# Instructure Canvas (slim)

> Canvas is Instructure's learning management system for schools and universities. Its REST and GraphQL APIs read and change courses, assignments, quizzes, submissions and grades on an institution's Canvas domain, with OAuth2 developer keys its administrators issue and scope.

- Full: https://www.anchorterminal.com/tools/canvas-lms.md (~8,150 tokens) · this version ~1,680 tokens · JSON https://www.anchorterminal.com/tools/canvas-lms.json · canonical https://www.anchorterminal.com/tools/canvas-lms
- Index: https://www.anchorterminal.com/llms.txt · API: https://www.anchorterminal.com/api/v1/index.json · MCP: https://www.anchorterminal.com/mcp · Updated: 2026-11-04 · pricing https://www.anchorterminal.com/tools/canvas-lms#pricing · reviews https://www.anchorterminal.com/tools/canvas-lms#reviews
- Licence: CC BY 4.0, credit Anchor Terminal and link this page (https://www.anchorterminal.com/terms/#data)

**C · 59.5/100 · rank #622 of 1349 · #3 in Learning, tutoring & assessment · not agent-ready · confidence medium**


Assessment: A wide REST and GraphQL API over an institution's courses, assignments, quizzes, submissions and grades, with scoped OAuth2 developer keys, Link-header paging, a 90-day deprecation policy and a dated change log. Access depends on an institution's administrator issuing a key, there is no public price or sandbox, and the API policy bars unapproved MCP connections.

## Facts

- Kind: HTTP API · vendor: Instructure · category: Learning, tutoring & assessment · legal entity: Instructure, Inc. · provenance 93/100
- Endpoint: `https://<institution>.instructure.com/api/v1` (HTTP)
- Auth: OAuth · pricing: Paid · x402: no · licence: AGPL-3.0 (Canvas LMS source); hosted service proprietary
- Probe metrics: not measured yet (probes haven't run)
- Surface listed: The Canvas REST API (api/v1) and GraphQL API on an institution's Canvas domain, read from developerdocs.instructure.com, the API policy, the OAuth2 and developer key guides, the status feed, the community change log, instructure.com's legal and trust pages, the canvas-lms repository feeds and the SEC filing on 3 November 2026. No key was issued and no call was made
- Base URL: https://<institution>.instructure.com/api/v1 (self-hosted installs use their own domain); GraphQL at /api/graphql
- Access: A developer key from the root account administrator (scoped or unscoped), or a global key from Instructure that the administrator enables; manual access tokens from a user's profile are for testing only
- Rate limit: Cost-based quota per access token that refills over time, X-Request-Cost on every response, X-Rate-Limit-Remaining when throttled, 429 Rate Limit Exceeded; no bucket size published
- Deprecation: 90 days' notice for removing endpoints or documented fields; undocumented fields, beta functionality and security fixes may change without notice
- MCP: No official MCP server found. Instructure's IgniteAI Agent is its own in-product agent, and the API policy prohibits connecting through MCP servers Instructure has not approved. Third-party Canvas MCP servers exist in the official registry under individual namespaces
- Free account: Canvas Lite for individual educators, 500MB, five published courses, 50 students a course, no API token access per its terms of 30 September 2026
- Security: security.txt at instructure.com valid to 1 January 2027, Bugcrowd disclosure form and security@instructure.com, 99.9 per cent annual uptime stated on the trust centre, certifications behind the customer trust portal
- Company: Instructure, Inc., Salt Lake City, founded 2008, Canvas launched 2011; acquired by KKR and Dragoneer on 13 November 2024

- Scores: Reliability 63, Performance pending, Schema & documentation 77, Agent ergonomics 63, Security & auth 61, Payments & pricing 0, Task success pending, Maintenance & community 72, Transparency & trust 82 · total over the 7 assessed categories
- Why: Reliability, Read with the hosted lines on the hosted Canvas API. · Schema & documentation, An OpenAPI 3.0 file is generated from the source with `rake doc:openapi`, and the reference is generated the same way, but no hosted copy of… · Agent ergonomics, include[] parameters and per_page size REST responses, and GraphQL selects fields (22 of 25). · Security & auth, OAuth2 with developer keys scoped to `url:<verb>|<path>` endpoints, 1-hour tokens, refresh tokens, revocation on logout and replace_tokens… · Payments & pricing, Read with the hosted rubric. · Maintenance & community, Read for a closed hosted service. · Transparency & trust, Canvas LMS source under AGPL-3.0 with clear terms of use and an API policy for the hosted service (28 of 30).
- Sources: 25, open questions: 8, both in the full twin
- Capabilities: learning.lms, learning.courses, learning.quiz, learning.progress
- JSON: https://www.anchorterminal.com/api/v1/tools/canvas-lms.json
- Verify (for the vendor): the badge `https://www.anchorterminal.com/badges/canvas-lms.svg` or a link to https://www.anchorterminal.com/tools/canvas-lms from a page on instructure.com or one of its subdomains, or the README at the root of github.com/instructure/canvas-lms, then `POST https://www.anchorterminal.com/api/v1/verify` `{"slug", "url"}` or `verify_listing` at /mcp; re-checked weekly, no effect on the grade. Snippets in the full twin.
- Support: security@instructure.com; privacy@instructure.com; https://community.instructure.com/; https://status.instructure.com/; more in the full twin

## Before you call it

1. Ask the institution's Canvas administrator for a scoped developer key, or run the OAuth2 flow on the institution's own domain; never ask users to paste manual access tokens
2. Send the token only in the Authorization header, follow the opaque Link headers for paging and set per_page rather than guessing page counts
3. Watch X-Request-Cost and X-Rate-Limit-Remaining, keep to one request at a time, and on 429 wait before retrying
4. Check the API policy before wiring Canvas into an MCP server; it prohibits connections through MCP servers Instructure has not approved
5. Use the GraphQL endpoint at /api/graphql when you need a few fields from many objects, since REST responses have no field selection

## Connect

```bash
curl -H "Authorization: Bearer <ACCESS_TOKEN>" "https://<institution>.instructure.com/api/v1/courses?per_page=50"
```
Full config and headless snippets are in the full page. Through letme (picks today, calling later): https://letme.dev/canvas-lms

## Similar tools

| Tool | Grade | Score | Shared capabilities | Slim |
| --- | --- | --- | --- | --- |
| Moodle | B | 67.7 | learning.lms, learning.courses, learning.quiz, learning.progress | https://www.anchorterminal.com/tools/moodle.min.md |
| Learnosity | C | 60.2 | learning.quiz, learning.progress, learning.courses | https://www.anchorterminal.com/tools/learnosity.min.md |
| Kahoot! | C | 55.2 | learning.quiz, learning.progress, learning.lms | https://www.anchorterminal.com/tools/kahoot.min.md |
| Quizgecko | F | 33 | learning.quiz, learning.courses | https://www.anchorterminal.com/tools/quizgecko.min.md |
| Preply | C | 57.4 | same category | https://www.anchorterminal.com/tools/preply.min.md |


## Panel reviews (0, desk reviews from public material, no calls made)