Connect Canva to Lutril
Lutril connects to Canva over SCIM 2.0 and reads every user in the team, including the ones who have been deprovisioned, with their role and their state. A grant provisions an account with no password, for single sign on, and the deadline deprovisions it. Reinstating somebody is NOT automated, deliberately: Canva documents no call that puts a deprovisioned user back, so Lutril refuses rather than reporting access it cannot verify.
Access requested
- The SCIM token is not scope based. It is generated per team and carries whatever SCIM provisioning allows: reading users, creating them, and setting a user inactive.
Setup steps
- 1
Check your plan first, because this is where most Canva connections stop. Canva restricts its SCIM API to Canva Enterprise for a SINGLE team. It is not available for Canva for Teams, and not for a multi team organization. The Connect API is no substitute: its users endpoint returns only the caller, so it cannot enumerate a team at all.
Canva SCIM availability - 2
Open your Canva team settings and go to SSO and provisioning. SCIM hangs off single sign on, so the team needs SAML configured first.
Open Canva team settings - 3
Under SCIM, turn on SCIM user provisioning and copy the access token it generates.
- 4
In Lutril, connect Canva and paste the token.
- 5
Accounts are created without a password. Canva provisions SCIM users for single sign on, so Lutril never generates a password and has nothing to send anyone: the person signs in through your identity provider.
- 6
Canva implements no delete for a SCIM user. The only removal there is sets the user inactive, which is what Lutril does at a deadline, and the account record stays in place.
Deprovisioning a Canva user - 7
Reinstating is where Lutril deliberately stops. Canva documents how to deprovision somebody and nothing about putting them back, and its own error for a soft deleted account says the person has to log in to restore it themselves. So a grant that lands on a deprovisioned account is refused with an explanation rather than reported as granted. Because of that, Canva is excluded from fully unattended provisioning: a human approves, and Lutril still takes the access back on time.
- 8
Canva publishes only two SCIM roles, Member and Brand Designer, and neither is an administrator. There is no privilege ladder for a grant to climb, so Canva access is time boxed on the account rather than on a role.
Where to create it
Official docs
Sign in to Lutril to connect Canva, or book a demo and we set it up with you. No slides.