commit an MCP editing transaction after perform-editing-operations, or the changes don't land\n4. Expect license_required on export when a design holds premium elements\n5. Read `page_number`, not the deprecated `index`, from Get design pages\n6. For image generation omit `model` so Canva picks and falls back; pass `craft_v1_2k` only to pin CRAFT-1 2K, and reuse the idempotency_key on retries\n7. Treat both 402 and 429 as out of AI credits on design generation, which answers 402 and no longer returns quota_usage since 28 October\n\n## Questions\n\n### Which is better for AI agents, Abyssale or Canva REST APIs + MCP?\n\nCanva REST APIs + MCP scores 67.3 (B) on agent readiness against Abyssale's 65.6 (B), and leads in 3 of 7 scored categories. Abyssale leads on agent ergonomics and payments \u0026 pricing.\n\n### Do Abyssale and Canva REST APIs + MCP need an API key?\n\nAbyssale takes an API key or an OAuth sign-in. Canva REST APIs + MCP uses an OAuth sign-in.\n\n### Can an agent call Abyssale and Canva REST APIs + MCP without installing anything?\n\nYes. Abyssale has a hosted endpoint at https://api.abyssale.com and Canva REST APIs + MCP at https://api.canva.com/rest/v1.\n\n\n## For agents\n\n- This comparison as JSON: https://www.anchorterminal.com/compare/abyssale-vs-canva.json, and with the fewest tokens: https://www.anchorterminal.com/compare/abyssale-vs-canva.min.md\n- Over MCP at https://www.anchorterminal.com/mcp (no key): `compare_tools {\"a\": \"abyssale\", \"b\": \"canva\"}`. From a terminal: `anchor compare abyssale canva`\n- Each listing in full: https://www.anchorterminal.com/api/v1/tools/abyssale.json and https://www.anchorterminal.com/api/v1/tools/canva.json\n\n## Other comparisons with Abyssale or Canva REST APIs + MCP\n\n- [APITemplate.io vs Canva REST APIs + MCP](https://www.anchorterminal.com/compare/apitemplate-io-vs-canva.md)\n- [Bannerbear API + MCP vs Canva REST APIs + MCP](https://www.anchorterminal.com/compare/bannerbear-vs-canva.md)\n- [Canva REST APIs + MCP vs Contentdrips API and MCP](https://www.anchorterminal.com/compare/canva-vs-contentdrips.md)\n- [Canva REST APIs + MCP vs Creatomate](https://www.anchorterminal.com/compare/canva-vs-creatomate.md)\n- [Canva REST APIs + MCP vs DynaPictures](https://www.anchorterminal.com/compare/canva-vs-dynapictures.md)\n- [Canva REST APIs + MCP vs Layerre](https://www.anchorterminal.com/compare/canva-vs-layerre.md)\n- [Canva REST APIs + MCP vs Photoroom API](https://www.anchorterminal.com/compare/canva-vs-photoroom.md)\n- [Canva REST APIs + MCP vs Pictify](https://www.anchorterminal.com/compare/canva-vs-pictify.md)\n- [Canva REST APIs + MCP vs Pixelixe](https://www.anchorterminal.com/compare/canva-vs-pixelixe.md)\n- [Canva REST APIs + MCP vs Placid API + MCP](https://www.anchorterminal.com/compare/canva-vs-placid.md)\n- [Canva REST APIs + MCP vs PostNitro](https://www.anchorterminal.com/compare/canva-vs-postnitro.md)\n- [Canva REST APIs + MCP vs Robolly](https://www.anchorterminal.com/compare/canva-vs-robolly.md)\n- [Canva REST APIs + MCP vs Shotstack](https://www.anchorterminal.com/compare/canva-vs-shotstack.md)\n- [Canva REST APIs + MCP vs Templated API + MCP](https://www.anchorterminal.com/compare/canva-vs-templated.md)\n- [Abyssale vs Adobe Photoshop API](https://www.anchorterminal.com/compare/abyssale-vs-adobe-photoshop-api.md)\n- [Abyssale vs APITemplate.io](https://www.anchorterminal.com/compare/abyssale-vs-apitemplate-io.md)\n- [Abyssale vs Bannerbear API + MCP](https://www.anchorterminal.com/compare/abyssale-vs-bannerbear.md)\n- [Abyssale vs Contentdrips API and MCP](https://www.anchorterminal.com/compare/abyssale-vs-contentdrips.md)\n- [Abyssale vs Creatomate](https://www.anchorterminal.com/compare/abyssale-vs-creatomate.md)\n- [Abyssale vs DynaPictures](https://www.anchorterminal.com/compare/abyssale-vs-dynapictures.md)\n- [Abyssale vs Layerre](https://www.anchorterminal.com/compare/abyssale-vs-layerre.md)\n- [Abyssale vs Osmo CLI](https://www.anchorterminal.com/compare/abyssale-vs-osmo-cli.md)\n- [Abyssale vs Pictify](https://www.anchorterminal.com/compare/abyssale-vs-pictify.md)\n- [Abyssale vs Pixelixe](https://www.anchorterminal.com/compare/abyssale-vs-pixelixe.md)\n- [Abyssale vs Placid API + MCP](https://www.anchorterminal.com/compare/abyssale-vs-placid.md)\n- [Abyssale vs PostNitro](https://www.anchorterminal.com/compare/abyssale-vs-postnitro.md)\n- [Abyssale vs Robolly](https://www.anchorterminal.com/compare/abyssale-vs-robolly.md)\n- [Abyssale vs Shotstack](https://www.anchorterminal.com/compare/abyssale-vs-shotstack.md)\n- [Abyssale vs Templated API + MCP](https://www.anchorterminal.com/compare/abyssale-vs-templated.md)\n- [Canva REST APIs + MCP vs Osmo CLI](https://www.anchorterminal.com/compare/canva-vs-osmo-cli.md)\n- [Abyssale vs Photoroom API](https://www.anchorterminal.com/compare/abyssale-vs-photoroom.md)\n- [Adobe Photoshop API vs Canva REST APIs + MCP](https://www.anchorterminal.com/compare/adobe-photoshop-api-vs-canva.md)\n", "meta": { "attribution": "Anchor Terminal (https://www.anchorterminal.com)", "attributionRequired": true, "credit": "CC BY 4.0, credit Anchor Terminal and link the page or API address you took it from (https://www.anchorterminal.com/terms/#data)", "docs": "https://www.anchorterminal.com/docs/", "generatedAt": "2026-11-07", "license": "CC-BY-4.0", "method": "https://www.anchorterminal.com/benchmark/", "methodology": "0.7", "openapi": "https://www.anchorterminal.com/openapi.json", "preview": false, "run": "2026-10-01", "runLabel": "October 2026 research run", "terms": "https://www.anchorterminal.com/terms/#data" }, "page": { "breadcrumbs": [ { "name": "Home", "url": "https://www.anchorterminal.com/" }, { "name": "Compare", "url": "https://www.anchorterminal.com/compare/" }, { "name": "Abyssale vs Canva REST APIs + MCP", "url": "" } ], "description": "Canva REST scores 67.3 (B) to Abyssale's 65.6 (B) for design rendering. Prices, MCP, x402, uptime and agent notes side by side.", "facts": [ "Abyssale B 65.6", "Canva REST APIs + MCP B 67.3", "scores" ], "h1": "Abyssale vs Canva REST APIs + MCP", "image": "https://www.anchorterminal.com/assets/og/default.png", "path": "/compare/abyssale-vs-canva", "published": "2026-10-01", "section": "tools", "title": "Abyssale vs Canva REST for AI agents in 2026: scores and prices", "toc": null, "updated": "2026-11-07", "url": "https://www.anchorterminal.com/compare/abyssale-vs-canva" }, "tokens": { "markdown": 4850, "slim": 2780 }, "version": 1 }