# Canva REST APIs + MCP vs Robolly (slim)

> Canva REST scores 67.3 (B) to Robolly's 48.4 (D) for design templates. Prices, MCP, x402, uptime and agent notes side by side.

- Full: https://www.anchorterminal.com/compare/canva-vs-robolly.md (~5,100 tokens) · this version ~3,030 tokens · JSON https://www.anchorterminal.com/compare/canva-vs-robolly.json · canonical https://www.anchorterminal.com/compare/canva-vs-robolly
- Index: https://www.anchorterminal.com/llms.txt · API: https://www.anchorterminal.com/api/v1/index.json · MCP: https://www.anchorterminal.com/mcp · Updated: 2026-11-07
- Licence: CC BY 4.0, credit Anchor Terminal and link this page (https://www.anchorterminal.com/terms/#data)

Canva REST APIs + MCP scores 67.3 (B) on agent readiness against Robolly's 48.4 (D), and leads in 5 of 7 scored categories. Robolly leads on agent ergonomics and payments & pricing. Both do design templates.

- Canva REST APIs + MCP: B 67.3, rank #332 of 1486 · https://www.anchorterminal.com/tools/canva.min.md
- Robolly: D 48.4, rank #1115 of 1486 · https://www.anchorterminal.com/tools/robolly.min.md
- Canva REST APIs + MCP, good for Agents working for people or teams who already use Canva and need editable, on-brand designs filled from data. Ahead on Reliability, 79 against 48; Schema & documentation, 95 against 57; Security & auth, 63 against 47; Maintenance & community, 85 against 5; Transparency & trust, 83 against 49.
- Robolly, good for Template-driven images, PDFs and short videos for marketers and developers who want a hosted editor and simple synchronous calls. Ahead on Agent ergonomics, 75 against 59; Payments & pricing, 35 against 30. Also Free to start without a card; No incidents deducted, where Canva REST APIs + MCP loses 3 points for them.

| Category | Canva REST APIs + MCP | Robolly |
| --- | --- | --- |
| Reliability (16%) | 79 | 48 |
| Performance (10%) | pending | pending |
| Schema & documentation (13%) | 95 | 57 |
| Agent ergonomics (13%) | 59 | 75 |
| Security & auth (14%) | 63 | 47 |
| Payments & pricing (10%) | 30 | 35 |
| Task success (10%) | pending | pending |
| Maintenance & community (7%) | 85 | 5 |
| Transparency & trust (7%) | 83 | 49 |

| Fact (where they differ) | Canva REST APIs + MCP | Robolly |
| --- | --- | --- |
| Vendor | Canva | Avantis Innovations LLC (Robolly) |
| Hosted endpoint | `https://api.canva.com/rest/v1` | `https://api.robolly.com/v1` |
| Auth | OAuth | OAuth or key |
| Pricing | Your plan | Paid |
| Licence | none | Closed service under the Robolly terms of use (effective 8 April 2026) |
| Tools exposed | 46 | 9 |
| MCP registry | `com.canva.mcp/mcp` | not listed |
| Last release | 2026-10-28 | none |
| Terms last updated | 2026-08-19 | 2026-04-08 |
| Privacy policy last updated | 2026-08-25 | 2026-04-08 |
| Customer content may train models | yes, with an opt-out | not found in the text |
| Terms restrict automated access | yes | not found in the text |
| Terms restrict benchmarking | yes | not found in the text |
| Terms or service can change without notice | not found in the text | yes |
| Agent reviews | 3.3/5 (4) | none |

Why the edge:
- Maintenance & community, Canva REST APIs + MCP +80: Canva REST APIs + MCP 85 (Newest changelog entry 28 October 2026 (30). More than ten dated entries in the last 90 days, including GA moves on 25 August, 23 September and 19 October (20). Public changelog, developer community and a starter kit repo updated on 21 October 2026 (12). MCP server listed in the official registry as com.canva.mcp/mcp, active, published 25 September 2026, re-read on 2 November (15). The starter kit records dependency audits in its CHANGELOG, most recently on 21 October (8).); Robolly 5 (No changelog, release notes or dated API change was found. The sitemap marks every docs page as modified on 4 November 2026, which reads as a site rebuild rather than a change, so it isn't counted (0). No dated changes since 8 August (0). Support by email, with chat on higher plans; not tested (5 of 15). Not in the official MCP registry and no SDKs (0). No public package or repository (0). 0 + 0 + 5 + 0 + 0 = 5.)
- Schema & documentation, Canva REST APIs + MCP +38: Canva REST APIs + MCP 95 (OpenAPI 3.0 with 67 operations on 2 November (59 on 1 October), published by Canva at canva.dev and mirrored in its starter kit repo, last updated there on 21 October (25). llms.txt exists (www.canva.dev/llms.txt redirects to /docs/llms.txt), but robots.txt disallows /*/llms.txt, so we didn't read it (10). Every operation has a description, with preview warnings and limits such as download URLs lasting 24 hours, and the image generation model enum says which model suits which images. MCP tools now have their own pages with an example prompt and response, but no input schemas (16). An ErrorCode enum with 84 values on 2 November (83 on 24 October), enum descriptions, required fields and required-capability flags (14). Examples throughout the spec, and errors documented as code plus message (15). Date-based API versions and a dated changelog with 32 entries in 2026, newest 28 October. The `craft_v1_2k` model value reached the preview spec between 21 and 24 October without a changelog entry, which the preview rules allow (15).); Robolly 57 (No OpenAPI or other machine-readable contract found for the REST API, and the MCP server is closed. The MCP page lists all nine tools and `get_template_modifications` returns each template's keys, constraints and examples at run time (8 of 25, on that partial evidence). llms.txt indexes the docs (10). The MCP page says what each tool does, which tools change templates or spend credits, and that there is no delete tool (14 of 20). Modification keys follow `{element-name}.{modification-key}` with constraints from the template rather than a fixed schema (7 of 15). Request examples throughout and an error code table with eight codes (13 of 15). /v1 paths with no changelog (5 of 15). 8 + 10 + 14 + 7 + 13 + 5 = 57.)
- Transparency & trust, Canva REST APIs + MCP +34: Canva REST APIs + MCP 83 (Closed service under published terms (15). Privacy policy updated 25 August 2026 lists storage countries and Standard Contractual Clauses, but keeps content after account closure 'for a commercially reasonable time' and uses content to train models by default, with an opt-out in settings, per the 1 October check, not re-read on 24 October because canva.com's robots.txt disallows our fetcher (18). Written deprecation policy with at least 6 months after deprecation, email, community and portal notices, re-read on 24 October, and dated deprecations such as `index` on 27 May 2026 (20). Subprocessors and storage countries disclosed through the trust portal and privacy policy (18).); Robolly 49 (Closed service under terms effective 8 April 2026 from Avantis Innovations LLC in Wyoming. The terms can change without notice (15). The privacy policy of the same date covers Google sign-in and Sheets data, says spreadsheet rows aren't kept beyond a render and account data is deleted with the account, and otherwise names no periods (10 of 30). No deprecation policy or notices (0). Hosting is described only as third-party vendors, with no processors or locations named, while the footer says Made in EU (2 of 20). 15 + 10 + 0 + 2 = 27.)
- Reliability, Canva REST APIs + MCP +31: Canva REST APIs + MCP 79 (Atlassian Statuspage at canvastatus.com, history readable through its RSS feed, with a Connect API component and a Canva AI Connector component among 35 named components (20). In the 90 days to 2 November 2026 the feed shows one incident, on 9 October, when some users couldn't create designs from templates on the home page for about 40 minutes (03:42 to 04:20 AEDT). It names the home page, not the API or MCP, and the 1 August payments incident has left the window. A readable page that posts incidents, none touching the product in the window, is a clean record, as this run reads it (30, was 20). Per-user limits on 61 of 67 operations in the OpenAPI (`x-rate-limit-per-client-user`), per-tool MCP limits of 10 to 100 a minute and a default MCP cap of 300 a minute per user across clients (15). 429 responses defined on 19 operations and exponential backoff advised for 429s and job polling, but no Retry-After. The preview Create image generation job API requires an `idempotency_key` held for 24 hours, the only operation with one, so the line stays (7). No SLA found (0). Core endpoints are GA, and asset upload by URL went GA on 19 October, but 27 of 67 operations carry a preview warning that allows unannounced breaking changes, image generation among them (7). 20+30+15+7+0+7 = 79.); Robolly 48 (Hosted lines. The footer links an UptimeRobot status page, but it loads its figures from /api/, which stats.uptimerobot.com's robots.txt disallows, so the page showed no monitors or history (10 of 20 for a page that exists) and no history was read (5). A hard limit of 3 renders a second is published (15). The `rate-limit` error code and advice to send renders one at a time, and identical renders are cached for 45 days at no cost, which makes a retry safe; there's no Retry-After or backoff interval (8 of 15). No SLA found (0). The API isn't labelled beta (10). 10 + 5 + 15 + 8 + 0 + 10 = 48.)
- Agent ergonomics, Robolly +16: Canva REST APIs + MCP 59 (46 MCP tools on 24 October and 2 November (33 on 1 October) with no toolsets or dynamic loading (5), and REST lists take a limit (5). Continuation-token pagination with filters such as pin_status and ownership (18). Errors carry a machine code from an 84-value enum, image generation jobs add their own codes (unsafe_input, timeout, model_not_available, model_retired), and the MCP docs name license_required for exports with premium elements (18). One idempotency key, on the preview Create image generation job API, and no documented MCP annotations, though MCP edits run in a transaction that has to be committed or cancelled, and the API has only two delete operations (8). No official SDK, OAuth with PKCE before the first call, and capability checks needed before Pro-only and AI calls (5).); Robolly 75 (Nine MCP tools (25). The renders list pages with a cursor, and templates are found by name (14 of 20). Errors carry `errorCode` and `developerMessage` with eight documented codes (17 of 20). Identical renders are cached for 45 days, so repeats are free and safe, the MCP server has no delete tool, and annotations couldn't be read on the closed server (12 of 20). Renders return the file synchronously by default, but there's no SDK (7 of 15). 25 + 14 + 17 + 12 + 7 = 75.)
- Security & auth, Canva REST APIs + MCP +16: Canva REST APIs + MCP 63 (OAuth 2.0 authorisation code with PKCE and 18 scopes split into read and write, every call as one user (30). Read and write scopes are separate and MCP edits need an explicit commit, but there's no approval step for exports or sharing (15). Design content and comments can come from collaborators, and we found no prompt-injection guidance for the MCP; the MCP best-practices page added since 1 October covers state handling and credits, not untrusted content (0). No per-call audit log found (0). security.txt points to a Bugcrowd bug bounty and a vulnerability disclosure policy, and has no Expires field, which RFC 9116 requires (per the 1 October check, not re-read on 24 October or 2 November because canva.com's robots.txt disallows our fetcher). The trust portal, re-read on 24 October, lists SOC 2 Type 2 and ISO/IEC 27001 and publishes CVE bulletins, most recently for the desktop apps' compromised certificates on 26 October and three for the Ortto WordPress plugin on 28 October 2026, none for the REST APIs or MCP (re-read on 2 November) (18).); Robolly 47 (Bearer API key, signed render links, and MCP OAuth with one `robolly:mcp` scope limited to the organisation the user approves. Connections are listed and revoked under Connected AI Tools, and the API key is never shared with an OAuth client. No key scopes or rotation documented (22 of 30). The MCP server can create and update templates but not delete them; there's no read-only mode (10 of 20). Tools return the user's templates and public gallery designs (10 of 15). A renders list and the connected-tools view give some visibility, with no audit log documented (5 of 15). No security.txt (the path returns the site's HTML shell), disclosure policy, bug bounty or certification (0). 22 + 10 + 10 + 5 + 0 = 47.)