POST /publish/resources/upload

API reference for the "/publish/resources/upload" endpoint.

When a user publishes their design via a publish extension, Canva sends a POST request to the following endpoint:


The purpose of the request is to upload the user's design to the destination platform.

The body of the request includes an array of assets. If a user publishes their design as a JPG or PNG, each page of the design is a separate asset. If the user publishes their design as a PDF or PPTX, the entire design is a single asset.

Each asset has a URL, which the extension must use to download the asset and upload it to the destination platform.

  • Extensions must respond to this request within 8 seconds.
  • When sending this request, Canva replaces <base_url> with the extension's Base URL. You can configure the Base URL via the Developer Portal.
  • If a user publishes a design that contains embedded media, such as a YouTube video or Instagram photo, Canva temporarily caches that media. If the user re-publishes their design, any changes to the underlying media (for example, a new thumbnail for a YouTube video) may not be reflected in the published design. The cache duration is approximately 24 hours.
  • Extensions should meet the UX guidelines.


POST <base_url>/publish/resources/upload
X-Canva-SignaturesstringYesA comma-separated list of request signatures. The name of this header is sometimes lowercase (e.g. x-canva-signatures).
X-Canva-TimestampstringYesThe UNIX timestamp (in seconds) of when Canva sent the request. The name of this header is sometimes lowercase (e.g. x-canva-timestamp).
messagestringNoA message the user provides before publishing their design. To use this feature, enable Requires custom message via the Developer Portal.
parentstringNoThe ID of the selected container.
userstringYesThe ID of the user.
brandstringYesThe ID of the user's team.
labelstringYesThe type of extension that sent the request.
assetsArray<Asset>YesThe assets to upload to the destination platform.
designIdstringYesThe ID of the user's design. This ID does not change if the user republishes their design.
"assets": [],
"user": "<user>",
"brand": "<brand>",
"label": "<label>",
"designId": "<design_id>"


The response an extension provides when it successfully uploads the published assets to the destination platform.

type"SUCCESS"YesThe type of response.
urlstringNoThe URL of a web page where the user can see their published assets on the destination platform. This must be fewer than 2000 characters.
"type": "SUCCESS"
type"ERROR"YesThe type of response.
errorCodestringYesAn error code that describes what went wrong. Enum: "CONFIGURATION_REQUIRED", "FORBIDDEN", "INTERNAL_ERROR", "INVALID_REQUEST", "NOT_FOUND", "TIMEOUT"
"type": "ERROR",
"errorCode": "<error_code>"

An extension must verify the request signature and timestamp of all incoming requests. When an extension can't verify either of these values, it must reject the request with a 401 status code.


A thumbnail image.

urlstringYesThe URL of the thumbnail. This URL must be HTTPS-enabled and less than 2048 characters.
heightnumberNoThe height of the thumbnail, in pixels. If you provide a height, you must provide a width.
widthnumberNoThe width of the thumbnail, in pixels. If you provide a width, you must provide a height.
"url": "<url>"
namestringYesThe file name of the asset (including the file extension).
typestringYesThe file type of the asset. Enum: "JPG", "PNG", "PDF", "PPTX"
urlstringYesThe URL of the asset.
"name": "<name>",
"type": "<type>",
"url": "<url>"