openapi: 3.2.0 info: title: Canvas LMS REST Developer Keys API version: v1 summary: The complete Canvas LMS REST API, converted from the Swagger 1.2 documents Instructure publishes under https://canvas.instructure.com/doc/api/. description: The Canvas LMS REST API covers courses, assignments, quizzes, grades, users, enrollments, accounts, files, modules, rubrics, submissions, SIS imports, LTI, analytics and account administration. contact: name: Instructure Canvas url: https://canvas.instructure.com/doc/api/ license: name: AGPL-3.0 url: https://github.com/instructure/canvas-lms/blob/master/LICENSE servers: - url: https://canvas.instructure.com/api description: Instructure-hosted Canvas (canvas.instructure.com) - url: https://{canvas_host}/api description: Any Canvas instance; Canvas is multi-tenant and self-hostable, so the host is the institution's Canvas domain. variables: canvas_host: default: canvas.instructure.com description: Your institution's Canvas hostname, e.g. school.instructure.com security: - bearerAuth: [] - oauth2: [] tags: - name: Developer Keys x-resource: developer_keys externalDocs: url: https://canvas.instructure.com/doc/api/developer_keys.html paths: /v1/accounts/{account_id}/developer_keys: get: tags: - Developer Keys operationId: list_developer_keys summary: List Developer Keys description: List all developer keys created in the current account. parameters: - name: account_id in: path schema: type: string required: true description: ID - name: inherited in: query schema: type: boolean required: false description: 'Defaults to false. If true, lists keys inherited from Site Admin (and consortium parent account, if applicable).' responses: '200': description: Success content: application/json: schema: type: array items: $ref: '#/components/schemas/DeveloperKey' externalDocs: url: https://canvas.instructure.com/doc/api/developer_keys.html post: tags: - Developer Keys operationId: create_developer_key summary: Create a Developer Key description: 'Create a new Canvas API key. Creating an LTI 1.3 registration is not supported here and should be done via the LTI Registration API.' parameters: - name: account_id in: path schema: type: string required: true description: ID requestBody: required: false content: application/json: schema: type: object properties: developer_key: type: object additionalProperties: true description: no description developer_key[auto_expire_tokens]: type: boolean description: 'Defaults to false. If true, access tokens generated by this key will expire after 1 hour.' developer_key[email]: type: string description: Contact email for the key. developer_key[icon_url]: type: string description: URL for a small icon to display in key list. developer_key[name]: type: string description: The display name. developer_key[notes]: type: string description: User-provided notes about the key. developer_key[redirect_uri]: type: string description: Deprecated in favor of redirect_uris. Do not use. developer_key[redirect_uris]: type: array items: {} description: 'List of URLs used during OAuth2 flow to validate given redirect URI.' developer_key[vendor_code]: type: string description: User-specified code representing the vendor that uses the key. developer_key[visible]: type: boolean description: Defaults to true. If false, key will not be visible in the UI. developer_key[test_cluster_only]: type: boolean description: 'Defaults to false. If true, key is only usable in non-production environments (test, beta). Avoids problems with beta refresh.' developer_key[client_credentials_audience]: type: string description: 'Used in OAuth2 client credentials flow to specify the audience for the access token.' developer_key[allowed_audiences]: type: array items: {} description: 'The registered audiences this key may request tokens for. Each value must appear in the environment''s configured list of registered audiences.' developer_key[authorized_flows]: type: array items: {} description: 'Additional OAuth2 flows this key is authorized to use. Allowed values: token_exchange, service_user_client_credentials.' developer_key[client_type]: type: string description: 'Whether this is a confidential or public client. Public clients (SPAs, mobile apps) require PKCE in the authorization code flow, cannot use the client_credentials flow, and receive short-lived access tokens with rotating refresh tokens. Allowed values: confidential (default), public. Not applicable to LTI keys. Immutable after creation.' developer_key[scopes]: type: array items: {} description: List of API endpoints key is allowed to access. developer_key[require_scopes]: type: boolean description: If true, then token requests with this key must include scopes. developer_key[allow_includes]: type: boolean description: 'If true, allows `includes` parameters in API requests that match the scopes of this key.' required: - developer_key application/x-www-form-urlencoded: schema: type: object properties: developer_key: type: object additionalProperties: true description: no description developer_key[auto_expire_tokens]: type: boolean description: 'Defaults to false. If true, access tokens generated by this key will expire after 1 hour.' developer_key[email]: type: string description: Contact email for the key. developer_key[icon_url]: type: string description: URL for a small icon to display in key list. developer_key[name]: type: string description: The display name. developer_key[notes]: type: string description: User-provided notes about the key. developer_key[redirect_uri]: type: string description: Deprecated in favor of redirect_uris. Do not use. developer_key[redirect_uris]: type: array items: {} description: 'List of URLs used during OAuth2 flow to validate given redirect URI.' developer_key[vendor_code]: type: string description: User-specified code representing the vendor that uses the key. developer_key[visible]: type: boolean description: Defaults to true. If false, key will not be visible in the UI. developer_key[test_cluster_only]: type: boolean description: 'Defaults to false. If true, key is only usable in non-production environments (test, beta). Avoids problems with beta refresh.' developer_key[client_credentials_audience]: type: string description: 'Used in OAuth2 client credentials flow to specify the audience for the access token.' developer_key[allowed_audiences]: type: array items: {} description: 'The registered audiences this key may request tokens for. Each value must appear in the environment''s configured list of registered audiences.' developer_key[authorized_flows]: type: array items: {} description: 'Additional OAuth2 flows this key is authorized to use. Allowed values: token_exchange, service_user_client_credentials.' developer_key[client_type]: type: string description: 'Whether this is a confidential or public client. Public clients (SPAs, mobile apps) require PKCE in the authorization code flow, cannot use the client_credentials flow, and receive short-lived access tokens with rotating refresh tokens. Allowed values: confidential (default), public. Not applicable to LTI keys. Immutable after creation.' developer_key[scopes]: type: array items: {} description: List of API endpoints key is allowed to access. developer_key[require_scopes]: type: boolean description: If true, then token requests with this key must include scopes. developer_key[allow_includes]: type: boolean description: 'If true, allows `includes` parameters in API requests that match the scopes of this key.' required: - developer_key responses: '200': description: Success content: application/json: schema: $ref: '#/components/schemas/DeveloperKey' externalDocs: url: https://canvas.instructure.com/doc/api/developer_keys.html /v1/developer_keys/{id}: put: tags: - Developer Keys operationId: update_developer_key summary: Update a Developer Key description: 'Update an existing Canvas API key. Updating an LTI 1.3 registration is not supported here and should be done via the LTI Registration API.' parameters: - name: id in: path schema: type: string required: true description: ID requestBody: required: false content: application/json: schema: type: object properties: developer_key: type: object additionalProperties: true description: no description developer_key[auto_expire_tokens]: type: boolean description: 'Defaults to false. If true, access tokens generated by this key will expire after 1 hour.' developer_key[email]: type: string description: Contact email for the key. developer_key[icon_url]: type: string description: URL for a small icon to display in key list. developer_key[name]: type: string description: The display name. developer_key[notes]: type: string description: User-provided notes about the key. developer_key[redirect_uri]: type: string description: Deprecated in favor of redirect_uris. Do not use. developer_key[redirect_uris]: type: array items: {} description: 'List of URLs used during OAuth2 flow to validate given redirect URI.' developer_key[vendor_code]: type: string description: User-specified code representing the vendor that uses the key. developer_key[visible]: type: boolean description: Defaults to true. If false, key will not be visible in the UI. developer_key[test_cluster_only]: type: boolean description: 'Defaults to false. If true, key is only usable in non-production environments (test, beta). Avoids problems with beta refresh.' developer_key[client_credentials_audience]: type: string description: 'Used in OAuth2 client credentials flow to specify the audience for the access token.' developer_key[allowed_audiences]: type: array items: {} description: 'The registered audiences this key may request tokens for. Each value must appear in the environment''s configured list of registered audiences.' developer_key[authorized_flows]: type: array items: {} description: 'Additional OAuth2 flows this key is authorized to use. Allowed values: token_exchange, service_user_client_credentials.' developer_key[scopes]: type: array items: {} description: List of API endpoints key is allowed to access. developer_key[require_scopes]: type: boolean description: If true, then token requests with this key must include scopes. developer_key[allow_includes]: type: boolean description: 'If true, allows `includes` parameters in API requests that match the scopes of this key.' required: - developer_key application/x-www-form-urlencoded: schema: type: object properties: developer_key: type: object additionalProperties: true description: no description developer_key[auto_expire_tokens]: type: boolean description: 'Defaults to false. If true, access tokens generated by this key will expire after 1 hour.' developer_key[email]: type: string description: Contact email for the key. developer_key[icon_url]: type: string description: URL for a small icon to display in key list. developer_key[name]: type: string description: The display name. developer_key[notes]: type: string description: User-provided notes about the key. developer_key[redirect_uri]: type: string description: Deprecated in favor of redirect_uris. Do not use. developer_key[redirect_uris]: type: array items: {} description: 'List of URLs used during OAuth2 flow to validate given redirect URI.' developer_key[vendor_code]: type: string description: User-specified code representing the vendor that uses the key. developer_key[visible]: type: boolean description: Defaults to true. If false, key will not be visible in the UI. developer_key[test_cluster_only]: type: boolean description: 'Defaults to false. If true, key is only usable in non-production environments (test, beta). Avoids problems with beta refresh.' developer_key[client_credentials_audience]: type: string description: 'Used in OAuth2 client credentials flow to specify the audience for the access token.' developer_key[allowed_audiences]: type: array items: {} description: 'The registered audiences this key may request tokens for. Each value must appear in the environment''s configured list of registered audiences.' developer_key[authorized_flows]: type: array items: {} description: 'Additional OAuth2 flows this key is authorized to use. Allowed values: token_exchange, service_user_client_credentials.' developer_key[scopes]: type: array items: {} description: List of API endpoints key is allowed to access. developer_key[require_scopes]: type: boolean description: If true, then token requests with this key must include scopes. developer_key[allow_includes]: type: boolean description: 'If true, allows `includes` parameters in API requests that match the scopes of this key.' required: - developer_key responses: '200': description: Success content: application/json: schema: $ref: '#/components/schemas/DeveloperKey' externalDocs: url: https://canvas.instructure.com/doc/api/developer_keys.html delete: tags: - Developer Keys operationId: delete_developer_key summary: Delete a Developer Key description: Delete an existing Canvas API key. Deleting an LTI 1.3 registration should be done via the LTI Registration API. parameters: - name: id in: path schema: type: string required: true description: ID responses: '200': description: Success content: application/json: schema: $ref: '#/components/schemas/DeveloperKey' externalDocs: url: https://canvas.instructure.com/doc/api/developer_keys.html /v1/developer_keys/{id}/regenerate_secret: post: tags: - Developer Keys operationId: regenerate_developer_key_secret summary: Regenerate Developer Key Secret description: 'Regenerate the secret (api_key) for an existing Canvas API key. This invalidates the existing secret. Any applications using the old secret will stop working. Regenerating a secret for an LTI key is not supported. This endpoint requires the developer_key_regenerate_secret feature flag to be enabled. This feature flag can only be turned on by Site Admins' parameters: - name: id in: path schema: type: string required: true description: ID responses: '200': description: Success content: application/json: schema: $ref: '#/components/schemas/DeveloperKey' externalDocs: url: https://canvas.instructure.com/doc/api/developer_keys.html components: schemas: DeveloperKey: type: object properties: id: type: integer example: 1 description: The Canvas ID of the DeveloperKey object name: type: string example: Test Key description: The display name created_at: type: string format: date-time example: '2025-05-30T17:09:18Z' description: Timestamp of the key's creation updated_at: type: string format: date-time example: '2025-05-30T17:09:18Z' description: Timestamp of the key's last update workflow_state: type: string example: active description: The state of the key enum: - active - deleted is_lti_key: type: boolean example: false description: True if key represents an LTI 1.3 Registration. False for Canvas API keys email: type: string example: test@example.com description: Contact email configured for key icon_url: type: string example: https://example.com/icon.png description: URL for a small icon to display in key list notes: type: string example: this key is for testing description: User-provided notes about key vendor_code: type: string example: Google description: User-specified code representing the vendor that uses the key account_name: type: string example: Test Account description: The name of the account that owns the key visible: type: boolean example: true description: True for all keys except Site Admin-level keys, which default to false. Controls visibility in the Inherited tab. scopes: type: array items: type: string example: - url:GET|/api/v1/accounts description: List of API endpoints key is allowed to access (API keys), or LTI 1.3 scopes (LTI keys) redirect_uri: type: string example: 'no' description: Deprecated in favor of redirect_uris. Do not use. redirect_uris: type: array items: type: string example: - https://mytool.com/oauth2/redirect - https://mytool.com/1_3/launch description: List of URLs used during OAuth2 flow to validate given redirect URI (API keys), or to redirect to after login (LTI keys) all_redirect_uris: type: array items: type: object additionalProperties: true example: - redirect_uri: https://mytool.com/redirect last_used_at: '2024-01-15T12:00:00Z' workflow_state: active description: All redirect URIs associated with the key, including any that have been automatically deactivated due to inactivity, along with their last-used timestamp and workflow_state (one of 'active' or 'inactive') access_token_count: type: integer example: '42' description: (API keys only) The number of active access tokens associated with the key last_used_at: type: string format: date-time example: '2025-05-30T17:09:18Z' description: (API keys only) The last time an access token for this key was used in an API request test_cluster_only: type: boolean example: false description: (API keys only) If true, key is only usable in non-production environments (test, beta). Avoids problems with beta refresh. allow_includes: type: boolean example: true description: (API keys only) If true, allows `includes` parameters in API requests that match the scopes of this key require_scopes: type: boolean example: false description: (API keys only) If true, then token requests with this key must include scopes client_credentials_audience: type: string example: external description: (API keys only) Used in OAuth2 client credentials flow to specify the audience for the access token allowed_audiences: type: array items: type: string example: - cedar-api-production.us-east-1.temp.prod.inseng.io description: (API keys only) The registered audiences this key may request tokens for. Each value must appear in the environment's configured list of registered audiences. authorized_flows: type: array items: type: string example: - token_exchange description: '(API keys only) Additional OAuth2 flows this key is authorized to use. Allowed values: token_exchange, service_user_client_credentials.' client_type: type: string example: confidential description: '(API keys only) Whether this is a confidential or public client. Public clients (SPAs, mobile apps) require PKCE, cannot use client_credentials, and receive short-lived rotating tokens. Allowed values: confidential, public. Defaults to confidential. Immutable after creation.' api_key: type: string example: sd45fg64.... description: (API keys only) The client secret used in the OAuth authorization_code flow. tool_configuration: type: string example: type: Lti::ToolConfiguration description: (LTI keys only) The Canvas-style tool configuration for this key. public_jwk: type: object additionalProperties: true example: e: AQAB etc: etc description: (LTI keys only) The tool's public JWK in JSON format. Discouraged in favor of a url hosting a JWK set. public_jwk_url: type: string example: https://mytool.com/1_3/jwks description: (LTI keys only) The tool-hosted URL containing its public JWK keyset. Canvas may cache JWKs up to 5 minutes. lti_registration: type: object additionalProperties: true example: type: TODO Lti::IMS::Registration description: (LTI keys only) The LTI IMS Registration object for this key, if key was created via Dynamic Registration. is_lti_registration: type: boolean example: false description: (LTI keys only) Returns true if key was created via Dynamic Registration. user_name: type: string example: '' description: Unused. user_id: type: string example: '' description: Unused. unified_tool_id: type: string example: 6ba7b810-9dad-11d1-80b4-00c04fd430c8 description: Correlates an API key to a product configuration. description: a Canvas API key (or LTI 1.3 registration) securitySchemes: bearerAuth: type: http scheme: bearer description: 'Canvas OAuth2 access token sent as "Authorization: Bearer ". See https://canvas.instructure.com/doc/api/file.oauth.html' oauth2: type: oauth2 description: Canvas OAuth2. See https://canvas.instructure.com/doc/api/file.oauth.html and https://canvas.instructure.com/doc/api/file.oauth_endpoints.html flows: authorizationCode: authorizationUrl: https://canvas.instructure.com/login/oauth2/auth tokenUrl: https://canvas.instructure.com/login/oauth2/token refreshUrl: https://canvas.instructure.com/login/oauth2/token scopes: {} externalDocs: description: Canvas LMS REST API Documentation url: https://canvas.instructure.com/doc/api/ x-generated-from: https://canvas.instructure.com/doc/api/api-docs.json x-provenance: method: derived derived_by: API Evangelist enrichment pipeline (Swagger 1.2 -> OpenAPI 3.1 conversion) source: openapi/_original/swagger-1.2/*.json (144 verbatim first-party Swagger 1.2 documents) source_url: https://canvas.instructure.com/doc/api/api-docs.json fetched: '2026-09-05' http_status: 200