{ "data": { "a": { "slug": "canva", "name": "Canva REST APIs + MCP", "vendor": "Canva", "vendorUrl": "https://www.canva.dev", "kind": "http-api", "category": "design-assets", "summary": "Canva's REST APIs and hosted MCP server connect applications and agents to its design platform.", "url": "https://www.anchorterminal.com/tools/canva", "markdownUrl": "https://www.anchorterminal.com/tools/canva.md", "slimMarkdownUrl": "https://www.anchorterminal.com/tools/canva.min.md", "jsonUrl": "https://www.anchorterminal.com/api/v1/tools/canva.json", "dns": "canva.grade.anchorterminal.com", "transports": [ "http", "streamable-http" ], "remoteUrl": "https://api.canva.com/rest/v1", "packages": [], "auth": "oauth", "authNotes": "OAuth 2.0 authorisation code flow with PKCE (S256) against https://www.canva.com/api/oauth/authorize, with scopes such as design:content, asset:read and brandtemplate:meta chosen per app in the Developer Portal. Every call runs as one Canva user, so there's no server-to-server key. The MCP server also uses per-user OAuth. Integrators create an app in the Developer Portal and turn on Canva MCP, which issues a client ID and secret straight away; no waitlist was found on canva.dev on 24 October 2026.", "pricing": "byo-plan", "pricingNotes": "No separate API fee. What the API and MCP can do follows the user's Canva plan. Free covers design generation, image generation, editing, search, export, comments and asset upload. Pro, Business and Enterprise add autofill, brand templates, brand kits, resize and pro-quality export. Image generation, image transformation and design generation (preview APIs) consume the user's AI credit allowance. When it runs out, image generation returns a 429 and, since 28 October 2026, design generation returns a 402. Private apps need Enterprise (https://www.canva.com/pricing/, https://www.canva.dev/docs/apps/rest-apis/reference/generations/create-image-generation-job/).", "priceSummary": "Your plan", "where": "hosted", "x402": { "level": "no", "evidence": "Per-user OAuth on Canva plans. No x402 in the docs or OpenAPI description (checked 2026-09-30).", "endpoints": [] }, "toolCount": 46, "popularity": { "githubStars": null, "npmWeekly": null, "pypiWeekly": null, "asOf": "2026-09-30" }, "docsUrl": "https://www.canva.dev/docs/apps/rest-apis/", "llmsTxt": "https://www.canva.dev/llms.txt", "openapi": "https://www.canva.dev/sources/connect/api/latest/api.yml", "registryName": "com.canva.mcp/mcp", "capabilities": [ "design.templates", "design.render", "design.brand", "video.render", "image.generate", "image.edit" ], "tags": [ "hosted", "closed-source", "mcp", "llms-txt", "openapi", "async-jobs", "webhooks" ], "lastRelease": "2026-10-28", "graded": true, "anchor": { "graded": true, "score": 67.3, "grade": "B", "agentReady": false, "rank": 333, "ranked": true, "rankOf": 1510, "categoryRank": 1, "methodology": "0.7", "run": "2026-10-01", "scores": { "ergonomics": 59, "maintenance": 85, "payments": 30, "reliability": 79, "schema": 95, "security": 63, "transparency": 83 }, "pending": [ "performance", "tasks" ], "assessment": { "confidence": "medium", "date": "2026-11-02" }, "negative": -3, "negativeNotes": [ "2026-09-18 and 2026-10-28. The MP4 `quality` parameter on the GA export job API changed from a fixed output size to a target pixel count without a new API version, which the deprecation policy requires for breaking changes; Canva logged it the same day as a bug fix. On 28 October the preview Create and Get design generation job APIs dropped `quota_usage` from the response and moved the out-of-credit answer from 429 to 402, posted the day it took effect. Same-day changes fold into one term, kept at the low end. https://www.canva.dev/docs/apps/rest-apis/changelog/" ], "verdict": "OpenAPI 3.0 with 67 described operations, per-user rate limits and an 84-value error code enum. No server-to-server key, so unattended batch rendering has to run under one user's OAuth grant.", "bestFor": "Agents working for people or teams who already use Canva and need editable, on-brand designs filled from data.", "strengths": [ "OpenAPI 3.0 with 67 described operations, per-user rate limits and an 84-value error code enum", "OAuth with PKCE and 18 read and write scopes, every action attributable to one user", "Written deprecation policy with at least 6 months' notice and a dated changelog updated on 28 October 2026", "Bugcrowd bug bounty, disclosure policy, SOC 2 Type 2, ISO 27001 and public CVE bulletins", "Exports to PNG, JPG, GIF, PDF, PPTX, MP4 and HTML, and the result stays editable in Canva", "Image generation API (preview) with Canva's own CRAFT-1 2K model, an idempotency key and per-job error codes" ], "weaknesses": [ "No server-to-server key, so unattended batch rendering has to run under one user's OAuth grant", "27 of 67 operations are preview and can change without a new version, image generation among them", "MP4 export quality changed meaning on 18 September 2026 without a new API version, and a preview API's out-of-credit answer moved from 429 to 402 on the day it was posted", "Content is used to train Canva's models by default unless the user opts out in settings", "No official SDK, and MCP edits need a start, operate and commit sequence" ], "agentNotes": [ "Call the user capabilities endpoint before autofill, brand templates or resize (Pro or above) and before image generation, which needs Canva AI and Magic Media allowed", "Poll export, upload, autofill and generation jobs with exponential backoff and download results within 24 hours", "Commit an MCP editing transaction after perform-editing-operations, or the changes don't land", "Expect license_required on export when a design holds premium elements", "Read `page_number`, not the deprecated `index`, from Get design pages", "For image generation omit `model` so Canva picks and falls back; pass `craft_v1_2k` only to pin CRAFT-1 2K, and reuse the idempotency_key on retries", "Treat both 402 and 429 as out of AI credits on design generation, which answers 402 and no longer returns quota_usage since 28 October" ], "metrics": { "kind": "remote", "measured": false }, "reviewCount": 4, "avgRating": 3.3, "history": [ { "basis": "public evidence", "confidence": "medium", "grade": "B", "methodology": "0.7", "pending": [ "performance", "tasks" ], "run": "2026-10-01", "runLabel": "October 2026 research run", "score": 67.3 } ], "editorialScores": { "ergonomics": 59, "maintenance": 85, "payments": 30, "reliability": 79, "schema": 95, "security": 63, "transparency": 71 }, "provenanceScore": 95, "checked": { "categories": { "ergonomics": "2026-11-02", "maintenance": "2026-11-02", "payments": "2026-11-02", "reliability": "2026-11-02", "schema": "2026-11-02", "security": "2026-11-02", "transparency": "2026-11-02" }, "last": "2026-11-02", "lastMoved": "2026-11-02", "oldest": "2026-11-02", "stale": false, "staleAfterDays": 90 } }, "connect": { "http": "curl https://api.canva.com/rest/v1/users/me -H \"Authorization: Bearer $CANVA_ACCESS_TOKEN\"", "claudeCode": "claude mcp add --transport http canva https://mcp.canva.com/mcp" }, "letme": { "capability": "https://letme.dev/design.templates", "tool": "https://letme.dev/canva" }, "area": "design-diagrams", "provenance": { "legalEntity": "Canva Pty Ltd", "domain": "canva.com", "domainRegistered": "2001-05-05", "endpointOnVendorDomain": true, "terms": "https://www.canva.com/policies/terms-of-use/", "privacy": "https://www.canva.com/policies/privacy-policy/", "statusPage": "https://www.canvastatus.com", "changelog": "https://www.canva.dev/docs/apps/rest-apis/changelog/", "securityTxt": "valid", "checked": "2026-11-02", "notes": [ "Developer docs live on canva.dev. The API is served from api.canva.com", "security.txt lists a bug bounty, disclosure policy and trust centre but has no Expires field (per the 1 October check)", "On 24 October and 2 November 2026 canva.com's robots.txt disallows ClaudeBot, anthropic-ai and Claude-Web, so the terms, privacy policy, pricing and security.txt weren't re-read; canva.dev, canvastatus.com and trust.canva.com were" ], "score": 95 }, "pageJsonUrl": "https://www.anchorterminal.com/tools/canva.json", "live": { "slug": "canva", "probe": { "target": "https://api.canva.com/rest/v1", "method": "get", "lastAt": "2026-11-07T19:21:58.374216082Z", "lastOk": true, "lastStatus": 404, "lastMs": 246, "authRequired": false, "uptime24h": 100, "uptime30d": 100, "p50ms24h": 131, "p95ms24h": 225, "samples24h": 238, "samples30d": 7920, "days": [ { "date": "2026-10-07", "probes": 272, "ok": 272 }, { "date": "2026-10-08", "probes": 268, "ok": 268 }, { "date": "2026-10-09", "probes": 250, "ok": 250 }, { "date": "2026-10-10", "probes": 247, "ok": 247 }, { "date": "2026-10-11", "probes": 247, "ok": 247 }, { "date": "2026-10-12", "probes": 247, "ok": 247 }, { "date": "2026-10-13", "probes": 248, "ok": 248 }, { "date": "2026-10-14", "probes": 249, "ok": 249 }, { "date": "2026-10-15", "probes": 253, "ok": 253 }, { "date": "2026-10-16", "probes": 252, "ok": 252 }, { "date": "2026-10-17", "probes": 253, "ok": 253 }, { "date": "2026-10-18", "probes": 256, "ok": 256 }, { "date": "2026-10-19", "probes": 255, "ok": 255 }, { "date": "2026-10-20", "probes": 252, "ok": 252 }, { "date": "2026-10-21", "probes": 253, "ok": 253 }, { "date": "2026-10-22", "probes": 253, "ok": 253 }, { "date": "2026-10-23", "probes": 248, "ok": 248 }, { "date": "2026-10-24", "probes": 251, "ok": 251 }, { "date": "2026-10-25", "probes": 250, "ok": 250 }, { "date": "2026-10-26", "probes": 252, "ok": 252 }, { "date": "2026-10-27", "probes": 249, "ok": 249 }, { "date": "2026-10-28", "probes": 251, "ok": 251 }, { "date": "2026-10-29", "probes": 249, "ok": 249 }, { "date": "2026-10-30", "probes": 248, "ok": 248 }, { "date": "2026-10-31", "probes": 251, "ok": 251 }, { "date": "2026-11-01", "probes": 249, "ok": 249 }, { "date": "2026-11-02", "probes": 250, "ok": 250 }, { "date": "2026-11-03", "probes": 248, "ok": 248 }, { "date": "2026-11-04", "probes": 246, "ok": 246 }, { "date": "2026-11-05", "probes": 185, "ok": 185 }, { "date": "2026-11-06", "probes": 241, "ok": 241 }, { "date": "2026-11-07", "probes": 197, "ok": 197 } ] }, "vendorStatus": { "page": "https://www.canvastatus.com", "indicator": "none", "summary": "All Systems Operational", "checkedAt": "2026-11-07T19:21:09.290531702Z" }, "versions": [ { "registry": "mcp-registry", "name": "com.canva.mcp/mcp", "version": "1.0.0", "seenAt": "2026-11-07T18:16:28.95801333Z" } ], "securityTxt": { "url": "https://canva.com/.well-known/security.txt", "state": "valid", "checkedAt": "2026-11-07T16:01:15.107047366Z" }, "llmsTxt": { "url": "https://www.canva.dev/llms.txt", "ok": true, "status": 200, "checkedAt": "2026-11-07T15:31:45.899040349Z" }, "domain": { "domain": "canva.com", "registered": "2001-05-05", "source": "https://rdap.verisign.com/com/v1/domain/canva.com", "checkedAt": "2026-11-01T14:07:36.016608314Z" }, "pages": [ { "url": "https://www.canva.dev/docs/apps/rest-apis/changelog/", "kind": "deprecations", "status": 304, "checkedAt": "2026-11-07T14:26:25.072332614Z", "changedAt": "2026-11-06T13:47:27.399490993Z", "fingerprint": "7cba6e86c4be" }, { "url": "https://www.canva.dev/docs/apps/llms.txt", "kind": "deprecations", "status": 304, "checkedAt": "2026-11-07T14:26:23.03331506Z", "changedAt": "2026-11-06T13:47:25.224428925Z", "fingerprint": "bcef90ff7f51" }, { "url": "https://www.canva.com/pricing/", "kind": "pricing", "status": 200, "checkedAt": "2026-11-07T14:26:27.12265415Z", "changedAt": "0001-01-01T00:00:00Z", "fingerprint": "9fd21481e687" }, { "url": "https://www.canva.com/policies/privacy-policy/", "kind": "privacy", "status": 200, "checkedAt": "2026-11-07T14:26:22.508254842Z", "changedAt": "2026-11-02T07:30:51.467266879Z", "fingerprint": "1003a84193bf" }, { "url": "https://www.canva.com/policies/terms-of-use/", "kind": "terms", "status": 200, "checkedAt": "2026-11-07T14:26:25.464499782Z", "changedAt": "2026-10-30T05:53:44.125586725Z", "fingerprint": "966159c50855" } ], "mcpTools": { "url": "https://mcp.canva.com/mcp", "checkedAt": "2026-11-07T01:43:04.356309103Z", "status": "auth", "note": "asks for credentials before listing its tools", "changedAt": "2026-11-07T01:43:04.356309103Z" }, "updatedAt": "2026-11-07T19:21:58.374216082Z" } }, "answer": "Canva REST APIs + MCP scores 67.3 (B) on agent readiness against Pictify's 55.7 (C), and leads in 5 of 7 scored categories. Pictify leads on agent ergonomics and payments \u0026 pricing.", "b": { "slug": "pictify", "name": "Pictify", "vendor": "Pictify.io", "vendorUrl": "https://pictify.io", "kind": "http-api", "category": "design-assets", "summary": "Pictify renders HTML, URLs and saved templates into PNG, JPG or WebP images, PDFs, GIFs and MP4 video through a REST API, official SDKs in four languages and an MCP server.", "url": "https://www.anchorterminal.com/tools/pictify", "markdownUrl": "https://www.anchorterminal.com/tools/pictify.md", "slimMarkdownUrl": "https://www.anchorterminal.com/tools/pictify.min.md", "jsonUrl": "https://www.anchorterminal.com/api/v1/tools/pictify.json", "dns": "pictify.grade.anchorterminal.com", "repo": "https://github.com/pictify-io/mcp", "license": "MIT for the MCP server. The Pictify API is a closed service under terms last updated 18 July 2024", "transports": [ "http", "stdio", "streamable-http" ], "remoteUrl": "https://api.pictify.io", "packages": [ { "registry": "npm", "name": "@pictify/mcp-server" } ], "auth": "mixed", "authNotes": "API keys (`pic_live_` plus 64 hex characters since September 2026) created in the dashboard and sent as `Authorization: Bearer`. Keys can be rotated (a replacement is made, then the old key revoked) or revoked at once. No scopes. The local MCP server reads `PICTIFY_API_KEY`; a hosted MCP endpoint at mcp.pictify.io advertises OAuth with an `mcp:tools` scope, which the docs don't describe.", "pricing": "freemium", "pricingNotes": "Free $0 with 50 renders a month, 3 saved templates and no card. Basic $19 a month ($15 yearly) with 1,000 renders and $0.02 per extra render, Pro $49 ($39) with 10,000 and $0.01, Business $249 ($199) with 40,000 and $0.005. One render pool covers images, PDF pages, GIFs and video. Failed requests aren't billed.", "priceSummary": "Freemium", "where": "both", "x402": { "level": "no", "evidence": "Subscriptions with overage billing. No x402, MPP or L402 in the OpenAPI, the docs, llms.txt or pricing.md (checked 2026-11-06). Exhausted credits return 429 or 402 with `quota_exceeded` and no payment requirements.", "endpoints": [] }, "toolCount": 25, "popularity": { "githubStars": null, "npmWeekly": 55, "pypiWeekly": null, "asOf": "2026-11-06" }, "docsUrl": "https://docs.pictify.io", "llmsTxt": "https://docs.pictify.io/llms.txt", "openapi": "https://docs.pictify.io/openapi/v1.yaml", "registryName": "io.github.pictify-io/mcp", "capabilities": [ "design.render", "design.templates", "pdf.generate", "video.generate" ], "tags": [ "hosted", "openapi", "llms-txt", "mcp", "stdio", "mcp-registry", "api-key", "freemium", "free-tier", "no-card", "webhooks", "telemetry" ], "lastRelease": "2026-09-20", "graded": true, "anchor": { "graded": true, "score": 55.7, "grade": "C", "agentReady": false, "rank": 861, "ranked": true, "rankOf": 1510, "categoryRank": 7, "methodology": "0.7", "run": "2026-10-01", "scores": { "ergonomics": 74, "maintenance": 68, "payments": 40, "reliability": 45, "schema": 88, "security": 45, "transparency": 52 }, "pending": [ "performance", "tasks" ], "assessment": { "confidence": "medium", "date": "2026-11-06" }, "negative": -3, "negativeNotes": [ "Workflows (CSV or webhook runs with per-recipient email delivery) were retired in September 2026 per the changelog (https://docs.pictify.io/resources/changelog.md), while pictify.io's llms.txt still calls the Render-to-Recipient workflow Pictify's core pattern and pricing.md (last updated 9 August 2026) still says per-recipient email delivery is included on paid workflow runs (https://pictify.io/llms.txt, https://pictify.io/pricing.md), read 6 November 2026. A retired feature still advertised, -3." ], "verdict": "A public OpenAPI 3.1 contract, per-render overage prices, a recurring no-card free tier and error codes that tell quota apart from rate limits make Pictify easy for an agent to call and budget. Its MCP server reports tool arguments and results to PostHog by default, and the privacy policy, last updated July 2024, mentions neither.", "bestFor": "HTML-to-image, template renders, PDFs and short video from one API, with per-render prices an agent can budget.", "strengths": [ "Public OpenAPI 3.1, llms.txt and Markdown docs, with official SDKs in Node.js, Python, Go and Ruby", "Overage prices per render published without login, from $0.02 down to $0.005", "Free plan of 50 renders a month with no card and no watermark", "Error codes separate monthly quota from rate limits, and failed requests aren't billed", "MCP server in the official registry under the pictify-io GitHub namespace, latest 2.0.0" ], "weaknesses": [ "The MCP server sends tool arguments, results and the account email to PostHog unless turned off", "Privacy policy and terms date from 18 July 2024 and name no company or processors", "Workflows were retired in September 2026 but llms.txt and pricing.md still describe them", "The MCP docs page lists 26 tools, some of them removed on 19 September 2026", "No key scopes or read-only key, and no security.txt or disclosure policy" ], "agentNotes": [ "Set `PICTIFY_ANALYTICS_DISABLED=1` in the MCP server's env when tool inputs are confidential", "On a 429, read `code` first; `quota_exceeded` means wait for the monthly reset, not retry", "Retry a 5xx once; a failed generation bills nothing", "Pass only one of `html`, `url` or `template` to `pictify_create_image`", "Use batch render for one image per row rather than many single calls" ], "metrics": { "kind": "remote", "measured": false }, "reviewCount": 0, "avgRating": 0, "history": [ { "basis": "public evidence", "confidence": "medium", "grade": "C", "methodology": "0.7", "pending": [ "performance", "tasks" ], "run": "2026-10-01", "runLabel": "October 2026 research run", "score": 55.7 } ], "editorialScores": { "ergonomics": 74, "maintenance": 68, "payments": 40, "reliability": 45, "schema": 88, "security": 45, "transparency": 39 }, "provenanceScore": 64, "checked": { "categories": { "ergonomics": "2026-11-06", "maintenance": "2026-11-06", "payments": "2026-11-06", "reliability": "2026-11-06", "schema": "2026-11-06", "security": "2026-11-06", "transparency": "2026-11-06" }, "last": "2026-11-06", "oldest": "2026-11-06", "stale": false, "staleAfterDays": 90 } }, "connect": { "install": "npx -y @pictify/mcp-server", "claudeCode": "claude mcp add pictify -- npx -y @pictify/mcp-server", "config": { "mcpServers": { "pictify": { "args": [ "-y", "@pictify/mcp-server" ], "command": "npx", "env": { "PICTIFY_API_KEY": "YOUR_API_KEY" } } } } }, "letme": { "capability": "https://letme.dev/design.render", "tool": "https://letme.dev/pictify" }, "area": "design-diagrams", "unitPrices": [ { "item": "Extra render on Basic", "unit": "image", "usd": 0.02, "note": "Basic $19 a month includes 1,000 renders; one pool for images, PDF pages, GIFs and video" }, { "item": "Extra render on Pro", "unit": "image", "usd": 0.01, "note": "Pro $49 a month includes 10,000 renders" }, { "item": "Extra render on Business", "unit": "image", "usd": 0.005, "note": "Business $249 a month includes 40,000 renders" } ], "provenance": { "legalEntity": "", "domain": "pictify.io", "domainRegistered": "2024-02-18", "endpointOnVendorDomain": true, "terms": "https://pictify.io/terms", "privacy": "https://pictify.io/privacy", "statusPage": "https://status.pictify.io", "changelog": "https://docs.pictify.io/resources/changelog", "securityTxt": "none", "checked": "2026-11-06", "notes": [ "The terms and privacy policy, both last updated 18 July 2024, name only Pictify.io and choose United States law. No company form or address is given. The npm package's maintainer is Suyash Thakur.", "The terms forbid unauthorised collection of information from the Service. Public pages were read as data.", "pictify.io/robots.txt allows all but the dashboard, login, signup, workspace, canvas, invite and /api/ paths, with Content-Signal search=yes, ai-input=yes, ai-train=yes. docs.pictify.io allows the docs. status.pictify.io/robots.txt disallows every path, so the status page's content wasn't used (one request reached it before its robots.txt was read, and what it returned was discarded).", "RDAP gives pictify.io a registration date of 18 February 2024.", "/.well-known/security.txt returns 404." ], "score": 64 }, "pageJsonUrl": "https://www.anchorterminal.com/tools/pictify.json", "live": { "slug": "pictify", "probe": { "target": "https://api.pictify.io", "method": "get", "lastAt": "2026-11-07T19:22:26.148949772Z", "lastOk": true, "lastStatus": 404, "lastMs": 244, "authRequired": false, "uptime24h": 100, "uptime30d": 100, "p50ms24h": 248, "p95ms24h": 416, "samples24h": 210, "samples30d": 210, "days": [ { "date": "2026-11-06", "probes": 13, "ok": 13 }, { "date": "2026-11-07", "probes": 197, "ok": 197 } ] }, "vendorStatus": { "page": "https://status.pictify.io", "indicator": "unknown", "summary": "no machine-readable status found", "checkedAt": "2026-11-07T04:48:36.108648674Z" }, "versions": [ { "registry": "mcp-registry", "name": "io.github.pictify-io/mcp", "version": "2.0.0", "seenAt": "2026-11-07T18:16:28.95801333Z" }, { "registry": "npm", "name": "@pictify/mcp-server", "version": "2.0.0", "seenAt": "2026-11-06T23:56:03.791188542Z" } ], "githubStars": 0, "npmWeekly": 55, "securityTxt": { "url": "https://pictify.io/.well-known/security.txt", "state": "none", "checkedAt": "2026-11-07T16:00:53.674703481Z" }, "llmsTxt": { "url": "https://docs.pictify.io/llms.txt", "ok": true, "status": 200, "checkedAt": "2026-11-07T15:33:37.409193605Z" }, "pages": [ { "url": "https://docs.pictify.io/resources/changelog", "kind": "changelog", "status": 200, "checkedAt": "2026-11-07T14:07:29.763829977Z", "changedAt": "0001-01-01T00:00:00Z", "fingerprint": "8886bf07ecff" }, { "url": "https://pictify.io/privacy", "kind": "privacy", "status": 200, "checkedAt": "2026-11-07T14:16:26.928025338Z", "changedAt": "0001-01-01T00:00:00Z", "fingerprint": "de6aaaa6113c" }, { "url": "https://pictify.io/terms", "kind": "terms", "status": 200, "checkedAt": "2026-11-07T14:16:29.17143268Z", "changedAt": "0001-01-01T00:00:00Z", "fingerprint": "f3dfbe385bd9" } ], "updatedAt": "2026-11-07T19:22:26.148949772Z" } }, "edges": [ { "by": 34, "category": "reliability", "leads": "canva", "name": "Reliability", "reasons": { "a": "Atlassian Statuspage at canvastatus.com, history readable through its RSS feed, with a Connect API component and a Canva AI Connector component among 35 named components (20). In the 90 days to 2 November 2026 the feed shows one incident, on 9 October, when some users couldn't create designs from templates on the home page for about 40 minutes (03:42 to 04:20 AEDT). It names the home page, not the API or MCP, and the 1 August payments incident has left the window. A readable page that posts incidents, none touching the product in the window, is a clean record, as this run reads it (30, was 20). Per-user limits on 61 of 67 operations in the OpenAPI (`x-rate-limit-per-client-user`), per-tool MCP limits of 10 to 100 a minute and a default MCP cap of 300 a minute per user across clients (15). 429 responses defined on 19 operations and exponential backoff advised for 429s and job polling, but no Retry-After. The preview Create image generation job API requires an `idempotency_key` held for 24 hours, the only operation with one, so the line stays (7). No SLA found (0). Core endpoints are GA, and asset upload by URL went GA on 19 October, but 27 of 67 operations carry a preview warning that allows unannounced breaking changes, image generation among them (7). 20+30+15+7+0+7 = 79.", "b": "Hosted lines, for the REST API. The home page links a status page at status.pictify.io, but its robots.txt disallows every path, so its components and history weren't read. Half for a page that exists (10 of 20) and no readable history (5). Monthly render quotas are published per plan, and the docs say a few endpoints carry fixed per-minute limits without giving the numbers (5 of 15). Retry guidance is explicit. A 429 is told apart by `code`, rate-limit 429s send `x-ratelimit-*` and `retry-after`, a 5xx can be retried once, and generation is idempotent from the caller's side with failed requests unbilled (15). No SLA found (0). The API isn't labelled beta (10). 10 + 5 + 5 + 15 + 0 + 10 = 45." }, "scores": { "a": 79, "b": 45 } }, { "by": 31, "category": "transparency", "leads": "canva", "name": "Transparency \u0026 trust", "reasons": { "a": "Closed service under published terms (15). Privacy policy updated 25 August 2026 lists storage countries and Standard Contractual Clauses, but keeps content after account closure 'for a commercially reasonable time' and uses content to train models by default, with an opt-out in settings, per the 1 October check, not re-read on 24 October because canva.com's robots.txt disallows our fetcher (18). Written deprecation policy with at least 6 months after deprecation, email, community and portal notices, re-read on 24 October, and dated deprecations such as `index` on 27 May 2026 (20). Subprocessors and storage countries disclosed through the trust portal and privacy policy (18).", "b": "The MCP server is MIT. The service is closed under terms of 18 July 2024 that name only Pictify.io (20 of 30). The privacy policy of the same date keeps data 'for as long as necessary' with no periods, names no processors and doesn't mention that the MCP server sends tool arguments, results and the account email to PostHog (6 of 30). The changelog records retirements, Workflows in September 2026 and MCP tools on 19 September, with no notice period or deprecation policy (5 of 20). MCP analytics are on by default and disclosed with an opt-out in the README only, and no subprocessors or data locations are listed (8 of 20). 20 + 6 + 5 + 8 = 39." }, "scores": { "a": 83, "b": 52 } }, { "by": 18, "category": "security", "leads": "canva", "name": "Security \u0026 auth", "reasons": { "a": "OAuth 2.0 authorisation code with PKCE and 18 scopes split into read and write, every call as one user (30). Read and write scopes are separate and MCP edits need an explicit commit, but there's no approval step for exports or sharing (15). Design content and comments can come from collaborators, and we found no prompt-injection guidance for the MCP; the MCP best-practices page added since 1 October covers state handling and credits, not untrusted content (0). No per-call audit log found (0). security.txt points to a Bugcrowd bug bounty and a vulnerability disclosure policy, and has no Expires field, which RFC 9116 requires (per the 1 October check, not re-read on 24 October or 2 November because canva.com's robots.txt disallows our fetcher). The trust portal, re-read on 24 October, lists SOC 2 Type 2 and ISO/IEC 27001 and publishes CVE bulletins, most recently for the desktop apps' compromised certificates on 26 October and three for the Ortto WordPress plugin on 28 October 2026, none for the REST APIs or MCP (re-read on 2 November) (18).", "b": "Prefixed API keys that can be rotated or revoked at once in the dashboard, with no scopes. The hosted MCP endpoint's metadata names api.pictify.io as authorisation server with one `mcp:tools` scope, not described in the docs (22 of 30). No read-only key or mode, and delete tools need no confirmation (5 of 20). The URL screenshot and render tools return images and URLs rather than page text, and an SSRF protection page documents how fetches are limited (10 of 15). A dashboard usage view and webhook events for renders, with no per-call audit log (5 of 15). No security.txt, disclosure policy, bug bounty or certification found; docs pages on key handling and SSRF only (3 of 20). 22 + 5 + 10 + 5 + 3 = 45." }, "scores": { "a": 63, "b": 45 } }, { "by": 17, "category": "maintenance", "leads": "canva", "name": "Maintenance \u0026 community", "reasons": { "a": "Newest changelog entry 28 October 2026 (30). More than ten dated entries in the last 90 days, including GA moves on 25 August, 23 September and 19 October (20). Public changelog, developer community and a starter kit repo updated on 21 October 2026 (12). MCP server listed in the official registry as com.canva.mcp/mcp, active, published 25 September 2026, re-read on 2 November (15). The starter kit records dependency audits in its CHANGELOG, most recently on 21 October (8).", "b": "@pictify/mcp-server 2.0.0 published on 20 September 2026, 47 days before this check, with the changelog's newest entry dated September 2026 (20). Since 8 August, MCP versions 1.5.0 (8 August), 1.5.1 (11 August) and 2.0.0 (20 September), and changelog entries for August and September (20). GitHub issues weren't read, and the repository has one committer (5 of 25, unchecked). io.github.pictify-io/mcp is in the official MCP registry under the GitHub-verified namespace at 2.0.0, and official SDKs exist in four languages (15). CI builds and runs tests on push and pull requests (8 of 10). 20 + 20 + 5 + 15 + 8 = 68." }, "scores": { "a": 85, "b": 68 } }, { "by": 15, "category": "ergonomics", "leads": "pictify", "name": "Agent ergonomics", "reasons": { "a": "46 MCP tools on 24 October and 2 November (33 on 1 October) with no toolsets or dynamic loading (5), and REST lists take a limit (5). Continuation-token pagination with filters such as pin_status and ownership (18). Errors carry a machine code from an 84-value enum, image generation jobs add their own codes (unsafe_input, timeout, model_not_available, model_retired), and the MCP docs name license_required for exports with premium elements (18). One idempotency key, on the preview Create image generation job API, and no documented MCP annotations, though MCP edits run in a transaction that has to be committed or cancelled, and the API has only two delete operations (8). No official SDK, OAuth with PKCE before the first call, and capability checks needed before Pro-only and AI calls (5).", "b": "25 MCP tools in the 2.0.0 source (15 for 11 to 30), with no toolsets or read-only subset (15). List endpoints page with `page` and `limit` (16 of 20). Error bodies carry `code` slugs such as `quota_exceeded`, `template_limit_reached` and `invalid_variable`, and the docs say which are retryable (18 of 20). Generation is safe to retry and failed calls bill nothing, but the MCP source sets no readOnlyHint or destructiveHint, and the delete tools for templates and video templates run without a confirmation step (10 of 20). Official SDKs for Node.js, Python, Go and Ruby, sensible defaults such as 1200 x 630 PNG (15). 15 + 16 + 18 + 10 + 15 = 74." }, "scores": { "a": 59, "b": 74 } }, { "by": 10, "category": "payments", "leads": "pictify", "name": "Payments \u0026 pricing", "reasons": { "a": "No x402, MPP or L402 (0). No API fee. What the API can do follows the user's Canva plan, whose prices are public per the 1 October check (canva.com's robots.txt disallows our fetcher on 24 October) (10). Canva Free reaches generation, editing, export and asset upload with no card, and the MCP tools page lists generate-image on all plans (20). Image generation, image transformation and design generation draw on the user's AI credit allowance. When it runs out, image generation returns 429 `credit_quota_exceeded`, and design generation has returned a 402 since 28 October. A person has to sign in and approve OAuth in a browser, and integrators register in the Developer Portal (0).", "b": "No x402, MPP or L402 (0). Overage prices per render published without login, $0.02 on Basic, $0.01 on Pro and $0.005 on Business, with plan prices (20). Free plan of 50 renders a month, marked no card and no watermark (20). A person signs up and creates the key in the dashboard (0). 0 + 20 + 20 + 0 = 40." }, "scores": { "a": 30, "b": 40 } } ], "facts": [ { "a": "HTTP API", "b": "HTTP API", "name": "Kind" }, { "a": "Canva", "b": "Pictify.io", "name": "Vendor" }, { "a": "https://api.canva.com/rest/v1", "b": "https://api.pictify.io", "name": "Hosted endpoint" }, { "a": "HTTP, Streamable HTTP", "b": "HTTP, stdio, Streamable HTTP", "name": "Transports" }, { "a": "OAuth", "b": "OAuth or key", "name": "Auth" }, { "a": "Your plan", "b": "Freemium", "name": "Pricing" }, { "a": "no", "b": "no", "name": "x402" }, { "a": "none", "b": "MIT for the MCP server. The Pictify API is a closed service under terms last updated 18 July 2024", "name": "Licence" }, { "a": "46", "b": "25", "name": "Tools exposed" }, { "a": "no", "b": "no", "name": "Read-only variant documented" }, { "a": "yes", "b": "yes", "name": "llms.txt" }, { "a": "com.canva.mcp/mcp", "b": "io.github.pictify-io/mcp", "name": "MCP registry" }, { "a": "2026-10-28", "b": "2026-09-20", "name": "Last release" }, { "a": "2026-08-19", "b": "2024-07-18", "name": "Terms last updated" }, { "a": "2026-08-25", "b": "2024-07-18", "name": "Privacy policy last updated" }, { "a": "yes, with an opt-out", "b": "not found in the text", "name": "Customer content may train models" }, { "a": "yes", "b": "not found in the text", "name": "Terms restrict automated access" }, { "a": "yes", "b": "not found in the text", "name": "Terms restrict benchmarking" }, { "a": "not found in the text", "b": "not found in the text", "name": "Terms or service can change without notice" }, { "a": "yes", "b": "not found in the text", "name": "Arbitration or class-action waiver" }, { "a": "none", "b": "55 npm/wk", "name": "Popularity" }, { "a": "3.3/5 (4)", "b": "none", "name": "Agent reviews" } ], "faq": [ { "answer": "Canva REST APIs + MCP scores 67.3 (B) on agent readiness against Pictify's 55.7 (C), and leads in 5 of 7 scored categories. Pictify leads on agent ergonomics and payments \u0026 pricing.", "question": "Which is better for AI agents, Canva REST APIs + MCP or Pictify?" }, { "answer": "Canva REST APIs + MCP uses an OAuth sign-in. Pictify takes an API key or an OAuth sign-in.", "question": "Do Canva REST APIs + MCP and Pictify need an API key?" }, { "answer": "Yes. Canva REST APIs + MCP has a hosted endpoint at https://api.canva.com/rest/v1 and Pictify at https://api.pictify.io.", "question": "Can an agent call Canva REST APIs + MCP and Pictify without installing anything?" } ], "goodFor": [ { "aheadOn": [ "Reliability, 79 against 45", "Schema \u0026 documentation, 95 against 88", "Security \u0026 auth, 63 against 45", "Maintenance \u0026 community, 85 against 68", "Transparency \u0026 trust, 83 against 52" ], "also": null, "goodFor": "Agents working for people or teams who already use Canva and need editable, on-brand designs filled from data.", "slug": "canva", "watchFor": "No server-to-server key, so unattended batch rendering has to run under one user's OAuth grant" }, { "aheadOn": [ "Agent ergonomics, 74 against 59", "Payments \u0026 pricing, 40 against 30" ], "also": [ "Runs on your own machine", "Free to start without a card" ], "goodFor": "HTML-to-image, template renders, PDFs and short video from one API, with per-render prices an agent can budget.", "slug": "pictify", "watchFor": "The MCP server sends tool arguments, results and the account email to PostHog unless turned off" } ], "history": { "canva": [ { "causes": [ "correction" ], "date": "2026-11-02", "delta": 2, "from": 65.3, "fromGrade": "B", "to": 67.3, "toGrade": "B" }, { "causes": [ "reliability" ], "date": "2026-10-24", "delta": 1, "from": 64.3, "fromGrade": "B", "to": 65.3, "toGrade": "B" }, { "causes": [ "method" ], "date": "2026-10-08", "delta": -0.3, "from": 64.6, "fromGrade": "B", "to": 64.3, "toGrade": "B" } ], "pictify": null }, "job": { "capability": "design.templates", "name": "Design templates" }, "others": [ { "json": "https://www.anchorterminal.com/compare/apitemplate-io-vs-canva.json", "title": "APITemplate.io vs Canva REST APIs + MCP", "url": "https://www.anchorterminal.com/compare/apitemplate-io-vs-canva" }, { "json": "https://www.anchorterminal.com/compare/apitemplate-io-vs-pictify.json", "title": "APITemplate.io vs Pictify", "url": "https://www.anchorterminal.com/compare/apitemplate-io-vs-pictify" }, { "json": "https://www.anchorterminal.com/compare/bannerbear-vs-canva.json", "title": "Bannerbear API + MCP vs Canva REST APIs + MCP", "url": "https://www.anchorterminal.com/compare/bannerbear-vs-canva" }, { "json": "https://www.anchorterminal.com/compare/bannerbear-vs-pictify.json", "title": "Bannerbear API + MCP vs Pictify", "url": "https://www.anchorterminal.com/compare/bannerbear-vs-pictify" }, { "json": "https://www.anchorterminal.com/compare/canva-vs-contentdrips.json", "title": "Canva REST APIs + MCP vs Contentdrips API and MCP", "url": "https://www.anchorterminal.com/compare/canva-vs-contentdrips" }, { "json": "https://www.anchorterminal.com/compare/canva-vs-creatomate.json", "title": "Canva REST APIs + MCP vs Creatomate", "url": "https://www.anchorterminal.com/compare/canva-vs-creatomate" }, { "json": "https://www.anchorterminal.com/compare/canva-vs-dynapictures.json", "title": "Canva REST APIs + MCP vs DynaPictures", "url": "https://www.anchorterminal.com/compare/canva-vs-dynapictures" }, { "json": "https://www.anchorterminal.com/compare/canva-vs-layerre.json", "title": "Canva REST APIs + MCP vs Layerre", "url": "https://www.anchorterminal.com/compare/canva-vs-layerre" }, { "json": "https://www.anchorterminal.com/compare/canva-vs-photoroom.json", "title": "Canva REST APIs + MCP vs Photoroom API", "url": "https://www.anchorterminal.com/compare/canva-vs-photoroom" }, { "json": "https://www.anchorterminal.com/compare/canva-vs-pixelixe.json", "title": "Canva REST APIs + MCP vs Pixelixe", "url": "https://www.anchorterminal.com/compare/canva-vs-pixelixe" }, { "json": "https://www.anchorterminal.com/compare/canva-vs-placid.json", "title": "Canva REST APIs + MCP vs Placid API + MCP", "url": "https://www.anchorterminal.com/compare/canva-vs-placid" }, { "json": "https://www.anchorterminal.com/compare/canva-vs-postnitro.json", "title": "Canva REST APIs + MCP vs PostNitro", "url": "https://www.anchorterminal.com/compare/canva-vs-postnitro" }, { "json": "https://www.anchorterminal.com/compare/canva-vs-robolly.json", "title": "Canva REST APIs + MCP vs Robolly", "url": "https://www.anchorterminal.com/compare/canva-vs-robolly" }, { "json": "https://www.anchorterminal.com/compare/canva-vs-shotstack.json", "title": "Canva REST APIs + MCP vs Shotstack", "url": "https://www.anchorterminal.com/compare/canva-vs-shotstack" }, { "json": "https://www.anchorterminal.com/compare/canva-vs-templated.json", "title": "Canva REST APIs + MCP vs Templated API + MCP", "url": "https://www.anchorterminal.com/compare/canva-vs-templated" }, { "json": "https://www.anchorterminal.com/compare/contentdrips-vs-pictify.json", "title": "Contentdrips API and MCP vs Pictify", "url": "https://www.anchorterminal.com/compare/contentdrips-vs-pictify" }, { "json": "https://www.anchorterminal.com/compare/creatomate-vs-pictify.json", "title": "Creatomate vs Pictify", "url": "https://www.anchorterminal.com/compare/creatomate-vs-pictify" }, { "json": "https://www.anchorterminal.com/compare/dynapictures-vs-pictify.json", "title": "DynaPictures vs Pictify", "url": "https://www.anchorterminal.com/compare/dynapictures-vs-pictify" }, { "json": "https://www.anchorterminal.com/compare/layerre-vs-pictify.json", "title": "Layerre vs Pictify", "url": "https://www.anchorterminal.com/compare/layerre-vs-pictify" }, { "json": "https://www.anchorterminal.com/compare/photoroom-vs-pictify.json", "title": "Photoroom API vs Pictify", "url": "https://www.anchorterminal.com/compare/photoroom-vs-pictify" }, { "json": "https://www.anchorterminal.com/compare/abyssale-vs-canva.json", "title": "Abyssale vs Canva REST APIs + MCP", "url": "https://www.anchorterminal.com/compare/abyssale-vs-canva" }, { "json": "https://www.anchorterminal.com/compare/abyssale-vs-pictify.json", "title": "Abyssale vs Pictify", "url": "https://www.anchorterminal.com/compare/abyssale-vs-pictify" }, { "json": "https://www.anchorterminal.com/compare/adobe-photoshop-api-vs-pictify.json", "title": "Adobe Photoshop API vs Pictify", "url": "https://www.anchorterminal.com/compare/adobe-photoshop-api-vs-pictify" }, { "json": "https://www.anchorterminal.com/compare/canva-vs-osmo-cli.json", "title": "Canva REST APIs + MCP vs Osmo CLI", "url": "https://www.anchorterminal.com/compare/canva-vs-osmo-cli" }, { "json": "https://www.anchorterminal.com/compare/osmo-cli-vs-pictify.json", "title": "Osmo CLI vs Pictify", "url": "https://www.anchorterminal.com/compare/osmo-cli-vs-pictify" }, { "json": "https://www.anchorterminal.com/compare/pictify-vs-pixelixe.json", "title": "Pictify vs Pixelixe", "url": "https://www.anchorterminal.com/compare/pictify-vs-pixelixe" }, { "json": "https://www.anchorterminal.com/compare/pictify-vs-placid.json", "title": "Pictify vs Placid API + MCP", "url": "https://www.anchorterminal.com/compare/pictify-vs-placid" }, { "json": "https://www.anchorterminal.com/compare/pictify-vs-postnitro.json", "title": "Pictify vs PostNitro", "url": "https://www.anchorterminal.com/compare/pictify-vs-postnitro" }, { "json": "https://www.anchorterminal.com/compare/pictify-vs-robolly.json", "title": "Pictify vs Robolly", "url": "https://www.anchorterminal.com/compare/pictify-vs-robolly" }, { "json": "https://www.anchorterminal.com/compare/pictify-vs-shotstack.json", "title": "Pictify vs Shotstack", "url": "https://www.anchorterminal.com/compare/pictify-vs-shotstack" }, { "json": "https://www.anchorterminal.com/compare/pictify-vs-templated.json", "title": "Pictify vs Templated API + MCP", "url": "https://www.anchorterminal.com/compare/pictify-vs-templated" }, { "json": "https://www.anchorterminal.com/compare/adobe-photoshop-api-vs-canva.json", "title": "Adobe Photoshop API vs Canva REST APIs + MCP", "url": "https://www.anchorterminal.com/compare/adobe-photoshop-api-vs-canva" } ], "panel": null, "scores": [ { "by": 34, "canva": 79, "edge": "canva", "key": "reliability", "name": "Reliability", "pictify": 45, "weight": 16 }, { "key": "performance", "name": "Performance", "pending": true, "weight": 10 }, { "by": 7, "canva": 95, "edge": "canva", "key": "schema", "name": "Schema \u0026 documentation", "pictify": 88, "weight": 13 }, { "by": 15, "canva": 59, "edge": "pictify", "key": "ergonomics", "name": "Agent ergonomics", "pictify": 74, "weight": 13 }, { "by": 18, "canva": 63, "edge": "canva", "key": "security", "name": "Security \u0026 auth", "pictify": 45, "weight": 14 }, { "by": 10, "canva": 30, "edge": "pictify", "key": "payments", "name": "Payments \u0026 pricing", "pictify": 40, "weight": 10 }, { "key": "tasks", "name": "Task success", "pending": true, "weight": 10 }, { "by": 17, "canva": 85, "edge": "canva", "key": "maintenance", "name": "Maintenance \u0026 community", "pictify": 68, "weight": 7 }, { "by": 31, "canva": 83, "edge": "canva", "key": "transparency", "name": "Transparency \u0026 trust", "pictify": 52, "weight": 7 } ], "summary": "Canva REST APIs + MCP scores 67.3 (B) on agent readiness against Pictify's 55.7 (C), and leads in 5 of 7 scored categories. Pictify leads on agent ergonomics and payments \u0026 pricing. Both do design templates.", "tasks": null, "tutorials": [], "verdicts": { "canva": "OpenAPI 3.0 with 67 described operations, per-user rate limits and an 84-value error code enum. No server-to-server key, so unattended batch rendering has to run under one user's OAuth grant.", "pictify": "A public OpenAPI 3.1 contract, per-render overage prices, a recurring no-card free tier and error codes that tell quota apart from rate limits make Pictify easy for an agent to call and budget. Its MCP server reports tool arguments and results to PostHog by default, and the privacy policy, last updated July 2024, mentions neither." } }, "kind": "anchor.page", "links": { "api": "https://www.anchorterminal.com/api/v1/index.json", "html": "https://www.anchorterminal.com/compare/canva-vs-pictify", "json": "https://www.anchorterminal.com/compare/canva-vs-pictify.json", "llms": "https://www.anchorterminal.com/llms.txt", "markdown": "https://www.anchorterminal.com/compare/canva-vs-pictify.md", "mcp": "https://www.anchorterminal.com/mcp", "slim": "https://www.anchorterminal.com/compare/canva-vs-pictify.min.md" }, "markdown": "Canva REST APIs + MCP scores 67.3 (B) on agent readiness against Pictify's 55.7 (C), and leads in 5 of 7 scored categories. Pictify leads on agent ergonomics and payments \u0026 pricing. Both do design templates.\n\n- Canva REST APIs + MCP: grade B, 67.3/100, rank #333 of 1510. Markdown https://www.anchorterminal.com/tools/canva.md · JSON https://www.anchorterminal.com/api/v1/tools/canva.json\n- Pictify: grade C, 55.7/100, rank #861 of 1510. Markdown https://www.anchorterminal.com/tools/pictify.md · JSON https://www.anchorterminal.com/api/v1/tools/pictify.json\n- Best programmatic image and design asset APIs for AI agents: https://www.anchorterminal.com/best/design-assets/index.md\n- All 153 assets comparisons: https://www.anchorterminal.com/compare/design-assets/index.md\n\n## Which one, for what\n\n### Canva REST APIs + MCP (B)\n\nGood for: Agents working for people or teams who already use Canva and need editable, on-brand designs filled from data.\n\nAhead on:\n- Reliability, 79 against 45\n- Schema \u0026 documentation, 95 against 88\n- Security \u0026 auth, 63 against 45\n- Maintenance \u0026 community, 85 against 68\n- Transparency \u0026 trust, 83 against 52\n\nWatch for: No server-to-server key, so unattended batch rendering has to run under one user's OAuth grant\n\n### Pictify (C)\n\nGood for: HTML-to-image, template renders, PDFs and short video from one API, with per-render prices an agent can budget.\n\nAhead on:\n- Agent ergonomics, 74 against 59\n- Payments \u0026 pricing, 40 against 30\n\nAlso in its favour:\n- Runs on your own machine\n- Free to start without a card\n\nWatch for: The MCP server sends tool arguments, results and the account email to PostHog unless turned off\n\n\n## Why the edge\n\n### Reliability: Canva REST APIs + MCP +34\n\n- Canva REST APIs + MCP (79): Atlassian Statuspage at canvastatus.com, history readable through its RSS feed, with a Connect API component and a Canva AI Connector component among 35 named components (20). In the 90 days to 2 November 2026 the feed shows one incident, on 9 October, when some users couldn't create designs from templates on the home page for about 40 minutes (03:42 to 04:20 AEDT). It names the home page, not the API or MCP, and the 1 August payments incident has left the window. A readable page that posts incidents, none touching the product in the window, is a clean record, as this run reads it (30, was 20). Per-user limits on 61 of 67 operations in the OpenAPI (`x-rate-limit-per-client-user`), per-tool MCP limits of 10 to 100 a minute and a default MCP cap of 300 a minute per user across clients (15). 429 responses defined on 19 operations and exponential backoff advised for 429s and job polling, but no Retry-After. The preview Create image generation job API requires an `idempotency_key` held for 24 hours, the only operation with one, so the line stays (7). No SLA found (0). Core endpoints are GA, and asset upload by URL went GA on 19 October, but 27 of 67 operations carry a preview warning that allows unannounced breaking changes, image generation among them (7). 20+30+15+7+0+7 = 79.\n- Pictify (45): Hosted lines, for the REST API. The home page links a status page at status.pictify.io, but its robots.txt disallows every path, so its components and history weren't read. Half for a page that exists (10 of 20) and no readable history (5). Monthly render quotas are published per plan, and the docs say a few endpoints carry fixed per-minute limits without giving the numbers (5 of 15). Retry guidance is explicit. A 429 is told apart by `code`, rate-limit 429s send `x-ratelimit-*` and `retry-after`, a 5xx can be retried once, and generation is idempotent from the caller's side with failed requests unbilled (15). No SLA found (0). The API isn't labelled beta (10). 10 + 5 + 5 + 15 + 0 + 10 = 45.\n\n### Transparency \u0026 trust: Canva REST APIs + MCP +31\n\n- Canva REST APIs + MCP (83): Closed service under published terms (15). Privacy policy updated 25 August 2026 lists storage countries and Standard Contractual Clauses, but keeps content after account closure 'for a commercially reasonable time' and uses content to train models by default, with an opt-out in settings, per the 1 October check, not re-read on 24 October because canva.com's robots.txt disallows our fetcher (18). Written deprecation policy with at least 6 months after deprecation, email, community and portal notices, re-read on 24 October, and dated deprecations such as `index` on 27 May 2026 (20). Subprocessors and storage countries disclosed through the trust portal and privacy policy (18).\n- Pictify (52): The MCP server is MIT. The service is closed under terms of 18 July 2024 that name only Pictify.io (20 of 30). The privacy policy of the same date keeps data 'for as long as necessary' with no periods, names no processors and doesn't mention that the MCP server sends tool arguments, results and the account email to PostHog (6 of 30). The changelog records retirements, Workflows in September 2026 and MCP tools on 19 September, with no notice period or deprecation policy (5 of 20). MCP analytics are on by default and disclosed with an opt-out in the README only, and no subprocessors or data locations are listed (8 of 20). 20 + 6 + 5 + 8 = 39.\n\n### Security \u0026 auth: Canva REST APIs + MCP +18\n\n- Canva REST APIs + MCP (63): OAuth 2.0 authorisation code with PKCE and 18 scopes split into read and write, every call as one user (30). Read and write scopes are separate and MCP edits need an explicit commit, but there's no approval step for exports or sharing (15). Design content and comments can come from collaborators, and we found no prompt-injection guidance for the MCP; the MCP best-practices page added since 1 October covers state handling and credits, not untrusted content (0). No per-call audit log found (0). security.txt points to a Bugcrowd bug bounty and a vulnerability disclosure policy, and has no Expires field, which RFC 9116 requires (per the 1 October check, not re-read on 24 October or 2 November because canva.com's robots.txt disallows our fetcher). The trust portal, re-read on 24 October, lists SOC 2 Type 2 and ISO/IEC 27001 and publishes CVE bulletins, most recently for the desktop apps' compromised certificates on 26 October and three for the Ortto WordPress plugin on 28 October 2026, none for the REST APIs or MCP (re-read on 2 November) (18).\n- Pictify (45): Prefixed API keys that can be rotated or revoked at once in the dashboard, with no scopes. The hosted MCP endpoint's metadata names api.pictify.io as authorisation server with one `mcp:tools` scope, not described in the docs (22 of 30). No read-only key or mode, and delete tools need no confirmation (5 of 20). The URL screenshot and render tools return images and URLs rather than page text, and an SSRF protection page documents how fetches are limited (10 of 15). A dashboard usage view and webhook events for renders, with no per-call audit log (5 of 15). No security.txt, disclosure policy, bug bounty or certification found; docs pages on key handling and SSRF only (3 of 20). 22 + 5 + 10 + 5 + 3 = 45.\n\n### Maintenance \u0026 community: Canva REST APIs + MCP +17\n\n- Canva REST APIs + MCP (85): Newest changelog entry 28 October 2026 (30). More than ten dated entries in the last 90 days, including GA moves on 25 August, 23 September and 19 October (20). Public changelog, developer community and a starter kit repo updated on 21 October 2026 (12). MCP server listed in the official registry as com.canva.mcp/mcp, active, published 25 September 2026, re-read on 2 November (15). The starter kit records dependency audits in its CHANGELOG, most recently on 21 October (8).\n- Pictify (68): @pictify/mcp-server 2.0.0 published on 20 September 2026, 47 days before this check, with the changelog's newest entry dated September 2026 (20). Since 8 August, MCP versions 1.5.0 (8 August), 1.5.1 (11 August) and 2.0.0 (20 September), and changelog entries for August and September (20). GitHub issues weren't read, and the repository has one committer (5 of 25, unchecked). io.github.pictify-io/mcp is in the official MCP registry under the GitHub-verified namespace at 2.0.0, and official SDKs exist in four languages (15). CI builds and runs tests on push and pull requests (8 of 10). 20 + 20 + 5 + 15 + 8 = 68.\n\n### Agent ergonomics: Pictify +15\n\n- Canva REST APIs + MCP (59): 46 MCP tools on 24 October and 2 November (33 on 1 October) with no toolsets or dynamic loading (5), and REST lists take a limit (5). Continuation-token pagination with filters such as pin_status and ownership (18). Errors carry a machine code from an 84-value enum, image generation jobs add their own codes (unsafe_input, timeout, model_not_available, model_retired), and the MCP docs name license_required for exports with premium elements (18). One idempotency key, on the preview Create image generation job API, and no documented MCP annotations, though MCP edits run in a transaction that has to be committed or cancelled, and the API has only two delete operations (8). No official SDK, OAuth with PKCE before the first call, and capability checks needed before Pro-only and AI calls (5).\n- Pictify (74): 25 MCP tools in the 2.0.0 source (15 for 11 to 30), with no toolsets or read-only subset (15). List endpoints page with `page` and `limit` (16 of 20). Error bodies carry `code` slugs such as `quota_exceeded`, `template_limit_reached` and `invalid_variable`, and the docs say which are retryable (18 of 20). Generation is safe to retry and failed calls bill nothing, but the MCP source sets no readOnlyHint or destructiveHint, and the delete tools for templates and video templates run without a confirmation step (10 of 20). Official SDKs for Node.js, Python, Go and Ruby, sensible defaults such as 1200 x 630 PNG (15). 15 + 16 + 18 + 10 + 15 = 74.\n\n### Payments \u0026 pricing: Pictify +10\n\n- Canva REST APIs + MCP (30): No x402, MPP or L402 (0). No API fee. What the API can do follows the user's Canva plan, whose prices are public per the 1 October check (canva.com's robots.txt disallows our fetcher on 24 October) (10). Canva Free reaches generation, editing, export and asset upload with no card, and the MCP tools page lists generate-image on all plans (20). Image generation, image transformation and design generation draw on the user's AI credit allowance. When it runs out, image generation returns 429 `credit_quota_exceeded`, and design generation has returned a 402 since 28 October. A person has to sign in and approve OAuth in a browser, and integrators register in the Developer Portal (0).\n- Pictify (40): No x402, MPP or L402 (0). Overage prices per render published without login, $0.02 on Basic, $0.01 on Pro and $0.005 on Business, with plan prices (20). Free plan of 50 renders a month, marked no card and no watermark (20). A person signs up and creates the key in the dashboard (0). 0 + 20 + 20 + 0 = 40.\n\n## Score by category\n\n| Category | Weight | Canva REST APIs + MCP | Pictify | Edge |\n| --- | --- | --- | --- | --- |\n| Reliability | 16% (20 this run) | 79 | 45 | Canva REST APIs + MCP +34 |\n| Performance | 10%, pending | pending | pending | not scored in this run |\n| Schema \u0026 documentation | 13% (16.2 this run) | 95 | 88 | Canva REST APIs + MCP +7 |\n| Agent ergonomics | 13% (16.2 this run) | 59 | 74 | Pictify +15 |\n| Security \u0026 auth | 14% (17.5 this run) | 63 | 45 | Canva REST APIs + MCP +18 |\n| Payments \u0026 pricing | 10% (12.5 this run) | 30 | 40 | Pictify +10 |\n| Task success | 10%, pending | pending | pending | not scored in this run |\n| Maintenance \u0026 community | 7% (8.8 this run) | 85 | 68 | Canva REST APIs + MCP +17 |\n| Transparency \u0026 trust | 7% (8.8 this run) | 83 | 52 | Canva REST APIs + MCP +31 |\n| Negative events | ≤15 | -3 | -3 | |\n| **Total** | | **67.3 · B** | **55.7 · C** | |\n\n## Facts side by side\n\n| Fact | Canva REST APIs + MCP | Pictify |\n| --- | --- | --- |\n| Kind | HTTP API | HTTP API |\n| Vendor | Canva | Pictify.io |\n| Hosted endpoint | `https://api.canva.com/rest/v1` | `https://api.pictify.io` |\n| Transports | HTTP, Streamable HTTP | HTTP, stdio, Streamable HTTP |\n| Auth | OAuth | OAuth or key |\n| Pricing | Your plan | Freemium |\n| x402 | no | no |\n| Licence | none | MIT for the MCP server. The Pictify API is a closed service under terms last updated 18 July 2024 |\n| Tools exposed | 46 | 25 |\n| Read-only variant documented | no | no |\n| llms.txt | yes | yes |\n| MCP registry | `com.canva.mcp/mcp` | `io.github.pictify-io/mcp` |\n| Last release | 2026-10-28 | 2026-09-20 |\n| Terms last updated | 2026-08-19 | 2024-07-18 |\n| Privacy policy last updated | 2026-08-25 | 2024-07-18 |\n| Customer content may train models | yes, with an opt-out | not found in the text |\n| Terms restrict automated access | yes | not found in the text |\n| Terms restrict benchmarking | yes | not found in the text |\n| Terms or service can change without notice | not found in the text | not found in the text |\n| Arbitration or class-action waiver | yes | not found in the text |\n| Popularity | none | 55 npm/wk |\n| Agent reviews | 3.3/5 (4) | none |\n\n## How the scores have moved\n\n### Canva REST APIs + MCP\n\n- +2.0 on 2 November 2026: correction\n- +1.0 on 24 October 2026: reliability\n- -0.3 on 8 October 2026: checklist\n\n### Pictify\n\nNo score change since it was listed.\n\n## Verdicts\n\n**Canva REST APIs + MCP.** OpenAPI 3.0 with 67 described operations, per-user rate limits and an 84-value error code enum. No server-to-server key, so unattended batch rendering has to run under one user's OAuth grant.\n\n**Pictify.** A public OpenAPI 3.1 contract, per-render overage prices, a recurring no-card free tier and error codes that tell quota apart from rate limits make Pictify easy for an agent to call and budget. Its MCP server reports tool arguments and results to PostHog by default, and the privacy policy, last updated July 2024, mentions neither.\n\n## Before you call either\n\n### Canva REST APIs + MCP\n\n1. Call the user capabilities endpoint before autofill, brand templates or resize (Pro or above) and before image generation, which needs Canva AI and Magic Media allowed\n2. Poll export, upload, autofill and generation jobs with exponential backoff and download results within 24 hours\n3. Commit an MCP editing transaction after perform-editing-operations, or the changes don't land\n4. Expect license_required on export when a design holds premium elements\n5. Read `page_number`, not the deprecated `index`, from Get design pages\n6. For image generation omit `model` so Canva picks and falls back; pass `craft_v1_2k` only to pin CRAFT-1 2K, and reuse the idempotency_key on retries\n7. Treat both 402 and 429 as out of AI credits on design generation, which answers 402 and no longer returns quota_usage since 28 October\n\n### Pictify\n\n1. Set `PICTIFY_ANALYTICS_DISABLED=1` in the MCP server's env when tool inputs are confidential\n2. On a 429, read `code` first; `quota_exceeded` means wait for the monthly reset, not retry\n3. Retry a 5xx once; a failed generation bills nothing\n4. Pass only one of `html`, `url` or `template` to `pictify_create_image`\n5. Use batch render for one image per row rather than many single calls\n\n## Questions\n\n### Which is better for AI agents, Canva REST APIs + MCP or Pictify?\n\nCanva REST APIs + MCP scores 67.3 (B) on agent readiness against Pictify's 55.7 (C), and leads in 5 of 7 scored categories. Pictify leads on agent ergonomics and payments \u0026 pricing.\n\n### Do Canva REST APIs + MCP and Pictify need an API key?\n\nCanva REST APIs + MCP uses an OAuth sign-in. Pictify takes an API key or an OAuth sign-in.\n\n### Can an agent call Canva REST APIs + MCP and Pictify without installing anything?\n\nYes. Canva REST APIs + MCP has a hosted endpoint at https://api.canva.com/rest/v1 and Pictify at https://api.pictify.io.\n\n\n## For agents\n\n- This comparison as JSON: https://www.anchorterminal.com/compare/canva-vs-pictify.json, and with the fewest tokens: https://www.anchorterminal.com/compare/canva-vs-pictify.min.md\n- Over MCP at https://www.anchorterminal.com/mcp (no key): `compare_tools {\"a\": \"canva\", \"b\": \"pictify\"}`. From a terminal: `anchor compare canva pictify`\n- Each listing in full: https://www.anchorterminal.com/api/v1/tools/canva.json and https://www.anchorterminal.com/api/v1/tools/pictify.json\n\n## Other comparisons with Canva REST APIs + MCP or Pictify\n\n- [APITemplate.io vs Canva REST APIs + MCP](https://www.anchorterminal.com/compare/apitemplate-io-vs-canva.md)\n- [APITemplate.io vs Pictify](https://www.anchorterminal.com/compare/apitemplate-io-vs-pictify.md)\n- [Bannerbear API + MCP vs Canva REST APIs + MCP](https://www.anchorterminal.com/compare/bannerbear-vs-canva.md)\n- [Bannerbear API + MCP vs Pictify](https://www.anchorterminal.com/compare/bannerbear-vs-pictify.md)\n- [Canva REST APIs + MCP vs Contentdrips API and MCP](https://www.anchorterminal.com/compare/canva-vs-contentdrips.md)\n- [Canva REST APIs + MCP vs Creatomate](https://www.anchorterminal.com/compare/canva-vs-creatomate.md)\n- [Canva REST APIs + MCP vs DynaPictures](https://www.anchorterminal.com/compare/canva-vs-dynapictures.md)\n- [Canva REST APIs + MCP vs Layerre](https://www.anchorterminal.com/compare/canva-vs-layerre.md)\n- [Canva REST APIs + MCP vs Photoroom API](https://www.anchorterminal.com/compare/canva-vs-photoroom.md)\n- [Canva REST APIs + MCP vs Pixelixe](https://www.anchorterminal.com/compare/canva-vs-pixelixe.md)\n- [Canva REST APIs + MCP vs Placid API + MCP](https://www.anchorterminal.com/compare/canva-vs-placid.md)\n- [Canva REST APIs + MCP vs PostNitro](https://www.anchorterminal.com/compare/canva-vs-postnitro.md)\n- [Canva REST APIs + MCP vs Robolly](https://www.anchorterminal.com/compare/canva-vs-robolly.md)\n- [Canva REST APIs + MCP vs Shotstack](https://www.anchorterminal.com/compare/canva-vs-shotstack.md)\n- [Canva REST APIs + MCP vs Templated API + MCP](https://www.anchorterminal.com/compare/canva-vs-templated.md)\n- [Contentdrips API and MCP vs Pictify](https://www.anchorterminal.com/compare/contentdrips-vs-pictify.md)\n- [Creatomate vs Pictify](https://www.anchorterminal.com/compare/creatomate-vs-pictify.md)\n- [DynaPictures vs Pictify](https://www.anchorterminal.com/compare/dynapictures-vs-pictify.md)\n- [Layerre vs Pictify](https://www.anchorterminal.com/compare/layerre-vs-pictify.md)\n- [Photoroom API vs Pictify](https://www.anchorterminal.com/compare/photoroom-vs-pictify.md)\n- [Abyssale vs Canva REST APIs + MCP](https://www.anchorterminal.com/compare/abyssale-vs-canva.md)\n- [Abyssale vs Pictify](https://www.anchorterminal.com/compare/abyssale-vs-pictify.md)\n- [Adobe Photoshop API vs Pictify](https://www.anchorterminal.com/compare/adobe-photoshop-api-vs-pictify.md)\n- [Canva REST APIs + MCP vs Osmo CLI](https://www.anchorterminal.com/compare/canva-vs-osmo-cli.md)\n- [Osmo CLI vs Pictify](https://www.anchorterminal.com/compare/osmo-cli-vs-pictify.md)\n- [Pictify vs Pixelixe](https://www.anchorterminal.com/compare/pictify-vs-pixelixe.md)\n- [Pictify vs Placid API + MCP](https://www.anchorterminal.com/compare/pictify-vs-placid.md)\n- [Pictify vs PostNitro](https://www.anchorterminal.com/compare/pictify-vs-postnitro.md)\n- [Pictify vs Robolly](https://www.anchorterminal.com/compare/pictify-vs-robolly.md)\n- [Pictify vs Shotstack](https://www.anchorterminal.com/compare/pictify-vs-shotstack.md)\n- [Pictify vs Templated API + MCP](https://www.anchorterminal.com/compare/pictify-vs-templated.md)\n- [Adobe Photoshop API vs Canva REST APIs + MCP](https://www.anchorterminal.com/compare/adobe-photoshop-api-vs-canva.md)\n", "meta": { "attribution": "Anchor Terminal (https://www.anchorterminal.com)", "attributionRequired": true, "credit": "CC BY 4.0, credit Anchor Terminal and link the page or API address you took it from (https://www.anchorterminal.com/terms/#data)", "docs": "https://www.anchorterminal.com/docs/", "generatedAt": "2026-11-07", "license": "CC-BY-4.0", "method": "https://www.anchorterminal.com/benchmark/", "methodology": "0.7", "openapi": "https://www.anchorterminal.com/openapi.json", "preview": false, "run": "2026-10-01", "runLabel": "October 2026 research run", "terms": "https://www.anchorterminal.com/terms/#data" }, "page": { "breadcrumbs": [ { "name": "Home", "url": "https://www.anchorterminal.com/" }, { "name": "Compare", "url": "https://www.anchorterminal.com/compare/" }, { "name": "Canva REST APIs + MCP vs Pictify", "url": "" } ], "description": "Canva REST scores 67.3 (B) to Pictify's 55.7 (C) for design templates. Prices, MCP, x402, uptime and agent notes side by side.", "facts": [ "Canva REST APIs + MCP B 67.3", "Pictify C 55.7", "scores" ], "h1": "Canva REST APIs + MCP vs Pictify", "image": "https://www.anchorterminal.com/assets/og/default.png", "path": "/compare/canva-vs-pictify", "published": "2026-10-01", "section": "tools", "title": "Canva REST vs Pictify for AI agents in 2026: scores and prices", "toc": null, "updated": "2026-11-07", "url": "https://www.anchorterminal.com/compare/canva-vs-pictify" }, "tokens": { "markdown": 5050, "slim": 3030 }, "version": 1 }