---
title: "Canva design publish status (Canva app credential)"
method: POST
path: "/api/v1/canva/design/status"
tags: ["Files"]
---

# Canva design publish status (Canva app credential)

`POST /api/v1/canva/design/status`

## Request

- Base URL: `https://everypage.co`
- URL: `https://everypage.co/api/v1/canva/design/status`
- Auth: HTTP bearer

Used by the EveryPage Canva Design Editor panel: reports whether the calling Canva user has a live published link for a design, and its state. Auth is a Canva Apps SDK user JWT in the Authorization header (like /api/v1/canva/import - NOT an EveryPage credential) PLUS a verified `designToken` in the body; both are required, because the response is derived entirely from the design id and an unproven id would make this an enumeration oracle.

For a live UNCLAIMED link the response carries the link identity, view count, `contentVersion`, and a fresh `claimToken`. For a link CLAIMED by an EveryPage account it carries `claimed: true` and the link's share/QR URLs only - never a claim token, and the view count and uuid only when the optional `accessToken` proves the caller IS the owning account (`connectedAccountIsOwner`). `publishedByOther` is a boolean-only disclosure that a DIFFERENT Canva user (a design collaborator) already published this design - publishing anyway would mint a second link behind any QR they already printed.

## Request body

- object
  - `designToken` string, required: Canva design token (getDesignToken / contentMetadata.designToken). REQUIRED and hard-verified - unlike the import lane there is no unbound fallback to degrade to.
  - `accessToken` string: Optional EveryPage bearer credential (API key or OAuth access token). In the body because the Authorization header carries the Canva JWT on this lane. When present, the response includes connectedAccountIsOwner.

## Response `200`

The design's publish state for the calling Canva user

- CanvaDesignStatus: The publish state of (calling Canva user, design). Fields beyond `published`/`publishedByOther` appear only when a live link exists, and `uuid`/`viewCount`/`contentVersion`/`claimToken` are further restricted - see the endpoint description.
  - `published` boolean: The calling Canva user has a live link for this design.
  - `publishedByOther` boolean: A DIFFERENT Canva user has a live link for this design (shared/team designs). Boolean only - nothing about the other link is disclosed.
  - `claimed` boolean: The link belongs to an EveryPage account (present when published).
  - `uuid` string, uuid: Present when the link is unclaimed, or the presented accessToken is the owner's.
  - `shortId` string
  - `viewURL` string
  - `qrURL` string: PNG QR code for the share link.
  - `viewCount` integer: Present when unclaimed, or the presented accessToken is the owner's.
  - `contentVersion` integer: Same visibility as viewCount. Increments on every in-place republish.
  - `claimToken` string: Freshly minted, ONLY while the link is unclaimed (30-day validity). Redeem via POST /api/v1/files/claim or the /api/claim browser link.
  - `connectedAccountIsOwner` boolean: Present only when an accessToken was sent and a link exists: whether that account owns the (claimed) link. Always false while unclaimed.

## Other responses

- `400`: Missing design token or malformed body.
- `401`: Missing/invalid Canva user token, an invalid design token, or an invalid `accessToken`.
- `429`: Per-Canva-user or per-IP rate limit exceeded.
- `503`: Design verification is temporarily unavailable (signing keys unreachable). Retry.

---

[API](https://skmtc.dev/everypage/apis/everypage-api.md) · [All operations](https://skmtc.dev/everypage/apis/everypage-api/llms.txt) · [OpenAPI document](https://skmtc.dev/everypage/apis/everypage-api/revisions/e6674f903456?raw)