Canva REST APIs + MCP vs Layerre

Canva REST APIs + MCP 79

Atlassian Statuspage at canvastatus.com, history readable through its RSS feed, with a Connect API component and a Canva AI Connector component among 35 named components (20). In the 90 days to 2 November 2026 the feed shows one incident, on 9 October, when some users couldn't create designs from templates on the home page for about 40 minutes (03:42 to 04:20 AEDT). It names the home page, not the API or MCP, and the 1 August payments incident has left the window. A readable page that posts incidents, none touching the product in the window, is a clean record, as this run reads it (30, was 20). Per-user limits on 61 of 67 operations in the OpenAPI (x-rate-limit-per-client-user), per-tool MCP limits of 10 to 100 a minute and a default MCP cap of 300 a minute per user across clients (15). 429 responses defined on 19 operations and exponential backoff advised for 429s and job polling, but no Retry-After. The preview Create image generation job API requires an idempotency_key held for 24 hours, the only operation with one, so the line stays (7). No SLA found (0). Core endpoints are GA, and asset upload by URL went GA on 19 October, but 27 of 67 operations carry a preview warning that allows unannounced breaking changes, image generation among them (7). 20+30+15+7+0+7 = 79.

Layerre 42

Hosted lines, for the REST API and the hosted MCP server. No status page found on the site, in llms.txt or in the docs (0). No readable incident history (5). Rate limits published as 10 requests a second, a 20-request burst and 600 a minute per IP address (15). A 429 carries Retry-After and a retry_after field, and the docs give retry code samples. No idempotency key or safe-retry note for variant creation, which spends renders (12 of 15). No SLA found (0). Neither surface is labelled beta, though both are at version 0.1.0 (10). 0 + 5 + 15 + 12 + 0 + 10 = 42.

Canva REST APIs + MCP 83

Closed service under published terms (15). Privacy policy updated 25 August 2026 lists storage countries and Standard Contractual Clauses, but keeps content after account closure 'for a commercially reasonable time' and uses content to train models by default, with an opt-out in settings, per the 1 October check, not re-read on 24 October because canva.com's robots.txt disallows our fetcher (18). Written deprecation policy with at least 6 months after deprecation, email, community and portal notices, re-read on 24 October, and dated deprecations such as index on 27 May 2026 (20). Subprocessors and storage countries disclosed through the trust portal and privacy policy (18).

Layerre 63

The MCP server is MIT. The service is closed under terms of 13 August 2026 that name a sole proprietorship in Ontario (20 of 30). The privacy policy and DPA of the same date agree. Data is kept while the account is active and deleted from production on account deletion, with limited backups. Design files aren't used to train public AI models. Google Analytics runs on accepted cookies (24 of 30). No deprecation policy or notice period (0). Ten subprocessors listed with purpose and location in both documents, including Supabase, Stripe, Cloudflare, Google, Resend, Canva and Slack (20). 20 + 24 + 0 + 20 = 64.

Canva REST APIs + MCP 63

OAuth 2.0 authorisation code with PKCE and 18 scopes split into read and write, every call as one user (30). Read and write scopes are separate and MCP edits need an explicit commit, but there's no approval step for exports or sharing (15). Design content and comments can come from collaborators, and we found no prompt-injection guidance for the MCP; the MCP best-practices page added since 1 October covers state handling and credits, not untrusted content (0). No per-call audit log found (0). security.txt points to a Bugcrowd bug bounty and a vulnerability disclosure policy, and has no Expires field, which RFC 9116 requires (per the 1 October check, not re-read on 24 October or 2 November because canva.com's robots.txt disallows our fetcher). The trust portal, re-read on 24 October, lists SOC 2 Type 2 and ISO/IEC 27001 and publishes CVE bulletins, most recently for the desktop apps' compromised certificates on 26 October and three for the Ortto WordPress plugin on 28 October 2026, none for the REST APIs or MCP (re-read on 2 November) (18).

Layerre 48

OAuth 2.1 with PKCE for MCP through a Supabase authorisation server, and revocable lyr_ API keys with rotation in the dashboard. No scopes documented for either, and auth.md says the REST API has no OAuth yet (22 of 30). The MCP server cannot delete templates, change billing or manage API keys, but there is no read-only key or endpoint (12 of 20). Tools return the user's own templates and renders; template import fetches a Canva link the user gives (10 of 15). The open-source server emits audit log lines for each tool call for whoever runs it, and nothing per call is documented for the hosted service (4 of 15). No security.txt (the path returns the site's HTML shell), disclosure policy, bug bounty or certification (0). 22 + 12 + 10 + 4 + 0 = 48.

Canva REST APIs + MCP 59

46 MCP tools on 24 October and 2 November (33 on 1 October) with no toolsets or dynamic loading (5), and REST lists take a limit (5). Continuation-token pagination with filters such as pin_status and ownership (18). Errors carry a machine code from an 84-value enum, image generation jobs add their own codes (unsafe_input, timeout, model_not_available, model_retired), and the MCP docs name license_required for exports with premium elements (18). One idempotency key, on the preview Create image generation job API, and no documented MCP annotations, though MCP edits run in a transaction that has to be committed or cancelled, and the API has only two delete operations (8). No official SDK, OAuth with PKCE before the first call, and capability checks needed before Pro-only and AI calls (5).

Layerre 69

13 MCP tools (15 for 11 to 30), with no toolsets or read-only subset (15). Template and variant lists take skip and limit, and templates filter by tag and q and can leave out layers (16 of 20). 422 validation bodies and a JSON 429 with retry_after (17 of 20). Every tool is annotated, read tools with readOnlyHint and idempotentHint, updates idempotent, no tool destructive, and the server has no delete tool. The REST API has no idempotency keys for variant creation (16 of 20). Few required fields, but no official SDK; a Postman collection and the MCP package only (5 of 15). 15 + 16 + 17 + 16 + 5 = 69.

Canva REST APIs + MCP 95

OpenAPI 3.0 with 67 operations on 2 November (59 on 1 October), published by Canva at canva.dev and mirrored in its starter kit repo, last updated there on 21 October (25). llms.txt exists (www.canva.dev/llms.txt redirects to /docs/llms.txt), but robots.txt disallows /*/llms.txt, so we didn't read it (10). Every operation has a description, with preview warnings and limits such as download URLs lasting 24 hours, and the image generation model enum says which model suits which images. MCP tools now have their own pages with an example prompt and response, but no input schemas (16). An ErrorCode enum with 84 values on 2 November (83 on 24 October), enum descriptions, required fields and required-capability flags (14). Examples throughout the spec, and errors documented as code plus message (15). Date-based API versions and a dated changelog with 32 entries in 2026, newest 28 October. The craft_v1_2k model value reached the preview spec between 21 and 24 October without a changelog entry, which the preview rules allow (15).

Layerre 87

Public OpenAPI 3.1 at layerre.com/openapi.json with 16 operations, and zod schemas on all 13 MCP tools in the open-source server (25). llms.txt, auth.md and Markdown mirrors of the pricing, FAQ and integration pages (10). Every operation has a description, and tool descriptions note costs such as 'an expensive operation that may take 10-30 seconds', without saying when not to use a tool (15 of 20). Layer properties have minimums, maximums and enums such as text_align, and list calls cap limit at 1,000 (14 of 15). 88 examples in the spec, and 404, 422 and 429 responses documented on most operations (13 of 15). Versioned /v1 paths and dated What's New pages, read from the sitemap since the pages are drawn by script; the API itself is version 0.1.0 (10 of 15). 25 + 10 + 15 + 14 + 13 + 10 = 87.

Canva REST APIs + MCP 85

Newest changelog entry 28 October 2026 (30). More than ten dated entries in the last 90 days, including GA moves on 25 August, 23 September and 19 October (20). Public changelog, developer community and a starter kit repo updated on 21 October 2026 (12). MCP server listed in the official registry as com.canva.mcp/mcp, active, published 25 September 2026, re-read on 2 November (15). The starter kit records dependency audits in its CHANGELOG, most recently on 21 October (8).

Layerre 78

@layerre/mcp-server 0.1.0 published to npm on 29 October 2026, 8 days before this check (30). MCP server commits from 19 to 24 October, the registry entry of 29 October, and What's New entries dated 21 August and 18 October in the sitemap (20). The repository is a week old with no issues to judge; support by email and in-app chat (5 of 25). com.layerre/layerre is in the official MCP registry under a domain-verified namespace (15). CI runs the vitest suite on push and pull requests to main on Node 22 (8 of 10). 30 + 20 + 5 + 15 + 8 = 78.