Instructure Canvas vs Learnosity

Instructure Canvas 72

Read for a closed hosted service. Change log entries announced 27 October 2026 and scheduled through 9 November (30). Entries on 2, 23 and 28 September and 9 and 27 October 2026, with deploys every two weeks (20). A dated community change log, community forums and Instructure support; replies on the public repository could not be read (12 of 15). No official REST SDK; the DAP client library for data exports is current on PyPI per the change log (6 of 15). The public canvas-lms mirror's master feed ends 30 April 2026 and its last release tag is release/2026-05-20, so package health and CI can't be read, though the hosted service keeps shipping (4 of 10). 30 + 20 + 12 + 6 + 4 = 72.

Learnosity 85

Read for a closed service. Developer release log dated 28 October 2026 and v2026.2.LTS on 10 June 2026 (30). Developer builds about every two weeks with dated logs in September and October (20). Release logs per API, support tickets, the Build Aide feedback widget, and SDK repositories with pull requests merged through 16 October 2026 (12 of 15). Current SDKs for Python (v0.3.13, 14 January 2026, commits to 16 October), Node.js (v0.7.3, 2 October 2026) and PHP (v1.2.1), under Apache-2.0 (15). GitHub Actions CI on the Python and Node.js SDKs; the Node SDK removed express from its dependencies in v0.7.3 (8 of 10). 30 + 20 + 12 + 15 + 8 = 85.

Instructure Canvas 63

Read with the hosted lines on the hosted Canvas API. Statuspage at status.instructure.com with components and history (20). From 24 August to 30 October 2026 the feed lists 25 entries, most of them slow pages or errors for some users lasting under an hour, and four of an hour or more, MFA SMS delivery (2 hours 12 minutes, 24 August), a Portland-region heavy-load outage (5 hours 17 minutes, 31 August), a login failure for some users (1 hour 46 minutes, 15 October) and Canvas Data 2 errors (1 hour 48 minutes, 21 October). Each affected a region or a subset rather than the API for everyone, read as one major outage with many minor ones (10). Throttling is documented as a cost-based quota with headers but no bucket size or refill rate (8 of 15). A 429 is documented with "retry later", no Retry-After or backoff numbers and no idempotency keys for writes (7 of 15). The trust centre states 99.9 per cent annual uptime; contract SLAs sit behind the customer portal (8 of 10). The REST API is generally available (10). 20 + 10 + 8 + 7 + 8 + 10 = 63.

Learnosity 75

Read with the hosted lines on the Data API. Statuspage at status.learnosity.com with component history (20). From 1 August to 3 November 2026 the feed lists six entries, Enhanced Math scoring delays in US-East-1 on 11 September, 2 October and 20 October (the last touching the Data API scoring endpoint for about 4 hours 40 minutes), an LTS remapping issue on 8 October, a demos-site maintenance on 21 to 22 October and Item Pools degraded in all regions for about 2 hours 20 minutes on 26 October, so one incident of an hour or more on a core endpoint and the rest regional or partial (10). Rate limits published per endpoint in 5-second windows (15). A 429 with meta.code 42000 and a stated 5-second wait, but no Retry-After header and no idempotency keys for SET and UPDATE (10 of 15). SLA uptime of 99.8 or 99.9 per cent by support tier on the licences page (10). The APIs are generally available, with LTS versions (10). 20 + 10 + 15 + 10 + 10 + 10 = 75.

Instructure Canvas 82

Canvas LMS source under AGPL-3.0 with clear terms of use and an API policy for the hosted service (28 of 30). Privacy notice effective 10 July 2026 with a 30-day deletion commitment, an AI privacy notice (27 October 2025) saying student data does not train Instructure's models and naming Anthropic, Meta and Cohere models, but no retention periods and no subprocessor list (15 of 30). A written 90-day deprecation notice in the API policy, applied in a dated change log (20). Hosting in the United States stated for Canvas Lite and offices named, model providers named for the AI tools, no subprocessor list or regions for the main service (8 of 20). 28 + 15 + 20 + 8 = 71.

Learnosity 71

Closed service; the website terms name Learnosity Limited and cover the website only, platform terms are in customer contracts, and the SDKs are Apache-2.0 (12 of 30). Privacy policy last updated 26 May 2026, a least-data principle on the product security policy, a DPA and data-protection protocols behind robots.txt disallows, and no retention periods (15 of 30). LTS lifecycle with dated deprecation, end-of-life and sunset for every version (20). AWS hosting in the US, EU and Australia with the customer choosing the region; the subprocessor list is disallowed to crawlers (8 of 20). 12 + 15 + 20 + 8 = 55.

Instructure Canvas 77

An OpenAPI 3.0 file is generated from the source with rake doc:openapi, and the reference is generated the same way, but no hosted copy of the file was found, so an agent has to build it from a repository whose public mirror ended in May 2026 (15 of 25). llms.txt on developerdocs.instructure.com indexes the Canvas resources and basics (10). Each resource page states what the endpoint does and its parameters, with little when-not-to-use guidance (16 of 20). Parameters are typed with allowed values and required flags in the resource pages (12 of 15). Request examples per endpoint, but no central error page, and the throttling page itself gives the status as "429 Forbidden (Rate Limit Exceeded)" (9 of 15). A change log dated by announcement and a written 90-day deprecation policy (15). 15 + 10 + 16 + 12 + 9 + 15 = 77.

Learnosity 67

No public OpenAPI or similar document was found for the Data API; the reference is help-centre articles, and only the Build Aide MCP server has typed tool inputs, over documentation rather than data (8 of 25). No llms.txt, but the hosted MCP server serves the documentation to agents with source citations (8 of 10). Endpoint articles state what each category is for and when to use the Data API instead of the pre-built APIs (15 of 20). Parameters are typed per endpoint in the articles, read only in part through the JSON API, so partial credit (9 of 15). Troubleshooting articles per HTTP code with the error body, and SDK examples in five languages (12 of 15). Dated LTS versions, release logs per API and developer release logs every two weeks (15). 8 + 8 + 15 + 9 + 12 + 15 = 67.

Instructure Canvas 0

Read with the hosted rubric. No x402, MPP or L402 (0). No price published; Canvas is sold by contract, and the tiers page compares access levels without prices (0). The only free account, Canvas Lite, excludes API token access per its terms of 30 September 2026, so there is no free tier for the API (0). A developer key or OAuth grant needs an institution's administrator (0). 0 + 0 + 0 + 0 = 0.

Learnosity 10

No x402, MPP or L402 (0). No price published; tiers and support levels are described and a quote comes from sales (0). No free tier or trial for the platform; the demos site runs on a public demos consumer key and the MCP server is free, which is documentation rather than the product (5 of 20). A contract and credentials from Learnosity are needed; only the documentation MCP server is reachable without a person (5 of 20). 0 + 0 + 5 + 5 = 10.

Instructure Canvas 61

OAuth2 with developer keys scoped to url:<verb>|<path> endpoints, 1-hour tokens, refresh tokens, revocation on logout and replace_tokens, but access_token as a query parameter is a documented if discouraged option, so 30 less 10 (20 of 30). Scoped keys can be limited to GET endpoints and administrators grant and revoke scopes; masquerading needs a separate permission; no confirmation step for destructive calls (14 of 20). The API returns student submissions, discussion posts and messages with no guidance on treating them as untrusted (5 of 15). Administrators control keys and tokens, and Canvas keeps authentication and course audit logs, but per-call API visibility for a key was not confirmed (6 of 15). security.txt valid to 1 January 2027, a Bugcrowd disclosure form, a bounty programme joined on request, SOC and other reports behind the customer trust portal (16 of 20). 20 + 14 + 5 + 6 + 16 = 61.

Learnosity 54

A consumer key and secret per consumer, with every request signed server-side and the secret never sent; rotation and revocation are not described on public pages (22 of 30). Access is scoped per consumer and the MCP server is read-only, but no read-only Data API credential or confirmation for session deletion was found (8 of 20). The Data API returns learner responses, which are untrusted text, with no guidance (5 of 15). No per-call audit log for the operator found on public pages (3 of 15). ISO 27001 certificate, CSA STAR, a public HECVAT, EU-US DPF and a FedRAMP Moderate authorisation stated by the CTO, security@learnosity.com and a good-faith research authorisation; no security.txt or paid bounty (16 of 20). 22 + 8 + 5 + 3 + 16 = 54.