# Instructure Canvas vs Moodle (slim)

> Moodle scores 67.7 (B) to Instructure Canvas's 59.5 (C) for learning lms. Prices, MCP, x402, uptime and agent notes side by side.

- Full: https://www.anchorterminal.com/compare/canvas-lms-vs-moodle.md (~4,550 tokens) · this version ~3,030 tokens · JSON https://www.anchorterminal.com/compare/canvas-lms-vs-moodle.json · canonical https://www.anchorterminal.com/compare/canvas-lms-vs-moodle
- Index: https://www.anchorterminal.com/llms.txt · API: https://www.anchorterminal.com/api/v1/index.json · MCP: https://www.anchorterminal.com/mcp · Updated: 2026-11-03
- Licence: CC BY 4.0, credit Anchor Terminal and link this page (https://www.anchorterminal.com/terms/#data)

Moodle scores 67.7 (B) on agent readiness against Instructure Canvas's 59.5 (C), and leads in 4 of 7 scored categories. Instructure Canvas leads on schema & documentation, agent ergonomics and transparency & trust. Both do learning lms.

- Instructure Canvas: C 59.5, rank #622 of 1349 · https://www.anchorterminal.com/tools/canvas-lms.min.md
- Moodle: B 67.7, rank #280 of 1349 · https://www.anchorterminal.com/tools/moodle.min.md
- Instructure Canvas, good for An agent acting for a teacher, student or administrator inside an institution that has issued a key, reading assignments and grades or creating course content. Ahead on Schema & documentation, 77 against 66; Agent ergonomics, 63 against 49; Transparency & trust, 82 against 76.
- Moodle, good for An agent working inside an institution or company that runs Moodle and can get a scoped token, reading course content, quiz attempts, assignments and grades or writing grades and enrolments. Ahead on Reliability, 80 against 63; Security & auth, 67 against 61; Payments & pricing, 60 against 0; Maintenance & community, 81 against 72.

| Category | Instructure Canvas | Moodle |
| --- | --- | --- |
| Reliability (16%) | 63 | 80 |
| Performance (10%) | pending | pending |
| Schema & documentation (13%) | 77 | 66 |
| Agent ergonomics (13%) | 63 | 49 |
| Security & auth (14%) | 61 | 67 |
| Payments & pricing (10%) | 0 | 60 |
| Task success (10%) | pending | pending |
| Maintenance & community (7%) | 72 | 81 |
| Transparency & trust (7%) | 82 | 76 |

| Fact (where they differ) | Instructure Canvas | Moodle |
| --- | --- | --- |
| Vendor | Instructure | Moodle Pty Ltd |
| Hosted endpoint | `https://<institution>.instructure.com/api/v1` | `https://<site>/webservice/rest/server.php` |
| Auth | OAuth | OAuth or key |
| Pricing | Paid | Free |
| Licence | AGPL-3.0 (Canvas LMS source); hosted service proprietary | GPL-3.0-or-later |
| llms.txt | yes | no |
| Last release | 2026-10-27 | 2026-10-05 |
| Terms last updated | no date given | no document linked |
| Privacy policy last updated | no date given | 2025-10-01 |
| Customer content may train models | not found in the text | not read yet |
| Terms restrict automated access | yes | not read yet |
| Terms restrict benchmarking | not found in the text | not read yet |
| Terms or service can change without notice | not found in the text | not read yet |
| Arbitration or class-action waiver | not found in the text | not read yet |

Why the edge:
- Payments & pricing, Moodle +60: Instructure Canvas 0 (Read with the hosted rubric. No x402, MPP or L402 (0). No price published; Canvas is sold by contract, and the tiers page compares access levels without prices (0). The only free account, Canvas Lite, excludes API token access per its terms of 30 September 2026, so there is no free tier for the API (0). A developer key or OAuth grant needs an institution's administrator (0). 0 + 0 + 0 + 0 = 0.); Moodle 60 (Read with the self-hosted rule for free software with nothing to buy. No payment protocol (0 of 40). The licence is public and MoodleCloud's plan prices are public too (20). Free to download and run, with a 28-day MoodleCloud trial that needs no card (20). An owner installs it and issues their own tokens, so no vendor sign-up stands in the way (20). 0 + 20 + 20 + 20 = 60.)
- Reliability, Moodle +17: Instructure Canvas 63 (Read with the hosted lines on the hosted Canvas API. Statuspage at status.instructure.com with components and history (20). From 24 August to 30 October 2026 the feed lists 25 entries, most of them slow pages or errors for some users lasting under an hour, and four of an hour or more, MFA SMS delivery (2 hours 12 minutes, 24 August), a Portland-region heavy-load outage (5 hours 17 minutes, 31 August), a login failure for some users (1 hour 46 minutes, 15 October) and Canvas Data 2 errors (1 hour 48 minutes, 21 October). Each affected a region or a subset rather than the API for everyone, read as one major outage with many minor ones (10). Throttling is documented as a cost-based quota with headers but no bucket size or refill rate (8 of 15). A 429 is documented with "retry later", no Retry-After or backoff numbers and no idempotency keys for writes (7 of 15). The trust centre states 99.9 per cent annual uptime; contract SLAs sit behind the customer portal (8 of 10). The REST API is generally available (10). 20 + 10 + 8 + 7 + 8 + 10 = 63.); Moodle 80 (Read with the local-software lines, since the owner runs Moodle and calls their own site. Official packages from moodle.org and GitHub with supported PHP and database versions stated per release, PostgreSQL 17 and MariaDB 11.4 and up for 5.3 (20). A public test suite (PHPUnit and Behat) and CI; whether the default branch was passing on 3 November was not read, since the repository's workflow pages weren't fetched (12 of 25). Bugs go to the Moodle Tracker, where security issues are triaged into dated advisories and point releases every two months carry fixes; the open bug count was not read (18 of 25). Versioned releases with release notes, upgrade notes and a written deprecation policy (15). Stable since 1.0 in 2002, now 5.3 (15). 20 + 12 + 18 + 15 + 15 = 80.)
- Agent ergonomics, Instructure Canvas +14: Instructure Canvas 63 (include[] parameters and per_page size REST responses, and GraphQL selects fields (22 of 25). Link-header paging on every list, with filters such as enrollment_type and state on courses (20). Error bodies are a JSON errors array, documented per endpoint rather than centrally, and 401 with WWW-Authenticate for expired tokens is explained (10 of 20). No idempotency keys; reads are safe to repeat and writes are not addressed (5 of 20). Few required parameters per call, but no official REST SDK (community libraries only) and the official client is the DAP CLI for data exports (6 of 15). 22 + 20 + 10 + 5 + 6 = 63.); Moodle 49 (About 800 to 900 functions, but a service can expose only the functions an agent needs and each call names one function, so the working set is small (20 of 25). Paging and filtering vary by function; course and user lookups take criteria and some take limits, read only in the catalogue (10 of 20). The REST protocol returns an exception, errorcode and message object on failure, and the 5.3 API returns OAuth2 access_denied with a hint naming the missing scope; the classic shape was not read first-hand on this pass (8 of 20). No idempotency keys; many functions are creates and updates (5 of 20). Required parameters vary by function; no official SDK, only sample clients and community libraries (6 of 15). 20 + 10 + 8 + 5 + 6 = 49.)
- Schema & documentation, Instructure Canvas +11: Instructure Canvas 77 (An OpenAPI 3.0 file is generated from the source with `rake doc:openapi`, and the reference is generated the same way, but no hosted copy of the file was found, so an agent has to build it from a repository whose public mirror ended in May 2026 (15 of 25). llms.txt on developerdocs.instructure.com indexes the Canvas resources and basics (10). Each resource page states what the endpoint does and its parameters, with little when-not-to-use guidance (16 of 20). Parameters are typed with allowed values and required flags in the resource pages (12 of 15). Request examples per endpoint, but no central error page, and the throttling page itself gives the status as "429 Forbidden (Rate Limit Exceeded)" (9 of 15). A change log dated by announcement and a written 90-day deprecation policy (15). 15 + 10 + 16 + 12 + 9 + 15 = 77.); Moodle 66 (Function definitions are machine-readable inside a site (the generated API Documentation page for classic functions, SwaggerUI for the 5.3 REST API), but no OpenAPI or similar file is published without a site (15 of 25). No llms.txt on moodledev.io or docs.moodle.org (0). Each function and parameter carries a description, and the developer docs explain when to write a service and how to validate context (14 of 20). PARAM_* types, required, optional and default flags, nested structures, and scope declarations on 5.3 routes (13 of 15). curl samples and sample clients in several languages, but the error response shape was not documented on the pages read (9 of 15). Release notes per version, an "introduced in" column in the function list and a written deprecation policy (15). 15 + 0 + 14 + 13 + 9 + 15 = 66.)
- Maintenance & community, Moodle +9: Instructure Canvas 72 (Read for a closed hosted service. Change log entries announced 27 October 2026 and scheduled through 9 November (30). Entries on 2, 23 and 28 September and 9 and 27 October 2026, with deploys every two weeks (20). A dated community change log, community forums and Instructure support; replies on the public repository could not be read (12 of 15). No official REST SDK; the DAP client library for data exports is current on PyPI per the change log (6 of 15). The public canvas-lms mirror's master feed ends 30 April 2026 and its last release tag is release/2026-05-20, so package health and CI can't be read, though the hosted service keeps shipping (4 of 10). 30 + 20 + 12 + 6 + 4 = 72.); Moodle 81 (Moodle 5.3.0 on 5 October 2026 and commits on main through 30 October (30). Point releases on 10 August, 14 September and 5 October 2026 across five branches (20). The Tracker, forums on moodle.org and developer chat answer issues; security issues were fixed and published with CVEs on 9 September, 22 September and 15 October 2026 (20 of 25). No official SDK or MCP server; sample clients only (5 of 15). PHPUnit and Behat suites, GitHub Actions, and minimum PHP and database versions raised per release, read from the release notes rather than a passing run (6 of 10). 30 + 20 + 20 + 5 + 6 = 81.)
- Security & auth, Moodle +6: Instructure Canvas 61 (OAuth2 with developer keys scoped to `url:<verb>|<path>` endpoints, 1-hour tokens, refresh tokens, revocation on logout and replace_tokens, but `access_token` as a query parameter is a documented if discouraged option, so 30 less 10 (20 of 30). Scoped keys can be limited to GET endpoints and administrators grant and revoke scopes; masquerading needs a separate permission; no confirmation step for destructive calls (14 of 20). The API returns student submissions, discussion posts and messages with no guidance on treating them as untrusted (5 of 15). Administrators control keys and tokens, and Canvas keeps authentication and course audit logs, but per-call API visibility for a key was not confirmed (6 of 15). security.txt valid to 1 January 2027, a Bugcrowd disclosure form, a bounty programme joined on request, SOC and other reports behind the customer trust portal (16 of 20). 20 + 14 + 5 + 6 + 16 = 61.); Moodle 67 (Two credential models. The classic token is one secret per user and service with no scopes, documented in the `wstoken` query parameter, and the 5.3 personal access tokens and OAuth 2 clients carry scopes, expiry from 7 days to 1 year, one-time display and revocation; read as scoped tokens on part of the surface less 10 for the query-string option (18 of 30). Services limited to chosen functions and authorised users, capability checks in every function, IP restriction and valid-until on tokens; no confirmation step for destructive functions (16 of 20). Functions return forum posts, submissions and messages written by users, with no guidance on treating them as untrusted (5 of 15). Moodle logs web service calls in the site logs and 5.3 shows each personal access token's last use and IP; per-call detail wasn't read (10 of 15). security.txt valid to 10 May 2027, a Bugcrowd-linked report form, responsible disclosure with CVEs, advisories released on a schedule across supported branches, no paid bounty (18 of 20). 18 + 16 + 5 + 10 + 18 = 67.)