---
title: "Anonymous Canva import (Canva app credential)"
method: POST
path: "/api/v1/canva/import"
tags: ["Files"]
---

# Anonymous Canva import (Canva app credential)

`POST /api/v1/canva/import`

## Request

- Base URL: `https://everypage.co`
- URL: `https://everypage.co/api/v1/canva/import`
- Auth: HTTP bearer

Used by the EveryPage Canva app: creates an anonymous, immediately-shareable file from a Canva export URL. The bearer credential is a Canva Apps SDK user JWT verified against Canva's JWKS - NOT an EveryPage API key or OAuth token - so this endpoint is not callable with the credentials the rest of this API uses. The response carries the share link and QR URL, the `claimToken` (attach the file to an account via /api/claim) and `manageToken` (configure it via the v1 settings endpoint while it remains anonymous), and may include `palette` with the same advisory, best-effort semantics as the owned import above.

**Republish-in-place:** an optional `designToken` binds the publish to the exporting Canva design. When the same Canva user publishes the same design again while the earlier file is live and UNCLAIMED, the bytes are replaced in place - same link, same QR - and the response reports `republished: true` with the new `contentVersion` (a republish consumes no upload-budget slot, and re-bases the 365-day expiry unless the uploader chose one via the settings endpoint). A CLAIMED file refuses this lane with 403 - the owning account must republish through /api/v1/files/import instead. A `designToken` that is absent or fails verification degrades to a plain unbound import; it never fails the publish.

## Request body

- object
  - `url` string, uri, required: Plain HTTPS export URL on the import host allowlist.
  - `filename` string: Display name for the new file. Defaults to canva-design.pdf.
  - `designToken` string: Canva design token (contentMetadata.designToken) binding the publish to a design for republish-in-place. Optional; unverifiable tokens are ignored.

## Response `200`

Imported (or republished in place - see `republished`)

- CanvaImportResult
  - `uuid` string, uuid
  - `shortId` string
  - `viewURL` string
  - `qrURL` string: PNG QR code for the share link.
  - `claimToken` string: Attaches the anonymous file to an account via /api/claim. Expires after 30 days. Republishes mint fresh tokens too.
  - `manageToken` string: Authorizes the v1 settings endpoint while the file remains anonymous. A distinct credential from claimToken; expires after 30 days.
  - `republished` boolean: True when this publish replaced the earlier file's bytes in place (same link, same QR); false on a create.
  - `contentVersion` integer: The file's content version after a republish (present only when republished is true).
  - `palette` string[]: Colour palette extracted from the document at import time: hex swatches ("#rrggbb"), dominant colour first, at most 6. ADVISORY ONLY - extraction is best-effort (first-page embedded raster images, short time budget), so the field is simply absent for vector-only documents, for files uploaded through non-import paths, for files created before the feature, and whenever extraction fails or times out. Absence is normal, never an error; use the palette for theming (e.g. styling a share card), never for logic.

## Other responses

- `400`: Malformed body or multipart, or an invalid value (code `validation_error`).
- `401`: Missing or invalid Canva user token.
- `403`: The URL's host is not an allowed import source; or the design's link belongs to an EveryPage account (republish it via the connected import); or the link is frozen pending abuse review.
- `409`: The document was changed by another connection mid-replace. Retry.
- `413`: The export is larger than the anonymous upload limit.
- `429`: Per-Canva-user rate limit or upload budget exceeded.
- `502`: The export source could not be fetched or returned an error.

---

[API](https://skmtc.dev/everypage/apis/everypage-api.md) · [All operations](https://skmtc.dev/everypage/apis/everypage-api/llms.txt) · [OpenAPI document](https://skmtc.dev/everypage/apis/everypage-api/revisions/e6674f903456?raw)