Instructure Canvas vs Kahoot!

Instructure Canvas 63

Read with the hosted lines on the hosted Canvas API. Statuspage at status.instructure.com with components and history (20). From 24 August to 30 October 2026 the feed lists 25 entries, most of them slow pages or errors for some users lasting under an hour, and four of an hour or more, MFA SMS delivery (2 hours 12 minutes, 24 August), a Portland-region heavy-load outage (5 hours 17 minutes, 31 August), a login failure for some users (1 hour 46 minutes, 15 October) and Canvas Data 2 errors (1 hour 48 minutes, 21 October). Each affected a region or a subset rather than the API for everyone, read as one major outage with many minor ones (10). Throttling is documented as a cost-based quota with headers but no bucket size or refill rate (8 of 15). A 429 is documented with "retry later", no Retry-After or backoff numbers and no idempotency keys for writes (7 of 15). The trust centre states 99.9 per cent annual uptime; contract SLAs sit behind the customer portal (8 of 10). The REST API is generally available (10). 20 + 10 + 8 + 7 + 8 + 10 = 63.

Kahoot! 45

Read with the hosted lines. status.kahoot.com is an Atlassian Statuspage with component history (20). One incident since 5 August 2026, YouTube video disruptions on 22 September, minor, about six hours (20). No rate limits in the OpenAPI file, and the support guide that might hold them answered our reader with a Cloudflare check (0). No 429 or retry guidance (0). No SLA found; the Master Service Agreement on the trust centre wasn't read (0). The spec is version 0.1.0 with no stability statement, though the enterprise page sells the API as a feature (5 of 10). 20 + 20 + 0 + 0 + 0 + 5 = 45.

Instructure Canvas 77

An OpenAPI 3.0 file is generated from the source with rake doc:openapi, and the reference is generated the same way, but no hosted copy of the file was found, so an agent has to build it from a repository whose public mirror ended in May 2026 (15 of 25). llms.txt on developerdocs.instructure.com indexes the Canvas resources and basics (10). Each resource page states what the endpoint does and its parameters, with little when-not-to-use guidance (16 of 20). Parameters are typed with allowed values and required flags in the resource pages (12 of 15). Request examples per endpoint, but no central error page, and the throttling page itself gives the status as "429 Forbidden (Rate Limit Exceeded)" (9 of 15). A change log dated by announcement and a written 90-day deprecation policy (15). 15 + 10 + 16 + 12 + 9 + 15 = 77.

Kahoot! 62

Public OpenAPI 3.1.0 at results.kahoot.com/openapi (25). No llms.txt on kahoot.com, 404 on 3 November 2026 (0). Every operation has a one-line description and the schemas describe each answer type, but nothing says when to use an endpoint or what the data window is (12 of 20). Path ids are typed as UUID, limit has a 1 to 100 range and default, 12 enums such as game mode and answer status, and a discriminator on answer type (12 of 15). Twelve example values in the schemas, but responses list only 200, 401 and 403 with no error body (8 of 15). A /v1 prefix and an ApiVersion schema, with no public changelog for the API (5 of 15). 25 + 0 + 12 + 12 + 8 + 5 = 62.

Instructure Canvas 0

Read with the hosted rubric. No x402, MPP or L402 (0). No price published; Canvas is sold by contract, and the tiers page compares access levels without prices (0). The only free account, Canvas Lite, excludes API token access per its terms of 30 September 2026, so there is no free tier for the API (0). A developer key or OAuth grant needs an institution's administrator (0). 0 + 0 + 0 + 0 = 0.

Kahoot! 15

Read with the hosted rule. No x402, MPP or L402 (0). Pro plans are public, $9 to $79 a presenter a month billed annually, but the API is enterprise-only and priced by quote (10). A free account needs no card and Pro has a seven-day trial, but neither reaches the API (5 of 20). Credentials come from Kahoot! to an enterprise organisation, so a person signs the contract and requests them (0). 0 + 10 + 5 + 0 = 15.

Instructure Canvas 72

Read for a closed hosted service. Change log entries announced 27 October 2026 and scheduled through 9 November (30). Entries on 2, 23 and 28 September and 9 and 27 October 2026, with deploys every two weeks (20). A dated community change log, community forums and Instructure support; replies on the public repository could not be read (12 of 15). No official REST SDK; the DAP client library for data exports is current on PyPI per the change log (6 of 15). The public canvas-lms mirror's master feed ends 30 April 2026 and its last release tag is release/2026-05-20, so package health and CI can't be read, though the hosted service keeps shipping (4 of 10). 30 + 20 + 12 + 6 + 4 = 72.

Kahoot! 58

Read for a closed service. iOS 6.8.0 on 27 October 2026 (30). Three App Store releases in the 90 days, 12, 22 and 27 October (20). A status page, a help centre and sales contact, but no public changelog for the API and the help centre is behind a bot check for us (8 of 15). No SDK or registry entry (0). No package to judge (0). 30 + 20 + 8 + 0 + 0 = 58.

Instructure Canvas 82

Canvas LMS source under AGPL-3.0 with clear terms of use and an API policy for the hosted service (28 of 30). Privacy notice effective 10 July 2026 with a 30-day deletion commitment, an AI privacy notice (27 October 2025) saying student data does not train Instructure's models and naming Anthropic, Meta and Cohere models, but no retention periods and no subprocessor list (15 of 30). A written 90-day deprecation notice in the API policy, applied in a dated change log (20). Hosting in the United States stated for Canvas Lite and offices named, model providers named for the AI tools, no subprocessor list or regions for the main service (8 of 20). 28 + 15 + 20 + 8 = 71.

Kahoot! 73

Closed service with clear terms naming Kahoot! AS, Norwegian law and an Acceptable Use Policy dated 22 October 2026 (15 of 30). Privacy notice effective 22 October 2026 with a DPA and a subprocessor list dated 3 March 2025; retention is stated as the relationship plus limitation periods, with 24 months for candidates and six months for backups, and AI vendors may not train on platform data (24 of 30). No deprecation policy or notice period found (0 of 20). Fourteen subprocessors named with countries, AWS, Google Cloud, Aiven, OVH and Hetzner among them, and US or EU hosting on enterprise (18 of 20). 15 + 24 + 0 + 18 = 57.

Instructure Canvas 61

OAuth2 with developer keys scoped to url:<verb>|<path> endpoints, 1-hour tokens, refresh tokens, revocation on logout and replace_tokens, but access_token as a query parameter is a documented if discouraged option, so 30 less 10 (20 of 30). Scoped keys can be limited to GET endpoints and administrators grant and revoke scopes; masquerading needs a separate permission; no confirmation step for destructive calls (14 of 20). The API returns student submissions, discussion posts and messages with no guidance on treating them as untrusted (5 of 15). Administrators control keys and tokens, and Canvas keeps authentication and course audit logs, but per-call API visibility for a key was not confirmed (6 of 15). security.txt valid to 1 January 2027, a Bugcrowd disclosure form, a bounty programme joined on request, SOC and other reports behind the customer trust portal (16 of 20). 20 + 14 + 5 + 6 + 16 = 61.

Kahoot! 69

OAuth 2.0 client credentials with an opaque bearer token from a Keycloak realm; the client id and secret are issued by Kahoot! and the spec defines no scopes (24 of 30). The API is read-only by design and reaches one organisation's data (16 of 20). Open-ended, word-cloud and brainstorming answers are participant-written text with no guidance on handling it (5 of 15). Enterprise admins get user management and reports, but no per-call API log is documented (4 of 15). security.txt with Expires 2027-10-02, a published disclosure policy without rewards, ISO 27001 certification and SOC 2 Type 2 stated (20). 24 + 16 + 5 + 4 + 20 = 69.