{
 "categories": [
  "education"
 ],
 "deployment": "saas",
 "evidence": [
  {
   "date": "2026-09-03",
   "fact": "homepage",
   "note": "Instructure presents Canvas as a commercial cloud LMS with SpeedGrader, Gradebook, Blueprint courses, Canvas Data, and first-party Student, Teacher, and Parent mobile apps.",
   "source": "https://www.instructure.com/canvas",
   "tier": "declared"
  },
  {
   "date": "2026-09-03",
   "fact": "platforms",
   "note": "The product page documents a web LMS and free Student, Teacher, and Parent mobile apps, including 27 million mobile app downloads.",
   "source": "https://www.instructure.com/canvas",
   "tier": "declared"
  },
  {
   "date": "2026-09-03",
   "fact": "license",
   "note": "Canvas is sold in commercial tiers. The page invites institutions to contact Instructure rather than offering a public self-serve production plan.",
   "source": "https://www.instructure.com/canvas",
   "tier": "declared"
  },
  {
   "date": "2026-09-03",
   "fact": "modalities.api.exists",
   "note": "Instructure documents a REST API for accessing and modifying Canvas data from external programs and scripts, plus an OpenAPI 3.0 spec generated from the same YARD source.",
   "source": "https://developerdocs.instructure.com/services/canvas",
   "tier": "declared"
  },
  {
   "date": "2026-09-03",
   "fact": "modalities.api.kinds[0]",
   "note": "All API access is HTTPS against the normal Canvas domain. Responses are JSON. POST and PUT accept form encoding or application/json.",
   "source": "https://developerdocs.instructure.com/services/canvas",
   "tier": "declared"
  },
  {
   "date": "2026-09-03",
   "fact": "modalities.api.kinds[1]",
   "note": "Canvas exposes GraphQL at POST /api/graphql. A token with the GraphQL scope may issue any query or mutation the authenticated user is otherwise permitted to perform.",
   "source": "https://developerdocs.instructure.com/services/canvas/resources/graph_ql",
   "tier": "declared"
  },
  {
   "date": "2026-09-03",
   "fact": "modalities.api.auth[0]",
   "note": "Canvas uses OAuth2 RFC-6749. Developer keys supply client ID and secret. The authorization-code grant returns an access token and refresh token. Callers should send Authorization Bearer. Tokens issued after October 2015 expire in one hour.",
   "source": "https://developerdocs.instructure.com/services/canvas/oauth2/file.oauth",
   "tier": "declared"
  },
  {
   "date": "2026-09-03",
   "fact": "modalities.api.coverage",
   "note": "The opened resource index lists accounts, courses, enrollments, assignments, submissions, quizzes, users, files, modules, pages, groups, SIS imports, developer keys, LTI registrations, content exports, and many other LMS objects.",
   "source": "https://developerdocs.instructure.com/services/canvas/resources",
   "tier": "declared"
  },
  {
   "date": "2026-09-03",
   "fact": "modalities.extensibility.scripting[0]",
   "note": "LTI Advantage tools are configured with Canvas developer keys. Tools complete the OpenID Connect launch and may call LTI Advantage services after a client_credentials grant.",
   "source": "https://developerdocs.instructure.com/services/canvas/external-tools/lti/file.lti_dev_key_config",
   "tier": "declared"
  },
  {
   "date": "2026-09-03",
   "fact": "modalities.extensibility.scripting[1]",
   "note": "Developer keys issued by an institution admin (or Site Admin on open-source installs) are the OAuth2 client credentials for third-party apps. Cloud keys are scoped to the issuing institution.",
   "source": "https://developerdocs.instructure.com/services/canvas/oauth2/file.oauth",
   "tier": "declared"
  },
  {
   "date": "2026-09-03",
   "fact": "modalities.extensibility.webhooks",
   "note": "Live Events emit Canvas actions to an AWS SQS queue or an HTTPS webhook. Instructure says they are suited to analytics and should not be used when the caller needs immediately up-to-date data.",
   "source": "https://developerdocs.instructure.com/services/canvas/data-services/live-events/overview/file.data_service_introduction",
   "tier": "declared"
  },
  {
   "date": "2026-09-03",
   "fact": "modalities.data_access.export",
   "note": "The Content Exports API starts jobs that produce common_cartridge, qti, or zip packages and returns a download URL when the export completes.",
   "source": "https://developerdocs.instructure.com/services/canvas/resources/content_exports",
   "tier": "declared"
  },
  {
   "date": "2026-09-03",
   "fact": "modalities.data_access.import",
   "note": "Canvas accepts UTF-8 SIS CSV files for users, courses, and enrollments, including batch and diffing modes through the Import SIS Data API.",
   "source": "https://developerdocs.instructure.com/services/canvas/sis/file.sis_csv",
   "tier": "declared"
  },
  {
   "date": "2026-09-03",
   "fact": "modalities.agent_docs.llms_txt",
   "note": "Opened the Instructure Developer Documentation Portal llms.txt. It indexes Canvas LMS basics, OAuth2, resources, LTI, Live Events, SIS, and related Instructure services.",
   "source": "https://developerdocs.instructure.com/llms.txt",
   "tier": "scraped"
  },
  {
   "date": "2026-09-03",
   "fact": "verdict.scores.api",
   "note": "The REST and GraphQL surfaces are broad, HTTPS JSON, OAuth2-authenticated, and generated from Canvas source with an OpenAPI option. Institutional developer-key gating, one-hour tokens, and Live Events' analytics-only guidance keep the score at 8 rather than 9.",
   "source": "https://developerdocs.instructure.com/services/canvas",
   "tier": "declared"
  },
  {
   "date": "2026-09-03",
   "fact": "freshness.watch[0].url",
   "note": "Opened and verified as the current Instructure Developer Documentation Portal Canvas LMS API overview after the 2026-07-01 docs move.",
   "source": "https://developerdocs.instructure.com/services/canvas",
   "tier": "declared"
  },
  {
   "date": "2026-09-03",
   "fact": "freshness.watch[1].url",
   "note": "Opened and verified as the current OAuth2 overview, including authorization-code and refresh flows and LTI client_credentials.",
   "source": "https://developerdocs.instructure.com/services/canvas/oauth2/file.oauth",
   "tier": "declared"
  },
  {
   "date": "2026-09-03",
   "fact": "freshness.watch[2].url",
   "note": "Opened the pre-move API page. It still documents HTTPS JSON and OAuth2 and states that docs relocated to the Instructure Developer Documentation Portal, with redirect after 2026-07-01.",
   "source": "https://canvas.instructure.com/doc/api/",
   "tier": "declared"
  },
  {
   "date": "2026-09-03",
   "fact": "freshness.watch[3].url",
   "note": "Opened and verified as the current Live Events introduction for HTTPS webhook and AWS SQS delivery.",
   "source": "https://developerdocs.instructure.com/services/canvas/data-services/live-events/overview/file.data_service_introduction",
   "tier": "declared"
  }
 ],
 "freshness": {
  "last_verified": "2026-09-03",
  "volatility": "medium",
  "watch": [
   {
    "type": "docs",
    "url": "https://developerdocs.instructure.com/services/canvas"
   },
   {
    "type": "docs",
    "url": "https://developerdocs.instructure.com/services/canvas/oauth2/file.oauth"
   },
   {
    "type": "docs",
    "url": "https://canvas.instructure.com/doc/api/"
   },
   {
    "type": "changelog",
    "url": "https://developerdocs.instructure.com/services/canvas/data-services/live-events/overview/file.data_service_introduction"
   }
  ]
 },
 "homepage": "https://www.instructure.com/canvas",
 "id": "canvas-lms",
 "license": "commercial",
 "modalities": {
  "agent_docs": {
   "llms_txt": true
  },
  "api": {
   "auth": [
    "oauth2"
   ],
   "coverage": "full",
   "docs": "https://developerdocs.instructure.com/services/canvas",
   "exists": true,
   "kinds": [
    "rest",
    "graphql"
   ]
  },
  "cli": {
   "exists": "unknown"
  },
  "computer_use": {
   "issues": [],
   "viability": "unknown"
  },
  "data_access": {
   "export": [
    "api-json",
    "common-cartridge",
    "qti",
    "zip"
   ],
   "import": [
    "sis-csv",
    "api-json"
   ]
  },
  "extensibility": {
   "scripting": [
    "lti-advantage",
    "developer-keys"
   ],
   "webhooks": true
  },
  "integrations": {
   "make": "unknown",
   "n8n": "unknown",
   "power_automate": "unknown",
   "zapier": "unknown"
  },
  "mcp": {
   "first_party": "unknown",
   "third_party": [],
   "verdict": "unknown"
  },
  "rpa": {
   "drivability": "unknown",
   "notes": "No repeatable UI probe was run. The Canvas REST and GraphQL APIs, OAuth2 developer keys, SIS CSV imports, content exports, LTI Advantage, and Live Events cover course and enrollment work without browser control. Pupil data are regulated; browser control is not a substitute for scoped institutional tokens.\n",
   "ui_stack": [
    "web-dom"
   ],
   "vendor_support": []
  },
  "sdk": {
   "exists": "unknown",
   "languages": [],
   "official": "unknown"
  }
 },
 "name": "Canvas LMS",
 "platforms": [
  "web",
  "ios",
  "android"
 ],
 "related": {
  "alternatives": [
   "itslearning",
   "ist-everyday",
   "sikt-fs"
  ],
  "our_products": []
 },
 "schema_version": 1,
 "score_version": 1,
 "status": "active",
 "vendor": "Instructure",
 "verdict": {
  "best_path": "api",
  "scores": {
   "api": 8,
   "cli": null,
   "computer_use": null,
   "integrations": null,
   "mcp": null,
   "overall": 8,
   "rpa": null
  },
  "summary": "Canvas LMS is automatable today through Instructure's REST API. Current docs live on the Instructure Developer Documentation Portal at developerdocs.instructure.com/services/canvas. The older canvas.instructure.com/doc/api/ page still serves the same contract and states that it redirects after 2026-07-01. All API access is HTTPS JSON against the institution's Canvas domain. Authentication is OAuth2 (RFC-6749): developer keys issue client ID and secret, the authorization code grant returns an access token and refresh token, and callers send Authorization Bearer. Tokens issued after October 2015 expire in one hour. Manual profile tokens are allowed only for the developer's own testing. GraphQL is at POST /api/graphql and can run any query or mutation the authenticated user may perform. The resource index includes accounts, courses, enrollments, assignments, submissions, quizzes, users, files, SIS imports, LTI registrations, and many other LMS objects. Institutions issue and enable developer keys; scoped keys restrict endpoints. Live Events deliver HTTPS webhooks or AWS SQS for analytics and are not the path for immediately consistent reads. SIS CSV imports load users, courses, and enrollments. Content export jobs produce Common Cartridge, QTI, or zip packages. LTI Advantage uses developer keys and a client_credentials JWT grant for Names and Roles and Assignment and Grade Services. Instructure publishes developerdocs.instructure.com/llms.txt. This record is Instructure Canvas LMS, not Canva. Nordic adoption was not assessed. Vendor documentation does not settle first-party MCP ownership. Third-party registry listings were not opened. No official general-purpose LMS SDK or CLI was established from the opened pages. Computer-use viability is unassessed. API scores 8 and is the best path.\n"
 }
}