{ "data": { "a": { "slug": "canva", "name": "Canva REST APIs + MCP", "vendor": "Canva", "vendorUrl": "https://www.canva.dev", "kind": "http-api", "category": "design-assets", "summary": "Canva's REST APIs and hosted MCP server connect applications and agents to its design platform.", "url": "https://www.anchorterminal.com/tools/canva", "markdownUrl": "https://www.anchorterminal.com/tools/canva.md", "slimMarkdownUrl": "https://www.anchorterminal.com/tools/canva.min.md", "jsonUrl": "https://www.anchorterminal.com/api/v1/tools/canva.json", "dns": "canva.grade.anchorterminal.com", "transports": [ "http", "streamable-http" ], "remoteUrl": "https://api.canva.com/rest/v1", "packages": [], "auth": "oauth", "authNotes": "OAuth 2.0 authorisation code flow with PKCE (S256) against https://www.canva.com/api/oauth/authorize, with scopes such as design:content, asset:read and brandtemplate:meta chosen per app in the Developer Portal. Every call runs as one Canva user, so there's no server-to-server key. The MCP server also uses per-user OAuth. Integrators create an app in the Developer Portal and turn on Canva MCP, which issues a client ID and secret straight away; no waitlist was found on canva.dev on 24 October 2026.", "pricing": "byo-plan", "pricingNotes": "No separate API fee. What the API and MCP can do follows the user's Canva plan. Free covers design generation, image generation, editing, search, export, comments and asset upload. Pro, Business and Enterprise add autofill, brand templates, brand kits, resize and pro-quality export. Image generation, image transformation and design generation (preview APIs) consume the user's AI credit allowance. When it runs out, image generation returns a 429 and, since 28 October 2026, design generation returns a 402. Private apps need Enterprise (https://www.canva.com/pricing/, https://www.canva.dev/docs/apps/rest-apis/reference/generations/create-image-generation-job/).", "priceSummary": "Your plan", "where": "hosted", "x402": { "level": "no", "evidence": "Per-user OAuth on Canva plans. No x402 in the docs or OpenAPI description (checked 2026-09-30).", "endpoints": [] }, "toolCount": 46, "popularity": { "githubStars": null, "npmWeekly": null, "pypiWeekly": null, "asOf": "2026-09-30" }, "docsUrl": "https://www.canva.dev/docs/apps/rest-apis/", "llmsTxt": "https://www.canva.dev/llms.txt", "openapi": "https://www.canva.dev/sources/connect/api/latest/api.yml", "registryName": "com.canva.mcp/mcp", "capabilities": [ "design.templates", "design.render", "design.brand", "video.render", "image.generate", "image.edit" ], "tags": [ "hosted", "closed-source", "mcp", "llms-txt", "openapi", "async-jobs", "webhooks" ], "lastRelease": "2026-10-28", "graded": true, "anchor": { "graded": true, "score": 67.3, "grade": "B", "agentReady": false, "rank": 333, "ranked": true, "rankOf": 1510, "categoryRank": 1, "methodology": "0.7", "run": "2026-10-01", "scores": { "ergonomics": 59, "maintenance": 85, "payments": 30, "reliability": 79, "schema": 95, "security": 63, "transparency": 83 }, "pending": [ "performance", "tasks" ], "assessment": { "confidence": "medium", "date": "2026-11-02" }, "negative": -3, "negativeNotes": [ "2026-09-18 and 2026-10-28. The MP4 `quality` parameter on the GA export job API changed from a fixed output size to a target pixel count without a new API version, which the deprecation policy requires for breaking changes; Canva logged it the same day as a bug fix. On 28 October the preview Create and Get design generation job APIs dropped `quota_usage` from the response and moved the out-of-credit answer from 429 to 402, posted the day it took effect. Same-day changes fold into one term, kept at the low end. https://www.canva.dev/docs/apps/rest-apis/changelog/" ], "verdict": "OpenAPI 3.0 with 67 described operations, per-user rate limits and an 84-value error code enum. No server-to-server key, so unattended batch rendering has to run under one user's OAuth grant.", "bestFor": "Agents working for people or teams who already use Canva and need editable, on-brand designs filled from data.", "strengths": [ "OpenAPI 3.0 with 67 described operations, per-user rate limits and an 84-value error code enum", "OAuth with PKCE and 18 read and write scopes, every action attributable to one user", "Written deprecation policy with at least 6 months' notice and a dated changelog updated on 28 October 2026", "Bugcrowd bug bounty, disclosure policy, SOC 2 Type 2, ISO 27001 and public CVE bulletins", "Exports to PNG, JPG, GIF, PDF, PPTX, MP4 and HTML, and the result stays editable in Canva", "Image generation API (preview) with Canva's own CRAFT-1 2K model, an idempotency key and per-job error codes" ], "weaknesses": [ "No server-to-server key, so unattended batch rendering has to run under one user's OAuth grant", "27 of 67 operations are preview and can change without a new version, image generation among them", "MP4 export quality changed meaning on 18 September 2026 without a new API version, and a preview API's out-of-credit answer moved from 429 to 402 on the day it was posted", "Content is used to train Canva's models by default unless the user opts out in settings", "No official SDK, and MCP edits need a start, operate and commit sequence" ], "agentNotes": [ "Call the user capabilities endpoint before autofill, brand templates or resize (Pro or above) and before image generation, which needs Canva AI and Magic Media allowed", "Poll export, upload, autofill and generation jobs with exponential backoff and download results within 24 hours", "Commit an MCP editing transaction after perform-editing-operations, or the changes don't land", "Expect license_required on export when a design holds premium elements", "Read `page_number`, not the deprecated `index`, from Get design pages", "For image generation omit `model` so Canva picks and falls back; pass `craft_v1_2k` only to pin CRAFT-1 2K, and reuse the idempotency_key on retries", "Treat both 402 and 429 as out of AI credits on design generation, which answers 402 and no longer returns quota_usage since 28 October" ], "metrics": { "kind": "remote", "measured": false }, "reviewCount": 4, "avgRating": 3.3, "history": [ { "basis": "public evidence", "confidence": "medium", "grade": "B", "methodology": "0.7", "pending": [ "performance", "tasks" ], "run": "2026-10-01", "runLabel": "October 2026 research run", "score": 67.3 } ], "editorialScores": { "ergonomics": 59, "maintenance": 85, "payments": 30, "reliability": 79, "schema": 95, "security": 63, "transparency": 71 }, "provenanceScore": 95, "checked": { "categories": { "ergonomics": "2026-11-02", "maintenance": "2026-11-02", "payments": "2026-11-02", "reliability": "2026-11-02", "schema": "2026-11-02", "security": "2026-11-02", "transparency": "2026-11-02" }, "last": "2026-11-02", "lastMoved": "2026-11-02", "oldest": "2026-11-02", "stale": false, "staleAfterDays": 90 } }, "connect": { "http": "curl https://api.canva.com/rest/v1/users/me -H \"Authorization: Bearer $CANVA_ACCESS_TOKEN\"", "claudeCode": "claude mcp add --transport http canva https://mcp.canva.com/mcp" }, "letme": { "capability": "https://letme.dev/design.templates", "tool": "https://letme.dev/canva" }, "area": "design-diagrams", "provenance": { "legalEntity": "Canva Pty Ltd", "domain": "canva.com", "domainRegistered": "2001-05-05", "endpointOnVendorDomain": true, "terms": "https://www.canva.com/policies/terms-of-use/", "privacy": "https://www.canva.com/policies/privacy-policy/", "statusPage": "https://www.canvastatus.com", "changelog": "https://www.canva.dev/docs/apps/rest-apis/changelog/", "securityTxt": "valid", "checked": "2026-11-02", "notes": [ "Developer docs live on canva.dev. The API is served from api.canva.com", "security.txt lists a bug bounty, disclosure policy and trust centre but has no Expires field (per the 1 October check)", "On 24 October and 2 November 2026 canva.com's robots.txt disallows ClaudeBot, anthropic-ai and Claude-Web, so the terms, privacy policy, pricing and security.txt weren't re-read; canva.dev, canvastatus.com and trust.canva.com were" ], "score": 95 }, "pageJsonUrl": "https://www.anchorterminal.com/tools/canva.json", "live": { "slug": "canva", "probe": { "target": "https://api.canva.com/rest/v1", "method": "get", "lastAt": "2026-11-07T19:21:58.374216082Z", "lastOk": true, "lastStatus": 404, "lastMs": 246, "authRequired": false, "uptime24h": 100, "uptime30d": 100, "p50ms24h": 131, "p95ms24h": 225, "samples24h": 238, "samples30d": 7920, "days": [ { "date": "2026-10-07", "probes": 272, "ok": 272 }, { "date": "2026-10-08", "probes": 268, "ok": 268 }, { "date": "2026-10-09", "probes": 250, "ok": 250 }, { "date": "2026-10-10", "probes": 247, "ok": 247 }, { "date": "2026-10-11", "probes": 247, "ok": 247 }, { "date": "2026-10-12", "probes": 247, "ok": 247 }, { "date": "2026-10-13", "probes": 248, "ok": 248 }, { "date": "2026-10-14", "probes": 249, "ok": 249 }, { "date": "2026-10-15", "probes": 253, "ok": 253 }, { "date": "2026-10-16", "probes": 252, "ok": 252 }, { "date": "2026-10-17", "probes": 253, "ok": 253 }, { "date": "2026-10-18", "probes": 256, "ok": 256 }, { "date": "2026-10-19", "probes": 255, "ok": 255 }, { "date": "2026-10-20", "probes": 252, "ok": 252 }, { "date": "2026-10-21", "probes": 253, "ok": 253 }, { "date": "2026-10-22", "probes": 253, "ok": 253 }, { "date": "2026-10-23", "probes": 248, "ok": 248 }, { "date": "2026-10-24", "probes": 251, "ok": 251 }, { "date": "2026-10-25", "probes": 250, "ok": 250 }, { "date": "2026-10-26", "probes": 252, "ok": 252 }, { "date": "2026-10-27", "probes": 249, "ok": 249 }, { "date": "2026-10-28", "probes": 251, "ok": 251 }, { "date": "2026-10-29", "probes": 249, "ok": 249 }, { "date": "2026-10-30", "probes": 248, "ok": 248 }, { "date": "2026-10-31", "probes": 251, "ok": 251 }, { "date": "2026-11-01", "probes": 249, "ok": 249 }, { "date": "2026-11-02", "probes": 250, "ok": 250 }, { "date": "2026-11-03", "probes": 248, "ok": 248 }, { "date": "2026-11-04", "probes": 246, "ok": 246 }, { "date": "2026-11-05", "probes": 185, "ok": 185 }, { "date": "2026-11-06", "probes": 241, "ok": 241 }, { "date": "2026-11-07", "probes": 197, "ok": 197 } ] }, "vendorStatus": { "page": "https://www.canvastatus.com", "indicator": "none", "summary": "All Systems Operational", "checkedAt": "2026-11-07T19:21:09.290531702Z" }, "versions": [ { "registry": "mcp-registry", "name": "com.canva.mcp/mcp", "version": "1.0.0", "seenAt": "2026-11-07T18:16:28.95801333Z" } ], "securityTxt": { "url": "https://canva.com/.well-known/security.txt", "state": "valid", "checkedAt": "2026-11-07T16:01:15.107047366Z" }, "llmsTxt": { "url": "https://www.canva.dev/llms.txt", "ok": true, "status": 200, "checkedAt": "2026-11-07T15:31:45.899040349Z" }, "domain": { "domain": "canva.com", "registered": "2001-05-05", "source": "https://rdap.verisign.com/com/v1/domain/canva.com", "checkedAt": "2026-11-01T14:07:36.016608314Z" }, "pages": [ { "url": "https://www.canva.dev/docs/apps/rest-apis/changelog/", "kind": "deprecations", "status": 304, "checkedAt": "2026-11-07T14:26:25.072332614Z", "changedAt": "2026-11-06T13:47:27.399490993Z", "fingerprint": "7cba6e86c4be" }, { "url": "https://www.canva.dev/docs/apps/llms.txt", "kind": "deprecations", "status": 304, "checkedAt": "2026-11-07T14:26:23.03331506Z", "changedAt": "2026-11-06T13:47:25.224428925Z", "fingerprint": "bcef90ff7f51" }, { "url": "https://www.canva.com/pricing/", "kind": "pricing", "status": 200, "checkedAt": "2026-11-07T14:26:27.12265415Z", "changedAt": "0001-01-01T00:00:00Z", "fingerprint": "9fd21481e687" }, { "url": "https://www.canva.com/policies/privacy-policy/", "kind": "privacy", "status": 200, "checkedAt": "2026-11-07T14:26:22.508254842Z", "changedAt": "2026-11-02T07:30:51.467266879Z", "fingerprint": "1003a84193bf" }, { "url": "https://www.canva.com/policies/terms-of-use/", "kind": "terms", "status": 200, "checkedAt": "2026-11-07T14:26:25.464499782Z", "changedAt": "2026-10-30T05:53:44.125586725Z", "fingerprint": "966159c50855" } ], "mcpTools": { "url": "https://mcp.canva.com/mcp", "checkedAt": "2026-11-07T01:43:04.356309103Z", "status": "auth", "note": "asks for credentials before listing its tools", "changedAt": "2026-11-07T01:43:04.356309103Z" }, "updatedAt": "2026-11-07T19:21:58.374216082Z" } }, "answer": "Canva REST APIs + MCP scores 67.3 (B) on agent readiness against DynaPictures's 43.2 (E), and leads in 6 of 7 scored categories.", "b": { "slug": "dynapictures", "name": "DynaPictures", "vendor": "DynaPictures GmbH", "vendorUrl": "https://dynapictures.com", "kind": "http-api", "category": "design-assets", "summary": "DynaPictures, from DynaPictures GmbH in Freiburg, fills templates made in its no-code editor with data to produce images, multi-page PDFs, countdown timer GIFs and AI images, through a REST API, image URLs, forms and a remote MCP server.", "url": "https://www.anchorterminal.com/tools/dynapictures", "markdownUrl": "https://www.anchorterminal.com/tools/dynapictures.md", "slimMarkdownUrl": "https://www.anchorterminal.com/tools/dynapictures.min.md", "jsonUrl": "https://www.anchorterminal.com/api/v1/tools/dynapictures.json", "dns": "dynapictures.grade.anchorterminal.com", "license": "Closed service under the DynaPictures terms of use (revision 2/2026)", "transports": [ "http", "streamable-http" ], "remoteUrl": "https://api.dynapictures.com", "packages": [], "auth": "api-key", "authNotes": "One API key per user, copied from the account page and sent as `Authorization: Bearer`, for both the REST API and the MCP server at mcp.dynapictures.com/mcp. The key carries the user's full access, with no workspace or action limits, and a new key is requested by email. No OAuth.", "pricing": "freemium", "pricingNotes": "Free plan, and a 14-day trial with 30 API credits, neither needing a card. Lite from 250 images a month and Pro from 2,000, priced through a FastSpring checkout whose amounts are drawn by script. One credit per image or PDF page. AI credit packs from $20 for 1,000 credits (about 250 images), which never expire.", "priceSummary": "$0.02 / credit", "where": "hosted", "x402": { "level": "no", "evidence": "Subscriptions and credit packs through FastSpring. No x402, MPP or L402 in the OpenAPI, llms.txt, auth.md or the agent skill (checked 2026-11-06). A spent quota returns 403 and missing AI credits 402, with no payment requirements.", "endpoints": [] }, "toolCount": null, "popularity": { "githubStars": null, "npmWeekly": null, "pypiWeekly": null, "asOf": "2026-11-06" }, "docsUrl": "https://dynapictures.com/docs/", "llmsTxt": "https://dynapictures.com/llms.txt", "openapi": "https://dynapictures.com/openapi.json", "capabilities": [ "design.templates", "design.render", "pdf.generate", "image.generate" ], "tags": [ "hosted", "openapi", "llms-txt", "mcp", "remote-mcp", "api-key", "freemium", "free-tier", "no-card", "sla", "eu" ], "graded": true, "anchor": { "graded": true, "score": 43.2, "grade": "E", "agentReady": false, "rank": 1257, "ranked": true, "rankOf": 1510, "categoryRank": 13, "methodology": "0.7", "run": "2026-10-01", "scores": { "ergonomics": 45, "maintenance": 4, "payments": 30, "reliability": 42, "schema": 82, "security": 26, "transparency": 63 }, "pending": [ "performance", "tasks" ], "assessment": { "confidence": "medium", "date": "2026-11-06" }, "negative": 0, "verdict": "An OpenAPI 3.1 file, an agent skill and a six-month removal notice with Sunset headers make DynaPictures' template rendering easy to plan around, with a free plan and no-card trial. The single API key opens the whole account, requests aren't idempotent, and no changelog, status page or dated release was found.", "bestFor": "Personalised images and PDFs per record, image URLs in emails and pages, and email countdown timers, for marketing teams in the EU.", "strengths": [ "OpenAPI 3.1 with 20 paths, llms.txt, auth.md and an agent skill written for agents", "Removals announced six months ahead with Deprecation and Sunset headers", "Free plan and a 14-day trial with 30 API credits, no card", "Identical image URLs return a cached image without using another credit", "Terms guarantee 94 per cent annual availability; AI sub-processors named in the privacy policy" ], "weaknesses": [ "One API key per user with full account access and no scopes; a new key needs an email to support", "Generation requests aren't idempotent, so a retry can spend a second credit", "No changelog, status page or dated release found", "The docs' Errors section is unedited template text", "Not in the official MCP registry, and plan prices are drawn by script" ], "agentNotes": [ "Use `GET /templates` to find a template UID and its layer names before generating", "Check whether an image exists before retrying a timed-out `POST /designs/{UID}`; retries can be charged", "Treat 403 as a spent quota or expired trial and stop; wait for `Retry-After` only on 503", "Poll `GET /ai/generate/{jobUid}` about every 2 seconds and download the result, since the URL may expire", "Keep the API key out of image URLs; use signed or public links for embedding" ], "metrics": { "kind": "remote", "measured": false }, "reviewCount": 0, "avgRating": 0, "history": [ { "basis": "public evidence", "confidence": "medium", "grade": "E", "methodology": "0.7", "pending": [ "performance", "tasks" ], "run": "2026-10-01", "runLabel": "October 2026 research run", "score": 43.2 } ], "editorialScores": { "ergonomics": 45, "maintenance": 4, "payments": 30, "reliability": 42, "schema": 82, "security": 26, "transparency": 63 }, "provenanceScore": 63, "checked": { "categories": { "ergonomics": "2026-11-06", "maintenance": "2026-11-06", "payments": "2026-11-06", "reliability": "2026-11-06", "schema": "2026-11-06", "security": "2026-11-06", "transparency": "2026-11-06" }, "last": "2026-11-06", "oldest": "2026-11-06", "stale": false, "staleAfterDays": 90 } }, "connect": { "http": "curl https://api.dynapictures.com/workspaces -H \"Authorization: Bearer YOUR_API_KEY\"", "config": { "mcpServers": { "dynapictures": { "headers": { "Authorization": "Bearer YOUR_API_KEY" }, "url": "https://mcp.dynapictures.com/mcp" } } } }, "letme": { "capability": "https://letme.dev/design.templates", "tool": "https://letme.dev/dynapictures" }, "area": "design-diagrams", "unitPrices": [ { "item": "AI credit pack", "unit": "credit", "usd": 0.02, "note": "$20 for 1,000 AI credits, about 250 AI images; packs never expire" } ], "provenance": { "legalEntity": "DynaPictures GmbH", "domain": "dynapictures.com", "domainRegistered": "2021-03-14", "endpointOnVendorDomain": true, "terms": "https://dynapictures.com/p/terms", "privacy": "https://dynapictures.com/p/privacy-policy", "statusPage": "", "changelog": "", "securityTxt": "none", "checked": "2026-11-06", "notes": [ "The terms (revision 2/2026) and privacy policy name DynaPictures GmbH, Zasiusstr. 6a, 79102 Freiburg im Breisgau, Germany. The terms apply to business customers only and guarantee 94 per cent annual availability.", "No clause on automated access to the website was found in the terms.", "dynapictures.com/robots.txt disallows only the /tools/r/ paths. api.dynapictures.com/robots.txt answers 401.", "RDAP gives dynapictures.com a registration date of 14 March 2021.", "/.well-known/security.txt returns 404. No status page or changelog found." ], "score": 63 }, "pageJsonUrl": "https://www.anchorterminal.com/tools/dynapictures.json", "live": { "slug": "dynapictures", "probe": { "target": "https://api.dynapictures.com", "method": "get", "lastAt": "2026-11-07T19:22:04.384664691Z", "lastOk": true, "lastStatus": 200, "lastMs": 356, "authRequired": false, "uptime24h": 100, "uptime30d": 100, "p50ms24h": 221, "p95ms24h": 339, "samples24h": 210, "samples30d": 210, "days": [ { "date": "2026-11-06", "probes": 13, "ok": 13 }, { "date": "2026-11-07", "probes": 197, "ok": 197 } ] }, "securityTxt": { "url": "https://dynapictures.com/.well-known/security.txt", "state": "none", "checkedAt": "2026-11-07T16:01:15.164343855Z" }, "llmsTxt": { "url": "https://dynapictures.com/llms.txt", "ok": true, "status": 200, "checkedAt": "2026-11-07T15:32:20.007030228Z" }, "pages": [ { "url": "https://dynapictures.com/p/privacy-policy", "kind": "privacy", "status": 200, "checkedAt": "2026-11-07T14:09:06.124953966Z", "changedAt": "0001-01-01T00:00:00Z", "fingerprint": "ef81a0377c7a" }, { "url": "https://dynapictures.com/p/terms", "kind": "terms", "status": 200, "checkedAt": "2026-11-07T14:09:08.231434531Z", "changedAt": "0001-01-01T00:00:00Z", "fingerprint": "6e15c5e4788d" } ], "mcpTools": { "url": "https://mcp.dynapictures.com/mcp", "checkedAt": "2026-11-07T01:43:58.466398541Z", "status": "error", "note": "Post \"https://mcp.dynapictures.com/mcp\": dial tcp: lookup mcp.dynapictures.com on 192.168.1.1:53: no such host", "changedAt": "2026-11-07T01:43:58.466398541Z" }, "updatedAt": "2026-11-07T19:22:04.384664691Z" } }, "edges": [ { "by": 81, "category": "maintenance", "leads": "canva", "name": "Maintenance \u0026 community", "reasons": { "a": "Newest changelog entry 28 October 2026 (30). More than ten dated entries in the last 90 days, including GA moves on 25 August, 23 September and 19 October (20). Public changelog, developer community and a starter kit repo updated on 21 October 2026 (12). MCP server listed in the official registry as com.canva.mcp/mcp, active, published 25 September 2026, re-read on 2 November (15). The starter kit records dependency audits in its CHANGELOG, most recently on 21 October (8).", "b": "No changelog, release notes or dated API change was found, and the MCP server card gives version 1.0.0 with no date (0). No dated changes since 8 August (0). Support by email and contact form, not tested (4 of 15). Not in the official MCP registry and no API SDKs (0). No public package or repository (0). 0 + 0 + 4 + 0 + 0 = 4." }, "scores": { "a": 85, "b": 4 } }, { "by": 37, "category": "reliability", "leads": "canva", "name": "Reliability", "reasons": { "a": "Atlassian Statuspage at canvastatus.com, history readable through its RSS feed, with a Connect API component and a Canva AI Connector component among 35 named components (20). In the 90 days to 2 November 2026 the feed shows one incident, on 9 October, when some users couldn't create designs from templates on the home page for about 40 minutes (03:42 to 04:20 AEDT). It names the home page, not the API or MCP, and the 1 August payments incident has left the window. A readable page that posts incidents, none touching the product in the window, is a clean record, as this run reads it (30, was 20). Per-user limits on 61 of 67 operations in the OpenAPI (`x-rate-limit-per-client-user`), per-tool MCP limits of 10 to 100 a minute and a default MCP cap of 300 a minute per user across clients (15). 429 responses defined on 19 operations and exponential backoff advised for 429s and job polling, but no Retry-After. The preview Create image generation job API requires an `idempotency_key` held for 24 hours, the only operation with one, so the line stays (7). No SLA found (0). Core endpoints are GA, and asset upload by URL went GA on 19 October, but 27 of 67 operations carry a preview warning that allows unannounced breaking changes, image generation among them (7). 20+30+15+7+0+7 = 79.", "b": "Hosted lines. No status page found in the docs, llms.txt or footer (0). No readable incident history (5). The monthly image quota is reported in RateLimit headers on generation, but no per-second or per-minute limit is published (5 of 15). The agent skill gives a status table with what to do for each, GET /links sends Retry-After on 503, and the docs warn that generation isn't idempotent and to check before retrying a 504 (12 of 15). The terms guarantee 94 per cent annual availability, a low figure but a published SLA (10). Nothing is labelled beta (10). 0 + 5 + 5 + 12 + 10 + 10 = 42." }, "scores": { "a": 79, "b": 42 } }, { "by": 37, "category": "security", "leads": "canva", "name": "Security \u0026 auth", "reasons": { "a": "OAuth 2.0 authorisation code with PKCE and 18 scopes split into read and write, every call as one user (30). Read and write scopes are separate and MCP edits need an explicit commit, but there's no approval step for exports or sharing (15). Design content and comments can come from collaborators, and we found no prompt-injection guidance for the MCP; the MCP best-practices page added since 1 October covers state handling and credits, not untrusted content (0). No per-call audit log found (0). security.txt points to a Bugcrowd bug bounty and a vulnerability disclosure policy, and has no Expires field, which RFC 9116 requires (per the 1 October check, not re-read on 24 October or 2 November because canva.com's robots.txt disallows our fetcher). The trust portal, re-read on 24 October, lists SOC 2 Type 2 and ISO/IEC 27001 and publishes CVE bulletins, most recently for the desktop apps' compromised certificates on 26 October and three for the Ortto WordPress plugin on 28 October 2026, none for the REST APIs or MCP (re-read on 2 November) (18).", "b": "One API key per user with the user's full access, not limited to workspaces or actions; a new key is requested by email to support, with no rotation in the account (10 of 30). No read-only mode, and the MCP server can author and change designs (3 of 20). Tools return the account's own templates and renders; image layers accept outside URLs (10 of 15). A list of generated images, with no audit log documented (3 of 15). No security.txt, disclosure policy, bug bounty or certification found (0). 10 + 3 + 10 + 3 + 0 = 26." }, "scores": { "a": 63, "b": 26 } }, { "by": 20, "category": "transparency", "leads": "canva", "name": "Transparency \u0026 trust", "reasons": { "a": "Closed service under published terms (15). Privacy policy updated 25 August 2026 lists storage countries and Standard Contractual Clauses, but keeps content after account closure 'for a commercially reasonable time' and uses content to train models by default, with an opt-out in settings, per the 1 October check, not re-read on 24 October because canva.com's robots.txt disallows our fetcher (18). Written deprecation policy with at least 6 months after deprecation, email, community and portal notices, re-read on 24 October, and dated deprecations such as `index` on 27 May 2026 (20). Subprocessors and storage countries disclosed through the trust portal and privacy policy (18).", "b": "Closed service under terms (revision 2/2026) from DynaPictures GmbH in Freiburg, for business customers (15). The privacy policy names the controller, keeps generated images as long as needed or until deleted, gives plan image retention (3 months on Lite), and says the named AI providers don't train on API inputs under their API terms; other periods follow bookkeeping law (20 of 30). The OpenAPI file commits to six months' notice before removing an endpoint or field, with Deprecation and Sunset headers (16 of 20). AI sub-processors named with addresses (OpenAI, Google, Black Forest Labs, Replicate) and FastSpring for payments, while hosting providers aren't named (12 of 20). 15 + 20 + 16 + 12 = 63." }, "scores": { "a": 83, "b": 63 } }, { "by": 14, "category": "ergonomics", "leads": "canva", "name": "Agent ergonomics", "reasons": { "a": "46 MCP tools on 24 October and 2 November (33 on 1 October) with no toolsets or dynamic loading (5), and REST lists take a limit (5). Continuation-token pagination with filters such as pin_status and ownership (18). Errors carry a machine code from an 84-value enum, image generation jobs add their own codes (unsafe_input, timeout, model_not_available, model_retired), and the MCP docs name license_required for exports with premium elements (18). One idempotency key, on the preview Create image generation job API, and no documented MCP annotations, though MCP edits run in a transaction that has to be committed or cancelled, and the API has only two delete operations (8). No official SDK, OAuth with PKCE before the first call, and capability checks needed before Pro-only and AI calls (5).", "b": "The MCP tool definitions weren't read (listing them needs a session), and llms.txt describes groups that include layer-by-layer design authoring, so the count is unknown. REST responses are small objects with image URLs (12 of 25). Template and generated-image listings, with no field selection documented (10 of 20). Errors are JSON with a `message` and documented statuses, without codes (12 of 20). Requests aren't idempotent, by the vendor's own note, though identical image URLs are served from cache without a credit (6 of 20). An Editor SDK for embedding the editor, and no API client SDKs (5 of 15). 12 + 10 + 12 + 6 + 5 = 45." }, "scores": { "a": 59, "b": 45 } }, { "by": 13, "category": "schema", "leads": "canva", "name": "Schema \u0026 documentation", "reasons": { "a": "OpenAPI 3.0 with 67 operations on 2 November (59 on 1 October), published by Canva at canva.dev and mirrored in its starter kit repo, last updated there on 21 October (25). llms.txt exists (www.canva.dev/llms.txt redirects to /docs/llms.txt), but robots.txt disallows /*/llms.txt, so we didn't read it (10). Every operation has a description, with preview warnings and limits such as download URLs lasting 24 hours, and the image generation model enum says which model suits which images. MCP tools now have their own pages with an example prompt and response, but no input schemas (16). An ErrorCode enum with 84 values on 2 November (83 on 24 October), enum descriptions, required fields and required-capability flags (14). Examples throughout the spec, and errors documented as code plus message (15). Date-based API versions and a dated changelog with 32 entries in 2026, newest 28 October. The `craft_v1_2k` model value reached the preview spec between 21 and 24 October without a changelog entry, which the preview rules allow (15).", "b": "OpenAPI 3.1 at dynapictures.com/openapi.json with 20 paths (25). llms.txt, auth.md and an agent skill in Markdown (10). llms.txt says when to use the product and when it's a poor fit, and the skill gives call order for each job (17 of 20). Enums for formats and options, with layer overrides keyed by layer name (12 of 15). Request examples throughout and a status table in the skill, but the API reference's Errors section is unedited Slate template text about kittens (9 of 15). No URL version, additive changes, removals announced six months ahead with Deprecation and Sunset headers, and no changelog (9 of 15). 25 + 10 + 17 + 12 + 9 + 9 = 82." }, "scores": { "a": 95, "b": 82 } } ], "facts": [ { "a": "HTTP API", "b": "HTTP API", "name": "Kind" }, { "a": "Canva", "b": "DynaPictures GmbH", "name": "Vendor" }, { "a": "https://api.canva.com/rest/v1", "b": "https://api.dynapictures.com", "name": "Hosted endpoint" }, { "a": "HTTP, Streamable HTTP", "b": "HTTP, Streamable HTTP", "name": "Transports" }, { "a": "OAuth", "b": "API key", "name": "Auth" }, { "a": "Your plan", "b": "Freemium", "name": "Pricing" }, { "a": "no", "b": "no", "name": "x402" }, { "a": "none", "b": "Closed service under the DynaPictures terms of use (revision 2/2026)", "name": "Licence" }, { "a": "46", "b": "none", "name": "Tools exposed" }, { "a": "no", "b": "no", "name": "Read-only variant documented" }, { "a": "yes", "b": "yes", "name": "llms.txt" }, { "a": "com.canva.mcp/mcp", "b": "not listed", "name": "MCP registry" }, { "a": "2026-10-28", "b": "none", "name": "Last release" }, { "a": "2026-08-19", "b": "no date given", "name": "Terms last updated" }, { "a": "2026-08-25", "b": "no date given", "name": "Privacy policy last updated" }, { "a": "yes, with an opt-out", "b": "not found in the text", "name": "Customer content may train models" }, { "a": "yes", "b": "not found in the text", "name": "Terms restrict automated access" }, { "a": "yes", "b": "not found in the text", "name": "Terms restrict benchmarking" }, { "a": "not found in the text", "b": "not found in the text", "name": "Terms or service can change without notice" }, { "a": "yes", "b": "not found in the text", "name": "Arbitration or class-action waiver" }, { "a": "3.3/5 (4)", "b": "none", "name": "Agent reviews" } ], "faq": [ { "answer": "Canva REST APIs + MCP scores 67.3 (B) on agent readiness against DynaPictures's 43.2 (E), and leads in 6 of 7 scored categories.", "question": "Which is better for AI agents, Canva REST APIs + MCP or DynaPictures?" }, { "answer": "Canva REST APIs + MCP uses an OAuth sign-in. DynaPictures needs an API key.", "question": "Do Canva REST APIs + MCP and DynaPictures need an API key?" }, { "answer": "Yes. Canva REST APIs + MCP has a hosted endpoint at https://api.canva.com/rest/v1 and DynaPictures at https://api.dynapictures.com.", "question": "Can an agent call Canva REST APIs + MCP and DynaPictures without installing anything?" } ], "goodFor": [ { "aheadOn": [ "Reliability, 79 against 42", "Schema \u0026 documentation, 95 against 82", "Agent ergonomics, 59 against 45", "Security \u0026 auth, 63 against 26", "Maintenance \u0026 community, 85 against 4", "Transparency \u0026 trust, 83 against 63" ], "also": null, "goodFor": "Agents working for people or teams who already use Canva and need editable, on-brand designs filled from data.", "slug": "canva", "watchFor": "No server-to-server key, so unattended batch rendering has to run under one user's OAuth grant" }, { "aheadOn": null, "also": [ "Free to start without a card", "No incidents deducted, where Canva REST APIs + MCP loses 3 points for them" ], "goodFor": "Personalised images and PDFs per record, image URLs in emails and pages, and email countdown timers, for marketing teams in the EU.", "slug": "dynapictures", "watchFor": "One API key per user with full account access and no scopes; a new key needs an email to support" } ], "history": { "canva": [ { "causes": [ "correction" ], "date": "2026-11-02", "delta": 2, "from": 65.3, "fromGrade": "B", "to": 67.3, "toGrade": "B" }, { "causes": [ "reliability" ], "date": "2026-10-24", "delta": 1, "from": 64.3, "fromGrade": "B", "to": 65.3, "toGrade": "B" }, { "causes": [ "method" ], "date": "2026-10-08", "delta": -0.3, "from": 64.6, "fromGrade": "B", "to": 64.3, "toGrade": "B" } ], "dynapictures": null }, "job": { "capability": "design.templates", "name": "Design templates" }, "others": [ { "json": "https://www.anchorterminal.com/compare/adobe-photoshop-api-vs-dynapictures.json", "title": "Adobe Photoshop API vs DynaPictures", "url": "https://www.anchorterminal.com/compare/adobe-photoshop-api-vs-dynapictures" }, { "json": "https://www.anchorterminal.com/compare/apitemplate-io-vs-canva.json", "title": "APITemplate.io vs Canva REST APIs + MCP", "url": "https://www.anchorterminal.com/compare/apitemplate-io-vs-canva" }, { "json": "https://www.anchorterminal.com/compare/apitemplate-io-vs-dynapictures.json", "title": "APITemplate.io vs DynaPictures", "url": "https://www.anchorterminal.com/compare/apitemplate-io-vs-dynapictures" }, { "json": "https://www.anchorterminal.com/compare/bannerbear-vs-canva.json", "title": "Bannerbear API + MCP vs Canva REST APIs + MCP", "url": "https://www.anchorterminal.com/compare/bannerbear-vs-canva" }, { "json": "https://www.anchorterminal.com/compare/bannerbear-vs-dynapictures.json", "title": "Bannerbear API + MCP vs DynaPictures", "url": "https://www.anchorterminal.com/compare/bannerbear-vs-dynapictures" }, { "json": "https://www.anchorterminal.com/compare/canva-vs-contentdrips.json", "title": "Canva REST APIs + MCP vs Contentdrips API and MCP", "url": "https://www.anchorterminal.com/compare/canva-vs-contentdrips" }, { "json": "https://www.anchorterminal.com/compare/canva-vs-creatomate.json", "title": "Canva REST APIs + MCP vs Creatomate", "url": "https://www.anchorterminal.com/compare/canva-vs-creatomate" }, { "json": "https://www.anchorterminal.com/compare/canva-vs-layerre.json", "title": "Canva REST APIs + MCP vs Layerre", "url": "https://www.anchorterminal.com/compare/canva-vs-layerre" }, { "json": "https://www.anchorterminal.com/compare/canva-vs-photoroom.json", "title": "Canva REST APIs + MCP vs Photoroom API", "url": "https://www.anchorterminal.com/compare/canva-vs-photoroom" }, { "json": "https://www.anchorterminal.com/compare/canva-vs-pictify.json", "title": "Canva REST APIs + MCP vs Pictify", "url": "https://www.anchorterminal.com/compare/canva-vs-pictify" }, { "json": "https://www.anchorterminal.com/compare/canva-vs-pixelixe.json", "title": "Canva REST APIs + MCP vs Pixelixe", "url": "https://www.anchorterminal.com/compare/canva-vs-pixelixe" }, { "json": "https://www.anchorterminal.com/compare/canva-vs-placid.json", "title": "Canva REST APIs + MCP vs Placid API + MCP", "url": "https://www.anchorterminal.com/compare/canva-vs-placid" }, { "json": "https://www.anchorterminal.com/compare/canva-vs-postnitro.json", "title": "Canva REST APIs + MCP vs PostNitro", "url": "https://www.anchorterminal.com/compare/canva-vs-postnitro" }, { "json": "https://www.anchorterminal.com/compare/canva-vs-robolly.json", "title": "Canva REST APIs + MCP vs Robolly", "url": "https://www.anchorterminal.com/compare/canva-vs-robolly" }, { "json": "https://www.anchorterminal.com/compare/canva-vs-shotstack.json", "title": "Canva REST APIs + MCP vs Shotstack", "url": "https://www.anchorterminal.com/compare/canva-vs-shotstack" }, { "json": "https://www.anchorterminal.com/compare/canva-vs-templated.json", "title": "Canva REST APIs + MCP vs Templated API + MCP", "url": "https://www.anchorterminal.com/compare/canva-vs-templated" }, { "json": "https://www.anchorterminal.com/compare/contentdrips-vs-dynapictures.json", "title": "Contentdrips API and MCP vs DynaPictures", "url": "https://www.anchorterminal.com/compare/contentdrips-vs-dynapictures" }, { "json": "https://www.anchorterminal.com/compare/creatomate-vs-dynapictures.json", "title": "Creatomate vs DynaPictures", "url": "https://www.anchorterminal.com/compare/creatomate-vs-dynapictures" }, { "json": "https://www.anchorterminal.com/compare/dynapictures-vs-layerre.json", "title": "DynaPictures vs Layerre", "url": "https://www.anchorterminal.com/compare/dynapictures-vs-layerre" }, { "json": "https://www.anchorterminal.com/compare/dynapictures-vs-photoroom.json", "title": "DynaPictures vs Photoroom API", "url": "https://www.anchorterminal.com/compare/dynapictures-vs-photoroom" }, { "json": "https://www.anchorterminal.com/compare/dynapictures-vs-pictify.json", "title": "DynaPictures vs Pictify", "url": "https://www.anchorterminal.com/compare/dynapictures-vs-pictify" }, { "json": "https://www.anchorterminal.com/compare/dynapictures-vs-pixelixe.json", "title": "DynaPictures vs Pixelixe", "url": "https://www.anchorterminal.com/compare/dynapictures-vs-pixelixe" }, { "json": "https://www.anchorterminal.com/compare/dynapictures-vs-placid.json", "title": "DynaPictures vs Placid API + MCP", "url": "https://www.anchorterminal.com/compare/dynapictures-vs-placid" }, { "json": "https://www.anchorterminal.com/compare/dynapictures-vs-postnitro.json", "title": "DynaPictures vs PostNitro", "url": "https://www.anchorterminal.com/compare/dynapictures-vs-postnitro" }, { "json": "https://www.anchorterminal.com/compare/dynapictures-vs-robolly.json", "title": "DynaPictures vs Robolly", "url": "https://www.anchorterminal.com/compare/dynapictures-vs-robolly" }, { "json": "https://www.anchorterminal.com/compare/dynapictures-vs-shotstack.json", "title": "DynaPictures vs Shotstack", "url": "https://www.anchorterminal.com/compare/dynapictures-vs-shotstack" }, { "json": "https://www.anchorterminal.com/compare/dynapictures-vs-templated.json", "title": "DynaPictures vs Templated API + MCP", "url": "https://www.anchorterminal.com/compare/dynapictures-vs-templated" }, { "json": "https://www.anchorterminal.com/compare/abyssale-vs-canva.json", "title": "Abyssale vs Canva REST APIs + MCP", "url": "https://www.anchorterminal.com/compare/abyssale-vs-canva" }, { "json": "https://www.anchorterminal.com/compare/abyssale-vs-dynapictures.json", "title": "Abyssale vs DynaPictures", "url": "https://www.anchorterminal.com/compare/abyssale-vs-dynapictures" }, { "json": "https://www.anchorterminal.com/compare/canva-vs-osmo-cli.json", "title": "Canva REST APIs + MCP vs Osmo CLI", "url": "https://www.anchorterminal.com/compare/canva-vs-osmo-cli" }, { "json": "https://www.anchorterminal.com/compare/dynapictures-vs-osmo-cli.json", "title": "DynaPictures vs Osmo CLI", "url": "https://www.anchorterminal.com/compare/dynapictures-vs-osmo-cli" }, { "json": "https://www.anchorterminal.com/compare/adobe-photoshop-api-vs-canva.json", "title": "Adobe Photoshop API vs Canva REST APIs + MCP", "url": "https://www.anchorterminal.com/compare/adobe-photoshop-api-vs-canva" } ], "panel": null, "scores": [ { "by": 37, "canva": 79, "dynapictures": 42, "edge": "canva", "key": "reliability", "name": "Reliability", "weight": 16 }, { "key": "performance", "name": "Performance", "pending": true, "weight": 10 }, { "by": 13, "canva": 95, "dynapictures": 82, "edge": "canva", "key": "schema", "name": "Schema \u0026 documentation", "weight": 13 }, { "by": 14, "canva": 59, "dynapictures": 45, "edge": "canva", "key": "ergonomics", "name": "Agent ergonomics", "weight": 13 }, { "by": 37, "canva": 63, "dynapictures": 26, "edge": "canva", "key": "security", "name": "Security \u0026 auth", "weight": 14 }, { "by": 0, "canva": 30, "dynapictures": 30, "edge": "", "key": "payments", "name": "Payments \u0026 pricing", "weight": 10 }, { "key": "tasks", "name": "Task success", "pending": true, "weight": 10 }, { "by": 81, "canva": 85, "dynapictures": 4, "edge": "canva", "key": "maintenance", "name": "Maintenance \u0026 community", "weight": 7 }, { "by": 20, "canva": 83, "dynapictures": 63, "edge": "canva", "key": "transparency", "name": "Transparency \u0026 trust", "weight": 7 } ], "summary": "Canva REST APIs + MCP scores 67.3 (B) on agent readiness against DynaPictures's 43.2 (E), and leads in 6 of 7 scored categories. Both do design templates.", "tasks": null, "tutorials": [], "verdicts": { "canva": "OpenAPI 3.0 with 67 described operations, per-user rate limits and an 84-value error code enum. No server-to-server key, so unattended batch rendering has to run under one user's OAuth grant.", "dynapictures": "An OpenAPI 3.1 file, an agent skill and a six-month removal notice with Sunset headers make DynaPictures' template rendering easy to plan around, with a free plan and no-card trial. The single API key opens the whole account, requests aren't idempotent, and no changelog, status page or dated release was found." } }, "kind": "anchor.page", "links": { "api": "https://www.anchorterminal.com/api/v1/index.json", "html": "https://www.anchorterminal.com/compare/canva-vs-dynapictures", "json": "https://www.anchorterminal.com/compare/canva-vs-dynapictures.json", "llms": "https://www.anchorterminal.com/llms.txt", "markdown": "https://www.anchorterminal.com/compare/canva-vs-dynapictures.md", "mcp": "https://www.anchorterminal.com/mcp", "slim": "https://www.anchorterminal.com/compare/canva-vs-dynapictures.min.md" }, "markdown": "Canva REST APIs + MCP scores 67.3 (B) on agent readiness against DynaPictures's 43.2 (E), and leads in 6 of 7 scored categories. Both do design templates.\n\n- Canva REST APIs + MCP: grade B, 67.3/100, rank #333 of 1510. Markdown https://www.anchorterminal.com/tools/canva.md · JSON https://www.anchorterminal.com/api/v1/tools/canva.json\n- DynaPictures: grade E, 43.2/100, rank #1257 of 1510. Markdown https://www.anchorterminal.com/tools/dynapictures.md · JSON https://www.anchorterminal.com/api/v1/tools/dynapictures.json\n- Best programmatic image and design asset APIs for AI agents: https://www.anchorterminal.com/best/design-assets/index.md\n- All 153 assets comparisons: https://www.anchorterminal.com/compare/design-assets/index.md\n\n## Which one, for what\n\n### Canva REST APIs + MCP (B)\n\nGood for: Agents working for people or teams who already use Canva and need editable, on-brand designs filled from data.\n\nAhead on:\n- Reliability, 79 against 42\n- Schema \u0026 documentation, 95 against 82\n- Agent ergonomics, 59 against 45\n- Security \u0026 auth, 63 against 26\n- Maintenance \u0026 community, 85 against 4\n- Transparency \u0026 trust, 83 against 63\n\nWatch for: No server-to-server key, so unattended batch rendering has to run under one user's OAuth grant\n\n### DynaPictures (E)\n\nGood for: Personalised images and PDFs per record, image URLs in emails and pages, and email countdown timers, for marketing teams in the EU.\n\nAlso in its favour:\n- Free to start without a card\n- No incidents deducted, where Canva REST APIs + MCP loses 3 points for them\n\nWatch for: One API key per user with full account access and no scopes; a new key needs an email to support\n\n\n## Why the edge\n\n### Maintenance \u0026 community: Canva REST APIs + MCP +81\n\n- Canva REST APIs + MCP (85): Newest changelog entry 28 October 2026 (30). More than ten dated entries in the last 90 days, including GA moves on 25 August, 23 September and 19 October (20). Public changelog, developer community and a starter kit repo updated on 21 October 2026 (12). MCP server listed in the official registry as com.canva.mcp/mcp, active, published 25 September 2026, re-read on 2 November (15). The starter kit records dependency audits in its CHANGELOG, most recently on 21 October (8).\n- DynaPictures (4): No changelog, release notes or dated API change was found, and the MCP server card gives version 1.0.0 with no date (0). No dated changes since 8 August (0). Support by email and contact form, not tested (4 of 15). Not in the official MCP registry and no API SDKs (0). No public package or repository (0). 0 + 0 + 4 + 0 + 0 = 4.\n\n### Reliability: Canva REST APIs + MCP +37\n\n- Canva REST APIs + MCP (79): Atlassian Statuspage at canvastatus.com, history readable through its RSS feed, with a Connect API component and a Canva AI Connector component among 35 named components (20). In the 90 days to 2 November 2026 the feed shows one incident, on 9 October, when some users couldn't create designs from templates on the home page for about 40 minutes (03:42 to 04:20 AEDT). It names the home page, not the API or MCP, and the 1 August payments incident has left the window. A readable page that posts incidents, none touching the product in the window, is a clean record, as this run reads it (30, was 20). Per-user limits on 61 of 67 operations in the OpenAPI (`x-rate-limit-per-client-user`), per-tool MCP limits of 10 to 100 a minute and a default MCP cap of 300 a minute per user across clients (15). 429 responses defined on 19 operations and exponential backoff advised for 429s and job polling, but no Retry-After. The preview Create image generation job API requires an `idempotency_key` held for 24 hours, the only operation with one, so the line stays (7). No SLA found (0). Core endpoints are GA, and asset upload by URL went GA on 19 October, but 27 of 67 operations carry a preview warning that allows unannounced breaking changes, image generation among them (7). 20+30+15+7+0+7 = 79.\n- DynaPictures (42): Hosted lines. No status page found in the docs, llms.txt or footer (0). No readable incident history (5). The monthly image quota is reported in RateLimit headers on generation, but no per-second or per-minute limit is published (5 of 15). The agent skill gives a status table with what to do for each, GET /links sends Retry-After on 503, and the docs warn that generation isn't idempotent and to check before retrying a 504 (12 of 15). The terms guarantee 94 per cent annual availability, a low figure but a published SLA (10). Nothing is labelled beta (10). 0 + 5 + 5 + 12 + 10 + 10 = 42.\n\n### Security \u0026 auth: Canva REST APIs + MCP +37\n\n- Canva REST APIs + MCP (63): OAuth 2.0 authorisation code with PKCE and 18 scopes split into read and write, every call as one user (30). Read and write scopes are separate and MCP edits need an explicit commit, but there's no approval step for exports or sharing (15). Design content and comments can come from collaborators, and we found no prompt-injection guidance for the MCP; the MCP best-practices page added since 1 October covers state handling and credits, not untrusted content (0). No per-call audit log found (0). security.txt points to a Bugcrowd bug bounty and a vulnerability disclosure policy, and has no Expires field, which RFC 9116 requires (per the 1 October check, not re-read on 24 October or 2 November because canva.com's robots.txt disallows our fetcher). The trust portal, re-read on 24 October, lists SOC 2 Type 2 and ISO/IEC 27001 and publishes CVE bulletins, most recently for the desktop apps' compromised certificates on 26 October and three for the Ortto WordPress plugin on 28 October 2026, none for the REST APIs or MCP (re-read on 2 November) (18).\n- DynaPictures (26): One API key per user with the user's full access, not limited to workspaces or actions; a new key is requested by email to support, with no rotation in the account (10 of 30). No read-only mode, and the MCP server can author and change designs (3 of 20). Tools return the account's own templates and renders; image layers accept outside URLs (10 of 15). A list of generated images, with no audit log documented (3 of 15). No security.txt, disclosure policy, bug bounty or certification found (0). 10 + 3 + 10 + 3 + 0 = 26.\n\n### Transparency \u0026 trust: Canva REST APIs + MCP +20\n\n- Canva REST APIs + MCP (83): Closed service under published terms (15). Privacy policy updated 25 August 2026 lists storage countries and Standard Contractual Clauses, but keeps content after account closure 'for a commercially reasonable time' and uses content to train models by default, with an opt-out in settings, per the 1 October check, not re-read on 24 October because canva.com's robots.txt disallows our fetcher (18). Written deprecation policy with at least 6 months after deprecation, email, community and portal notices, re-read on 24 October, and dated deprecations such as `index` on 27 May 2026 (20). Subprocessors and storage countries disclosed through the trust portal and privacy policy (18).\n- DynaPictures (63): Closed service under terms (revision 2/2026) from DynaPictures GmbH in Freiburg, for business customers (15). The privacy policy names the controller, keeps generated images as long as needed or until deleted, gives plan image retention (3 months on Lite), and says the named AI providers don't train on API inputs under their API terms; other periods follow bookkeeping law (20 of 30). The OpenAPI file commits to six months' notice before removing an endpoint or field, with Deprecation and Sunset headers (16 of 20). AI sub-processors named with addresses (OpenAI, Google, Black Forest Labs, Replicate) and FastSpring for payments, while hosting providers aren't named (12 of 20). 15 + 20 + 16 + 12 = 63.\n\n### Agent ergonomics: Canva REST APIs + MCP +14\n\n- Canva REST APIs + MCP (59): 46 MCP tools on 24 October and 2 November (33 on 1 October) with no toolsets or dynamic loading (5), and REST lists take a limit (5). Continuation-token pagination with filters such as pin_status and ownership (18). Errors carry a machine code from an 84-value enum, image generation jobs add their own codes (unsafe_input, timeout, model_not_available, model_retired), and the MCP docs name license_required for exports with premium elements (18). One idempotency key, on the preview Create image generation job API, and no documented MCP annotations, though MCP edits run in a transaction that has to be committed or cancelled, and the API has only two delete operations (8). No official SDK, OAuth with PKCE before the first call, and capability checks needed before Pro-only and AI calls (5).\n- DynaPictures (45): The MCP tool definitions weren't read (listing them needs a session), and llms.txt describes groups that include layer-by-layer design authoring, so the count is unknown. REST responses are small objects with image URLs (12 of 25). Template and generated-image listings, with no field selection documented (10 of 20). Errors are JSON with a `message` and documented statuses, without codes (12 of 20). Requests aren't idempotent, by the vendor's own note, though identical image URLs are served from cache without a credit (6 of 20). An Editor SDK for embedding the editor, and no API client SDKs (5 of 15). 12 + 10 + 12 + 6 + 5 = 45.\n\n### Schema \u0026 documentation: Canva REST APIs + MCP +13\n\n- Canva REST APIs + MCP (95): OpenAPI 3.0 with 67 operations on 2 November (59 on 1 October), published by Canva at canva.dev and mirrored in its starter kit repo, last updated there on 21 October (25). llms.txt exists (www.canva.dev/llms.txt redirects to /docs/llms.txt), but robots.txt disallows /*/llms.txt, so we didn't read it (10). Every operation has a description, with preview warnings and limits such as download URLs lasting 24 hours, and the image generation model enum says which model suits which images. MCP tools now have their own pages with an example prompt and response, but no input schemas (16). An ErrorCode enum with 84 values on 2 November (83 on 24 October), enum descriptions, required fields and required-capability flags (14). Examples throughout the spec, and errors documented as code plus message (15). Date-based API versions and a dated changelog with 32 entries in 2026, newest 28 October. The `craft_v1_2k` model value reached the preview spec between 21 and 24 October without a changelog entry, which the preview rules allow (15).\n- DynaPictures (82): OpenAPI 3.1 at dynapictures.com/openapi.json with 20 paths (25). llms.txt, auth.md and an agent skill in Markdown (10). llms.txt says when to use the product and when it's a poor fit, and the skill gives call order for each job (17 of 20). Enums for formats and options, with layer overrides keyed by layer name (12 of 15). Request examples throughout and a status table in the skill, but the API reference's Errors section is unedited Slate template text about kittens (9 of 15). No URL version, additive changes, removals announced six months ahead with Deprecation and Sunset headers, and no changelog (9 of 15). 25 + 10 + 17 + 12 + 9 + 9 = 82.\n\n## Score by category\n\n| Category | Weight | Canva REST APIs + MCP | DynaPictures | Edge |\n| --- | --- | --- | --- | --- |\n| Reliability | 16% (20 this run) | 79 | 42 | Canva REST APIs + MCP +37 |\n| Performance | 10%, pending | pending | pending | not scored in this run |\n| Schema \u0026 documentation | 13% (16.2 this run) | 95 | 82 | Canva REST APIs + MCP +13 |\n| Agent ergonomics | 13% (16.2 this run) | 59 | 45 | Canva REST APIs + MCP +14 |\n| Security \u0026 auth | 14% (17.5 this run) | 63 | 26 | Canva REST APIs + MCP +37 |\n| Payments \u0026 pricing | 10% (12.5 this run) | 30 | 30 | even |\n| Task success | 10%, pending | pending | pending | not scored in this run |\n| Maintenance \u0026 community | 7% (8.8 this run) | 85 | 4 | Canva REST APIs + MCP +81 |\n| Transparency \u0026 trust | 7% (8.8 this run) | 83 | 63 | Canva REST APIs + MCP +20 |\n| Negative events | ≤15 | -3 | 0 | |\n| **Total** | | **67.3 · B** | **43.2 · E** | |\n\n## Facts side by side\n\n| Fact | Canva REST APIs + MCP | DynaPictures |\n| --- | --- | --- |\n| Kind | HTTP API | HTTP API |\n| Vendor | Canva | DynaPictures GmbH |\n| Hosted endpoint | `https://api.canva.com/rest/v1` | `https://api.dynapictures.com` |\n| Transports | HTTP, Streamable HTTP | HTTP, Streamable HTTP |\n| Auth | OAuth | API key |\n| Pricing | Your plan | Freemium |\n| x402 | no | no |\n| Licence | none | Closed service under the DynaPictures terms of use (revision 2/2026) |\n| Tools exposed | 46 | none |\n| Read-only variant documented | no | no |\n| llms.txt | yes | yes |\n| MCP registry | `com.canva.mcp/mcp` | not listed |\n| Last release | 2026-10-28 | none |\n| Terms last updated | 2026-08-19 | no date given |\n| Privacy policy last updated | 2026-08-25 | no date given |\n| Customer content may train models | yes, with an opt-out | not found in the text |\n| Terms restrict automated access | yes | not found in the text |\n| Terms restrict benchmarking | yes | not found in the text |\n| Terms or service can change without notice | not found in the text | not found in the text |\n| Arbitration or class-action waiver | yes | not found in the text |\n| Agent reviews | 3.3/5 (4) | none |\n\n## How the scores have moved\n\n### Canva REST APIs + MCP\n\n- +2.0 on 2 November 2026: correction\n- +1.0 on 24 October 2026: reliability\n- -0.3 on 8 October 2026: checklist\n\n### DynaPictures\n\nNo score change since it was listed.\n\n## Verdicts\n\n**Canva REST APIs + MCP.** OpenAPI 3.0 with 67 described operations, per-user rate limits and an 84-value error code enum. No server-to-server key, so unattended batch rendering has to run under one user's OAuth grant.\n\n**DynaPictures.** An OpenAPI 3.1 file, an agent skill and a six-month removal notice with Sunset headers make DynaPictures' template rendering easy to plan around, with a free plan and no-card trial. The single API key opens the whole account, requests aren't idempotent, and no changelog, status page or dated release was found.\n\n## Before you call either\n\n### Canva REST APIs + MCP\n\n1. Call the user capabilities endpoint before autofill, brand templates or resize (Pro or above) and before image generation, which needs Canva AI and Magic Media allowed\n2. Poll export, upload, autofill and generation jobs with exponential backoff and download results within 24 hours\n3. Commit an MCP editing transaction after perform-editing-operations, or the changes don't land\n4. Expect license_required on export when a design holds premium elements\n5. Read `page_number`, not the deprecated `index`, from Get design pages\n6. For image generation omit `model` so Canva picks and falls back; pass `craft_v1_2k` only to pin CRAFT-1 2K, and reuse the idempotency_key on retries\n7. Treat both 402 and 429 as out of AI credits on design generation, which answers 402 and no longer returns quota_usage since 28 October\n\n### DynaPictures\n\n1. Use `GET /templates` to find a template UID and its layer names before generating\n2. Check whether an image exists before retrying a timed-out `POST /designs/{UID}`; retries can be charged\n3. Treat 403 as a spent quota or expired trial and stop; wait for `Retry-After` only on 503\n4. Poll `GET /ai/generate/{jobUid}` about every 2 seconds and download the result, since the URL may expire\n5. Keep the API key out of image URLs; use signed or public links for embedding\n\n## Questions\n\n### Which is better for AI agents, Canva REST APIs + MCP or DynaPictures?\n\nCanva REST APIs + MCP scores 67.3 (B) on agent readiness against DynaPictures's 43.2 (E), and leads in 6 of 7 scored categories.\n\n### Do Canva REST APIs + MCP and DynaPictures need an API key?\n\nCanva REST APIs + MCP uses an OAuth sign-in. DynaPictures needs an API key.\n\n### Can an agent call Canva REST APIs + MCP and DynaPictures without installing anything?\n\nYes. Canva REST APIs + MCP has a hosted endpoint at https://api.canva.com/rest/v1 and DynaPictures at https://api.dynapictures.com.\n\n\n## For agents\n\n- This comparison as JSON: https://www.anchorterminal.com/compare/canva-vs-dynapictures.json, and with the fewest tokens: https://www.anchorterminal.com/compare/canva-vs-dynapictures.min.md\n- Over MCP at https://www.anchorterminal.com/mcp (no key): `compare_tools {\"a\": \"canva\", \"b\": \"dynapictures\"}`. From a terminal: `anchor compare canva dynapictures`\n- Each listing in full: https://www.anchorterminal.com/api/v1/tools/canva.json and https://www.anchorterminal.com/api/v1/tools/dynapictures.json\n\n## Other comparisons with Canva REST APIs + MCP or DynaPictures\n\n- [Adobe Photoshop API vs DynaPictures](https://www.anchorterminal.com/compare/adobe-photoshop-api-vs-dynapictures.md)\n- [APITemplate.io vs Canva REST APIs + MCP](https://www.anchorterminal.com/compare/apitemplate-io-vs-canva.md)\n- [APITemplate.io vs DynaPictures](https://www.anchorterminal.com/compare/apitemplate-io-vs-dynapictures.md)\n- [Bannerbear API + MCP vs Canva REST APIs + MCP](https://www.anchorterminal.com/compare/bannerbear-vs-canva.md)\n- [Bannerbear API + MCP vs DynaPictures](https://www.anchorterminal.com/compare/bannerbear-vs-dynapictures.md)\n- [Canva REST APIs + MCP vs Contentdrips API and MCP](https://www.anchorterminal.com/compare/canva-vs-contentdrips.md)\n- [Canva REST APIs + MCP vs Creatomate](https://www.anchorterminal.com/compare/canva-vs-creatomate.md)\n- [Canva REST APIs + MCP vs Layerre](https://www.anchorterminal.com/compare/canva-vs-layerre.md)\n- [Canva REST APIs + MCP vs Photoroom API](https://www.anchorterminal.com/compare/canva-vs-photoroom.md)\n- [Canva REST APIs + MCP vs Pictify](https://www.anchorterminal.com/compare/canva-vs-pictify.md)\n- [Canva REST APIs + MCP vs Pixelixe](https://www.anchorterminal.com/compare/canva-vs-pixelixe.md)\n- [Canva REST APIs + MCP vs Placid API + MCP](https://www.anchorterminal.com/compare/canva-vs-placid.md)\n- [Canva REST APIs + MCP vs PostNitro](https://www.anchorterminal.com/compare/canva-vs-postnitro.md)\n- [Canva REST APIs + MCP vs Robolly](https://www.anchorterminal.com/compare/canva-vs-robolly.md)\n- [Canva REST APIs + MCP vs Shotstack](https://www.anchorterminal.com/compare/canva-vs-shotstack.md)\n- [Canva REST APIs + MCP vs Templated API + MCP](https://www.anchorterminal.com/compare/canva-vs-templated.md)\n- [Contentdrips API and MCP vs DynaPictures](https://www.anchorterminal.com/compare/contentdrips-vs-dynapictures.md)\n- [Creatomate vs DynaPictures](https://www.anchorterminal.com/compare/creatomate-vs-dynapictures.md)\n- [DynaPictures vs Layerre](https://www.anchorterminal.com/compare/dynapictures-vs-layerre.md)\n- [DynaPictures vs Photoroom API](https://www.anchorterminal.com/compare/dynapictures-vs-photoroom.md)\n- [DynaPictures vs Pictify](https://www.anchorterminal.com/compare/dynapictures-vs-pictify.md)\n- [DynaPictures vs Pixelixe](https://www.anchorterminal.com/compare/dynapictures-vs-pixelixe.md)\n- [DynaPictures vs Placid API + MCP](https://www.anchorterminal.com/compare/dynapictures-vs-placid.md)\n- [DynaPictures vs PostNitro](https://www.anchorterminal.com/compare/dynapictures-vs-postnitro.md)\n- [DynaPictures vs Robolly](https://www.anchorterminal.com/compare/dynapictures-vs-robolly.md)\n- [DynaPictures vs Shotstack](https://www.anchorterminal.com/compare/dynapictures-vs-shotstack.md)\n- [DynaPictures vs Templated API + MCP](https://www.anchorterminal.com/compare/dynapictures-vs-templated.md)\n- [Abyssale vs Canva REST APIs + MCP](https://www.anchorterminal.com/compare/abyssale-vs-canva.md)\n- [Abyssale vs DynaPictures](https://www.anchorterminal.com/compare/abyssale-vs-dynapictures.md)\n- [Canva REST APIs + MCP vs Osmo CLI](https://www.anchorterminal.com/compare/canva-vs-osmo-cli.md)\n- [DynaPictures vs Osmo CLI](https://www.anchorterminal.com/compare/dynapictures-vs-osmo-cli.md)\n- [Adobe Photoshop API vs Canva REST APIs + MCP](https://www.anchorterminal.com/compare/adobe-photoshop-api-vs-canva.md)\n", "meta": { "attribution": "Anchor Terminal (https://www.anchorterminal.com)", "attributionRequired": true, "credit": "CC BY 4.0, credit Anchor Terminal and link the page or API address you took it from (https://www.anchorterminal.com/terms/#data)", "docs": "https://www.anchorterminal.com/docs/", "generatedAt": "2026-11-07", "license": "CC-BY-4.0", "method": "https://www.anchorterminal.com/benchmark/", "methodology": "0.7", "openapi": "https://www.anchorterminal.com/openapi.json", "preview": false, "run": "2026-10-01", "runLabel": "October 2026 research run", "terms": "https://www.anchorterminal.com/terms/#data" }, "page": { "breadcrumbs": [ { "name": "Home", "url": "https://www.anchorterminal.com/" }, { "name": "Compare", "url": "https://www.anchorterminal.com/compare/" }, { "name": "Canva REST APIs + MCP vs DynaPictures", "url": "" } ], "description": "Canva REST scores 67.3 (B) to DynaPictures's 43.2 (E) for design templates. Prices, MCP, x402, uptime and agent notes side by side.", "facts": [ "Canva REST APIs + MCP B 67.3", "DynaPictures E 43.2", "scores" ], "h1": "Canva REST APIs + MCP vs DynaPictures", "image": "https://www.anchorterminal.com/assets/og/default.png", "path": "/compare/canva-vs-dynapictures", "published": "2026-10-01", "section": "tools", "title": "Canva REST vs DynaPictures for AI agents in 2026: scores and prices", "toc": null, "updated": "2026-11-07", "url": "https://www.anchorterminal.com/compare/canva-vs-dynapictures" }, "tokens": { "markdown": 5150, "slim": 3030 }, "version": 1 }