Set up a Canva connector

C1 provides identity governance and just-in-time provisioning for Canva. Integrate your Canva tenant with C1 to run user access reviews, enable access requests, and provision accounts and group memberships.

Capabilities

The Canva connector syncs the following resources:

Resource	Sync	Provision
Accounts		Create, Delete
Groups		Grant, Revoke
Roles
Teams

Accounts sync from Canva SCIM v2. Groups sync with membership grants. Roles are a synthetic catalog (Admin, Member, Guest) derived from each user’s SCIM role. Teams sync from the Canva Admin API when optional Admin API credentials are configured.

Gather Canva credentials

You need a Canva SCIM bearer token with user and group read/write access. Team sync also requires Admin API OAuth client credentials. Treat all secrets as sensitive.

1. Sign in to your Canva enterprise admin console as a user who can manage SCIM provisioning.

2. Generate a SCIM bearer token for your tenant. Canva documents SCIM v2 at https://www.canva.com/_scim/v2.

3. Confirm the token has the permissions required for this connector:

   • SCIM Users:Read and SCIM Users:Write
   • SCIM Groups:Read and SCIM Groups:Write
4. Optional: to sync Teams, create an OAuth 2.0 client in Canva for the Admin API and copy the client ID and client secret. Team sync requires Admin API Teams:Read.

SCIM is the primary surface for users, groups, roles, and provisioning. The Admin API is optional and is only required for the team resource type.

Configure the Canva connector

Cloud-hosted

Follow these instructions to use a built-in, no-code connector hosted by C1.

1. In C1, navigate to Integrations > Connectors and click Add connector.

2. Search for Canva and click Add.

3. Choose how to set up the new Canva connector:

   • Add the connector to a currently unmanaged app
   • Add the connector to a managed app
   • Create a new managed app
4. Set the owner for this connector.

5. Click Next.

6. Find the Settings area of the page and click Edit.

7. Enter the required configuration:

   • SCIM bearer token (required): SCIM token generated in Canva admin settings
   • Admin API client ID (optional): OAuth client ID for team sync
   • Admin API client secret (optional): OAuth client secret for team sync
8. Click Save.

9. The connector’s label changes to Syncing, followed by Connected. You can view the logs to ensure that information is syncing.

Done. Your Canva connector is now pulling access data into C1.

Self-hosted

Follow these instructions to run the Canva connector in your own environment.

1. Create secrets for the Canva SCIM token and, if needed, Admin API OAuth credentials.

2. Configure the connector environment variables:

   • BATON_SCIM_TOKEN: SCIM bearer token (required)
   • BATON_ADMIN_CLIENT_ID: Admin API client ID (optional; enables team sync)
   • BATON_ADMIN_CLIENT_SECRET: Admin API client secret (optional; enables team sync)
3. Deploy the connector using your standard self-hosted connector process.

Done. Your Canva connector is now pulling access data into C1.

Provisioning behavior

• Create account creates a SCIM v2 user with work email, given name, family name, and active set to true.
• Group grant/revoke updates group membership with SCIM PatchOp add/remove operations.
• Delete account deactivates the user with a SCIM PatchOp that sets active to false (Canva’s recommended soft deactivation).

Fields not synced

Canva does not expose manager chain, department, division, cost center, title, employment type, hire date, termination date, or custom enterprise extensions. Non-work email, locale, phone, address, government IDs, and compensation attributes are excluded by design.