generated: '2026-06-20'
method: derived
source: >-
  Derived from openapi/canvas-lms-rest-api-openapi.yml, the AsyncAPI, apis.yml
  tags/properties, and Canvas developer docs. Cross-cutting standards Canvas
  conforms to are asserted with the evidence used to decide each.
standards:
- id: oauth2
  conforms: true
  evidence: OpenAPI securitySchemes declares type oauth2, authorizationCode flow (login/oauth2/auth, login/oauth2/token)
- id: oidc
  conforms: false
  evidence: No /.well-known/openid-configuration published (404 on www, 503 on canvas host); Canvas OAuth2 is RFC 6749 only, not OIDC discovery
- id: rfc6749-oauth2
  conforms: true
  evidence: Canvas OAuth2 Overview documents the RFC 6749 authorization code grant
- id: rfc5988-web-linking
  conforms: true
  evidence: Pagination uses RFC 5988 Link response headers (rel next/prev/first/last)
- id: rfc9457-problem-details
  conforms: false
  evidence: Canvas returns a custom {"errors":[{"message":...}]} envelope, not application/problem+json
- id: lti-1.3
  conforms: true
  evidence: Full IMS/1EdTech LTI 1.3 / LTI Advantage implementation (Deep Linking, NRPS, AGS, Dynamic Registration)
- id: lti-advantage
  conforms: true
  evidence: Names and Role Provisioning, Assignment & Grade Services (Line Items, Score, Result) documented
- id: ims-caliper
  conforms: true
  evidence: Live Events and DAP emit Caliper IMS analytics event payloads alongside the Canvas JSON format
- id: ims-common-cartridge
  conforms: true
  evidence: Common Cartridge import/export and QTI 1.x/2.x quiz interchange supported (apis.yml Features + tooling repos)
- id: graphql
  conforms: true
  evidence: GraphQL endpoint at /api/graphql with hosted GraphiQL explorer and published SDL (graphql/canvas-lms-schema.graphql)
- id: asyncapi
  conforms: true
  evidence: Live Events stream captured as openapi/canvas-lms-live-events-asyncapi.yml (webhook + SQS delivery)
- id: json-api
  conforms: false
  evidence: Canvas uses plain JSON with include[] compound documents, not the JSON:API media type
- id: odata
  conforms: false
  evidence: No OData query surface on the Canvas LMS API (AB Connect, a separate Instructure service, uses OData-like filters)
- id: scim
  conforms: false
  evidence: Provisioning is via the SIS Import CSV API, not SCIM 2.0
- id: idempotency-key
  conforms: false
  evidence: No documented Idempotency-Key header; write operations are not idempotent by key