---

name: canva-debug-bundle description: 'Assemble a minimal Canva Connect diagnostic bundle without credentials, customer content, raw payloads, or full headers. Use when preparing an incident handoff or provider escalation. Trigger with: "Canva debug bundle", "collect Canva evidence", "sanitize Canva diagnostics".' allowed-tools: Read, Grep, Write, Edit version: 2.0.0 argument-hint: '[incident-id-and-approved-output-path]' model: inherit effort: high license: MIT author: Jeremy Longshore jeremy@intentsolutions.io tags:

• saas
• canva
• debugging
• operations compatibility: 'Collection requires an incident ID, approved evidence destination, retention period, and reviewer.'

---

Canva Redacted Debug Bundle

Overview

Prefer references and classifications over raw data. The bundle should prove configuration and failure state while remaining safe to share with authorized responders.

Prerequisites

• Incident ID, UTC window, affected endpoint pattern, and deployment revision
• Approved evidence path, reviewer, retention, and deletion time
• Redaction denylist and current data-classification policy

Instructions

Step 1: Freeze a manifest

List each proposed artifact, purpose, source, classification, redaction rule, owner, and retention before collecting it.

Step 2: Collect local versions

Use Read and Grep to capture application/runtime version, pinned OpenAPI checksum, deployment/config revision, and feature flags without environment values.

Step 3: Collect failure envelopes

Record aggregate status/provider-code counts, endpoint patterns, opaque request/job references, and sanitized timestamps. Do not collect bodies or user/resource IDs.

Step 4: Add bounded connectivity evidence

If authorized, record DNS/TLS outcome and one non-mutating test-user status check. Exclude Authorization and response headers beyond an explicit safe allowlist.

Step 5: Review before packaging

Use Write or Edit to build the manifest and summary, scan for credential formats, URLs, personal data, and design content, then require a second-person review.

Step 6: Seal and expire

Hash the reviewed files, record access controls and deletion time, transfer through the approved channel, and verify deletion after closure.

Authentication

Canva Connect calls use Bearer access tokens obtained by a backend through OAuth 2.0 Authorization Code with SHA-256 PKCE. Request explicit least-privilege scopes, keep client secrets and tokens out of browser-visible state, and serialize refresh so the replacement single-use refresh token is stored atomically.

Tool Discipline

Use Read and Grep for discovery and evidence. Use Write or Edit only for the approved artifact, code, configuration, test, or receipt described by this workflow; do not make an unapproved Canva-side change.

Output

• Scoped decision or implementation artifact
• Redacted operation and validation receipt
• Failure, rollback, and follow-up ownership record

Examples

A support bundle contains the release SHA, OpenAPI checksum, endpoint/status histogram, opaque export job reference, and sanitized timeline—never the export body, URL, token, or profile.

Error Handling

Failure	Response
Artifact purpose is unclear	Exclude it from the bundle
Redaction cannot be proven	Do not package or share the file
Live probe needs broader scope	Skip it and document the evidence gap
Bundle retention expires	Delete it and record the disposal receipt

Resources

• First-party source notes
• Connect security
• Error responses