Canva is Needs Work to agents.
Discry independently scored how well an AI agent can discover and understand the Canva API from what’s public — not whether it’s usable. Below: every signal we checked, what’s costing the score, and what to change.
SCORED UNDER RUBRIC 1.2 · A full re-launch under Discry Score 2.5 — a new behavioral instrument, not comparable to these scores — is in progress.
Discovery
45% of score · 52/100Comprehension
55% of score · 82/100What we found
- Canva's robots.txt explicitly disallows */llms.txt, */llms-full.txt, and */*.md — actively blocking AI-optimized discovery paths while other discovery signals are absent
- The Connect API documentation is exceptionally well-structured with task-oriented descriptions, clear auth/scope requirements per endpoint, and per-endpoint rate limits
- Official Canva MCP server exists with OAuth auto-flow — listed on PulseMCP and Smithery, plus a dedicated Dev MCP server reference app in their docs
- OpenAPI spec publicly available at canva.dev/sources/connect/api/latest/api.yml and in the GitHub starter kit repo
- Error response documentation lists 30+ error codes but lacks actionable recovery guidance — 'invalid_field' doesn't explain which field or what valid values are
What to change
Prioritized by impact on discoverability. You (or your docs platform) deploy these — Discry never touches your API.
- 01Remove the robots.txt disallow rules for */llms.txt and */llms-full.txt, then publish an llms.txt covering the Connect API surface area
- 02Add error recovery guidance to the error responses page — for each error code, explain what triggered it and what the caller should do to fix it
- 03Create .well-known/mcp.json pointing to the official Canva MCP server with tool declarations and OAuth config
- 04Add llms-full.txt with comprehensive markdown covering all Connect API endpoints for agent consumption
- 05Expand code examples beyond JSON request/response bodies to include complete curl commands and SDK snippets in Python/Node.js
Execution coverage · INFORMATIONAL, UNSCORED
Whether an agent can actually complete a call and recover from errors is the deeper Audit layer — documented here, but not part of the Discry Score.
OAuth 2.0 with Bearer token auth, scoped permissions per endpoint. Structured JSON error responses with code and message fields. Per-endpoint rate limits documented (e.g., 20 req/min for create design). Cursor-based pagination. No idempotency key support documented.