Files

Anonymous Canva import (Canva app credential)

Used by the EveryPage Canva app: creates an anonymous, immediately-shareable file from a Canva export URL. The bearer credential is a Canva Apps SDK user JWT verified against Canva's JWKS - NOT an EveryPage API key or OAuth token - so this endpoint is not callable with the credentials the rest of this API uses. The response carries the share link and QR URL, the claimToken (attach the file to an account via /api/claim) and manageToken (configure it via the v1 settings endpoint while it remains anonymous), and may include palette with the same advisory, best-effort semantics as the owned import above.

Republish-in-place: an optional designToken binds the publish to the exporting Canva design. When the same Canva user publishes the same design again while the earlier file is live and UNCLAIMED, the bytes are replaced in place - same link, same QR - and the response reports republished: true with the new contentVersion (a republish consumes no upload-budget slot, and re-bases the 365-day expiry unless the uploader chose one via the settings endpoint). A CLAIMED file refuses this lane with 403 - the owning account must republish through /api/v1/files/import instead. A designToken that is absent or fails verification degrades to a plain unbound import; it never fails the publish.

post/api/v1/canva/import

Request

  • Base URL: https://everypage.co
  • URL: https://everypage.co/api/v1/canva/import
  • Auth: HTTP bearer

Request body

urlstring uri required

Plain HTTPS export URL on the import host allowlist.

filenamestring

Display name for the new file. Defaults to canva-design.pdf.

designTokenstring

Canva design token (contentMetadata.designToken) binding the publish to a design for republish-in-place. Optional; unverifiable tokens are ignored.

Response

Imported (or republished in place - see republished)

uuidstring uuid
shortIdstring
viewURLstring
qrURLstring

PNG QR code for the share link.

claimTokenstring

Attaches the anonymous file to an account via /api/claim. Expires after 30 days. Republishes mint fresh tokens too.

manageTokenstring

Authorizes the v1 settings endpoint while the file remains anonymous. A distinct credential from claimToken; expires after 30 days.

republishedboolean

True when this publish replaced the earlier file's bytes in place (same link, same QR); false on a create.

contentVersioninteger

The file's content version after a republish (present only when republished is true).

palettestring[]

Colour palette extracted from the document at import time: hex swatches ("#rrggbb"), dominant colour first, at most 6. ADVISORY ONLY - extraction is best-effort (first-page embedded raster images, short time budget), so the field is simply absent for vector-only documents, for files uploaded through non-import paths, for files created before the feature, and whenever extraction fails or times out. Absence is normal, never an error; use the palette for theming (e.g. styling a share card), never for logic.

Example response

{
  "shortId": "aB3xY9kQ2mZ7",
  "viewURL": "https://everypage.co/aB3xY9kQ2mZ7",
  "palette": [
    "#1a2b3c"
  ]
}

Changes

No recorded changes to this operation across all 1 revision of this API.