The Canvas Agent enables seamless, conversational access to your Canvas Learning Management System through natural language queries. Instead of navigating through multiple web pages and menus, users can simply ask questions and receive immediate, accurate responses powered by Canvas REST APIs.
Teachers and instructors gain powerful administrative and pedagogical capabilities:
Student Progress Monitoring: Instantly identify “Which students haven’t submitted their midterm papers?” or “Show me all students who scored below 70% on the last three quizzes”
Data-Driven Instruction: Access participation data, engagement metrics, and performance analytics for early intervention strategies
Administrative Efficiency: Check enrollment numbers, retrieve discussion participation data, and manage course logistics through simple conversations
Content Management: Create discussion posts, manage assignments, and update course materials using natural language commands
User asks: "What discussions do I need to respond to this week?"↓Agent queries Canvas discussion topics API↓Filters results by due dates and user participation↓Returns formatted list of pending discussions
Instructor Query Flow:
Copy
Ask AI
User asks: "Create a discussion post about photosynthesis due next Friday"↓Agent constructs discussion topic payload↓Posts to Canvas discussion API with specified due date↓Confirms creation and provides discussion link
Administrative Query Flow:
Copy
Ask AI
User asks: "Which students in my AP History class have missing assignments?"↓Agent retrieves enrollment data and submission records↓Cross-references to identify gaps↓Returns actionable list with student details
The agent operates conservatively by default, restricting access to only those operations explicitly permitted by the user’s Canvas role. This ensures compliance with institutional policies and prevents unauthorized access to sensitive data.
Key Security Features:
Automatic permission verification before each API call
Scope-based access control aligned with Canvas permissions
Session-based authentication with automatic token refresh
Audit logging of all API interactions
Graceful denial of unauthorized requests with clear messaging
Generate API credentials in Canvas to enable communication between Praxis and Canvas
2
Configure Scopes
Define which API functions your Digital Twin can access
3
Configure Digital Twin
Add Canvas credentials to your Praxis instance
4
Test Integration
Verify the connection and authorize access
The Developer Key you create for API access is separate and distinct from any LTI (Learning Tools Interoperability) keys used for embedding Pria as an LTI activity within Canvas.
For Accounts Managing Multiple Digital Twins:Organizations with multiple Digital Twin instances can streamline configuration by storing Canvas API credentials at the account level:
Centralized Configuration: Set Canvas Client ID and Secret once at the parent account level
Automatic Inheritance: All child Digital Twin instances automatically inherit these credentials
Simplified Maintenance: Update credentials in one place to affect all instances
Focus on Customization: Teachers can concentrate on behavior and content personalization rather than technical setup
Contact our support team to configure account-level Canvas credentials. This is recommended once your API scopes and configuration attributes have stabilized in your development environment.
This is the authorization screen students and instructors will see when first connecting to Canvas:
7
Configure API Scopes
a. Check the Enforce Scopes checkbox located to the right of the Key Name field
b. Use the search box to find specific API functions (e.g., type “smart” to locate Smart Search)c. Check the boxes for each API function you want to authorize
Repeat this process to authorize additional API functions as needed. See the Canvas Scopes section for detailed scope information.
Development Mode: While developing and testing, you may choose to disable scope enforcement to allow unrestricted API access. During this phase, monitor the Agent Details in your dialog history to identify which endpoints your queries use. Document these for production scope configuration.
d. Click Save in the bottom-right cornere. Enable the Developer Key by toggling the State button to “ON”
8
Copy Credentials
Under the Details section:
Copy the Client ID (the numeric identifier, e.g., XXX217)
Click Show Key and copy the Client Secret
Store these credentials securely—you’ll need them for Digital Twin configuration.
Remember: One Developer Key can serve multiple Praxis instances. You’ll use these credentials when configuring each Digital Twin that needs Canvas access.
When you enable scopes for Pria’s API integration, you establish precise security boundaries:
Explicit Permissions: Define exactly which Canvas operations Pria can perform on behalf of users
Principle of Least Privilege: Grant only the minimum access necessary for required functionality
Data Protection: Ensure Pria accesses only the data it needs to function
Audit Trail: Track which API functions are authorized and used
Pria’s Canvas Agent automatically implements role-based access control that respects Canvas’s native permission system. Even with broad API scopes enabled, individual users can only perform actions appropriate to their Canvas role (student, instructor, administrator).
Click the Admin (⌂) icon at the top of your Praxis interface.
2
Locate Your Instance
Find your Digital Twin instance in the list and click the green Edit pencil icon on the left.
3
Add API Credentials
In the Edit Instance panel:a. Scroll down to the Integration sectionb. Locate the Canvas Client ID and Canvas Client Secret fieldsc. Paste the credentials you copied from the Canvas Developer Key
4
Save Configuration
Click Update at the bottom of the panel to save your changes.
These credentials enable your Digital Twin to authenticate with Canvas on behalf of users. The actual user permissions are determined by their Canvas role and the OAuth authorization they grant.
Navigate to your Digital Twin and ask a Canvas-related question:
Copy
Ask AI
What is my course syllabus in Canvas?
or
Copy
Ask AI
Show me my upcoming assignments
2
Authorize Access
On first connection (or when your token expires), you’ll be prompted to authorize your Digital Twin to access Canvas:
Click the authorization link provided
Review the permissions requested
Click Authorize in the Canvas OAuth consent screen
You’ll be redirected back to Praxis automatically
3
Verify Response
Your Digital Twin should return relevant information from your Canvas course, confirming successful integration.
4
Agent Details
A comprehensive audit log of the Digital Twin’s Canvas interactions via the call_canvas agent is available in the Agent Details section of each response, allowing you to review successful execution status and identify the specific API functions that were called during the interaction.
Token Management: Access tokens are valid for 60 minutes and are automatically refreshed in the background to maintain seamless access. You typically only need to authorize once per session or when tokens expire.
Instance not properly configured: Your account is stand alone and is not integrated with Canvas. It must be associated to an instance properly configured by your Teacher or Administrator.
Symptom: Authentication fails or redirects to the wrong Canvas instance
Instance not properly configured: Access to Canvas LMS requires a valid Authorized Public URL property for your instance! This value can be configured using the Administration UI.
For missing or incorrect API UrlCause: The system cannot determine your institution’s Canvas domain, or there’s a mismatch in the authorized URLs configuration.Solution:
1
Check Authorized URLs
In your Digital Twin configuration, ensure the first line of your Public Authorized URLs contains your institution’s primary Canvas domain:
Copy
Ask AI
https://your-institution.instructure.com
2
Verify Domain Priority
The Canvas Agent uses the first domain in your authorized URLs list that matches your institution. Order matters:Correct Order:
The agent will use school.instructure.com (production)
Production vs. Test Instances: It is strongly recommended NOT to share a single Digital Twin between production and test Canvas instances. This can cause domain confusion and authentication failures.If you must use both environments, the Canvas Agent will select the first domain in your authorized URLs list that contains either:
Symptom: Error message about Client ID or Secret missing
Instance not properly configured: Access to Canvas LMS requires a valid Client Id for your instance! This value can be configured using the Administration UI.
Instance not properly configured: Access to Canvas LMS requires a valid client secret for your instance! This value can be configured using the Administration UI.Solution:
Verify that you’ve copied the correct Client ID and Secret from Canvas
Ensure the Developer Key is enabled in Canvas
Check that the Redirect URI in Canvas matches: https://pria.praxislxp.com/api/auth/token_complete
Update your Digital Twin instance with the correct credentials
Access to Canvas LMS API function at https://institution.instructure.com/api/v1/courses/53493/assignments is Unauthorized (401). Insufficient scopes on access token.
Cause: The API endpoint being accessed requires a scope that hasn’t been authorized in your Canvas Developer Key.Solution:
1
Identify Required Scope
From the error message, note the endpoint path (e.g., /api/v1/courses/:course_id/assignments)
2
Add Scope in Canvas
Return to Canvas Developer Keys
Edit your Pria API key
Search for and enable the required scope
Save changes
3
Generate New Token
Users will need to re-authorize to receive a token with the updated scopes:
Log out of Praxis
Log back in
Re-authorize Canvas access when prompted
Important: When scopes are enforced, they must be defined in both locations:
Your Canvas Developer Key (authorizes the scopes)
Your Digital Twin configuration (declares required scopes)
Any modifications to the scope list require generating new access tokens, as scopes are embedded in the token at creation time.
Symptom: Frequent re-authorization requests or “token expired” messagesCause: Access tokens expire after 60 minutes of inactivitySolution: This is normal behavior. The system automatically refreshes tokens in the background. If you’re prompted to re-authorize:
Click the authorization link
Approve the request in Canvas
Continue your session
If you experience excessive re-authorization requests, check that your browser allows cookies from pria.praxislxp.com and your Canvas domain.
Canvas API scopes are granular permission controls that define exactly which actions an application can perform when accessing Canvas data through the REST API.Key Concepts:
Principle of Least Privilege: Applications should only have access to what they absolutely need
Endpoint-Specific: Each scope corresponds to specific API endpoints and HTTP methods
Security Layer: Scopes work in conjunction with user roles to enforce access control
Applications should only have access to what they absolutely need. Over-permissioning creates security risks and violates best practices.
Each scope is a pipe-delimited string with three components:
Copy
Ask AI
url:<HTTP_METHOD>|<API_ENDPOINT>
Components:
Literal prefix: Always starts with url:
HTTP Method: GET, POST, PUT, or DELETE
Endpoint Path: The API path without the domain
Example Scope:
Copy
Ask AI
url:GET|/api/v1/courses/:course_id/enrollments
This scope allows:
Method: GET (read-only)
Resource: Course enrollments
Context: Within a specific course
Path Variables: URL parameters are written with colon notation (e.g., :user_id, :course_id, :assignment_id). When defining scopes, ensure variable names match exactly—scope comparison is token-based and case-sensitive.
Latest Version: The most current version of this starter configuration is maintained in the Praxis AI Community Repository - please contribute:Canvas Scopes Configuration
Access to Canvas LMS API function at https://institution.instructure.com/api/v1/courses/53493/assignments is Unauthorized (401). {"errors":[{"message":"Insufficient scopes on access token."}],"error_report_id":"1288266"}
Resolution Steps:
Identify the missing scope from the error message endpoint
Add the scope to your Canvas Developer Key
Ensure the scope is also listed in your Digital Twin configuration
Have users re-authorize to receive updated tokens
Critical Scope Requirement: When scopes are enforced, they must be defined in both locations:
Canvas Developer Key (authorizes the application to use these scopes)
Digital Twin Configuration (declares which scopes to request during OAuth)
Modifying scopes requires generating new access tokens, as scope permissions are embedded in the token at creation time and cannot be changed retroactively.
Canvas Smart Search provides an intelligent fallback mechanism when specific API endpoints are unavailable or return insufficient data due to scope restrictions.
Environment Availability: According to Canvas deployment notes, Smart Search is available only for Beta and Production releases. It may not be available in test or development Canvas instances.If you experience issues with Smart Search even after proper configuration, contact Instructure Support to verify that your Canvas instance has Smart Search enabled.
Recommended Configuration: Always include the Smart Search scope in your production configuration:
Copy
Ask AI
"url:GET|/api/v1/courses/:course_id/smartsearch"
This ensures your Digital Twin can gracefully handle edge cases and provide comprehensive search capabilities even when specific API scopes are restricted.