Restricted uses

Version 1.0, November 6, 2026.

This page is part of the Documentation and is incorporated into the Canva Developer Terms⁠(opens in a new tab or window) and Schedule 1 (Canva API Services) (section 7.1(h)). Breach is a material breach of those terms. Canva may update this page on reasonable notice. Capitalised terms (including "Output") have the meaning given in the Canva Developer Terms. In this page, "enable" includes knowingly providing a tool, workflow or integration whose primary or foreseeable use is a restricted use, and "distribute" includes making available to end users through your application.

You must not use the Canva APIs or any Output to create, enable or distribute:

1. Unlawful and regulated activity. Any use that violates applicable law, including the sale or promotion of illegal goods, sanctions or export-control evasion, and infringement of others' intellectual property or privacy rights. This includes promoting or selling products that are legal but restricted in the jurisdiction of your end users without complying with those restrictions, such as gambling, alcohol, tobacco and vaping products, weapons, prescription medicines and regulated financial products.
2. Child sexual abuse or exploitation material. Any sexual or abusive content involving minors, real or synthetic, and any content that grooms, sexualises or endangers children. No exceptions, and we report where the law requires.
3. Non-consensual intimate or sexualised imagery. Intimate, sexual or sexualised depictions of any identifiable real person without their consent, including "nudification" and fictional placement of real people in sexual contexts.
4. Sexually explicit content. Pornographic or sexually explicit content of any kind, whether or not it is lawful and consensual. The Canva APIs are not a platform for adult content.
5. Content enabling serious harm. Instructions or material assistance for weapons, explosives, or chemical, biological, radiological or nuclear harm; content inciting, glorifying or coordinating violence, terrorism or self-harm, including content that promotes or provides instruction for eating disorders or dangerous challenges.
6. Hate and harassment. Content that attacks, demeans or dehumanises people on the basis of race, ethnicity, national origin, religion, disability, age, sex, gender identity, sexual orientation or any other protected attribute; content that threatens, bullies, stalks or harasses an individual; and symbols or material of organisations that promote hatred or violence.
7. Deception, fraud and impersonation. Content intended to deceive; including disinformation generated or distributed at scale, impersonation of real people or organisations (including Canva, or claiming your application is made, endorsed or certified by Canva when it is not), phishing and scam content, fake reviews or engagement, and deceptive content intended to manipulate political processes, elections or civic participation.
8. Provenance tampering. Removing, altering, obscuring or forging watermarks, Content Credentials (C2PA) metadata, AI-generation labels or other provenance information attached to Outputs or to Canva content, or presenting AI-generated Outputs as human-created or as authentic photographs or recordings of real events.
9. Malicious code and cyber abuse. Creating or distributing malware, exploits or other malicious code; content or tooling that supports unauthorised access to systems, accounts or data; credential harvesting; or any use of the API Services in connection with a cyberattack.
10. Undisclosed professional advice. Presenting Outputs as medical, legal or financial advice from a qualified professional, or providing such advice to end users without clear disclosure that the content is AI-generated and does not come from a qualified professional, and without complying with any licensing, disclosure or warning requirements that apply to that advice in the end user's jurisdiction.
11. Surveillance and privacy violations. Building facial-recognition or biometric-identification databases; inferring sensitive characteristics (health, sexuality, political or religious views) about individuals; tracking, monitoring or profiling identifiable people without a lawful basis; doxxing.
12. Significant-effects automated decisions. Using the API Services or Outputs to make decisions with legal or similarly significant effects on individuals such as employment, credit, insurance, housing, education access, immigration, without meaningful human oversight.
13. Critical infrastructure and safety-critical systems. Using the API Services or Outputs as a component of, or to control, medical devices, weapons systems, critical infrastructure (energy, water, transport, emergency services), or any other system where failure could cause death, serious injury or large-scale harm.
14. Spam and platform manipulation. Bulk unsolicited or deceptive messaging, engagement farming, search-manipulation content farms, or flooding any platform (including Canva's) with low-value synthetic content.
15. Circumventing Canva's controls. Bypassing or attempting to bypass rate limits, quotas, authentication, content filters or other safety or security measures; attempting to "jailbreak" or extract the system instructions of Canva's AI features; scraping, crawling or bulk-exporting Canva content, templates, fonts, stock media or user data beyond what the API Services expressly permit; and sharing, proxying, reselling or sublicensing API credentials or access, or using the API Services to provide a service that substantially replicates Canva.
16. Manipulating or misusing agents. Prompt injection, tool poisoning (misleading tool names, descriptions or schemas), hidden or obfuscated instructions placed in designs, assets, documents or tool responses, or any other technique intended to cause Canva's AI features, Canva agents or another user's agent to act outside the user's intent; using the API Services or any connector to exfiltrate data from a user's Canva account or connected services; and taking actions in a user's Canva account (including creating, editing, sharing, publishing, exporting or purchasing) that the user has not authorised.
17. Training or benchmarking competing models. Using Outputs, Canva content or the API Services to train, fine-tune, distil, evaluate or improve any machine-learning model, except as expressly permitted in writing by Canva.

If your use case touches one of these categories for a legitimate purpose: safety research, journalism, classification rather than generation, contact our developer support channel⁠(opens in a new tab or window) before building; written consent under the Terms is the only exception path. To report misuse of the Canva APIs: contact us here⁠(opens in a new tab or window).

You are responsible for your end users' use of your application. You must maintain reasonable measures to detect and prevent restricted uses by your end users (including content moderation proportionate to your use case and the ability to suspend users who breach these rules), must cooperate with Canva's reasonable requests to investigate suspected misuse, and must report to Canva any restricted use you become aware of within 5 business days. Canva may suspend or terminate access to the API Services immediately where it reasonably believes a restricted use has occurred.