---

name: canva-advanced-troubleshooting description: 'Isolate difficult Canva Connect failures without rotating credentials, replaying writes, or leaking customer data. Use when investigating intermittent transport, OAuth, async-job, capability, or preview-feature failures. Trigger with: "deep debug Canva", "Canva intermittent failure", "prepare Canva support evidence".' allowed-tools: Read, Grep, Write, Edit version: 2.0.0 argument-hint: '[incident-id-or-failure-symptoms]' model: inherit effort: high license: MIT author: Jeremy Longshore jeremy@intentsolutions.io tags:

• saas
• canva
• troubleshooting
• operations compatibility: 'Live probes require an approved test user, least-privilege token, and incident-scoped authorization.'

---

Canva Advanced Failure Isolation

Overview

Separate application, authorization, provider-contract, asynchronous-job, and network evidence before choosing a recovery action. Preserve the original operation identity and collect only redacted facts.

Prerequisites

• Incident identifier, first-observed time, and affected operation
• Current integration configuration and pinned OpenAPI version
• Approved synthetic reproduction user and evidence destination

Instructions

Step 1: Freeze the failing operation

Record method, endpoint pattern, environment, opaque operation or job identifier, expected terminal state, and last known good release. Do not copy raw payloads or URLs.

Step 2: Inspect local evidence

Use Read and Grep to compare sanitized logs, deployment/config revisions, token metadata timestamps, scope policy, and the pinned response schema.

Step 3: Classify the boundary

Distinguish transport failure, HTTP/provider error, OAuth expiry or revocation, missing explicit scope, unavailable capability, preview drift, and an asynchronous job still in progress.

Step 4: Reproduce read-only

Use a dedicated test user for the smallest non-mutating check. Never refresh a token merely to diagnose unless the credential owner authorizes rotation and atomic storage is available.

Step 5: Reconcile before retry

Query the existing job or resource where the contract permits. Do not recreate a design, export, upload, or autofill job until duplicate impact and idempotency are resolved.

Step 6: Escalate with a safe receipt

Provide Canva support only the integration ID, UTC window, endpoint pattern, redacted error code, opaque request/job reference, contract version, and bounded reproduction result.

Authentication

Canva Connect calls use Bearer access tokens obtained by a backend through OAuth 2.0 Authorization Code with SHA-256 PKCE. Request explicit least-privilege scopes, keep client secrets and tokens out of browser-visible state, and serialize refresh so the replacement single-use refresh token is stored atomically.

Tool Discipline

Use Read and Grep for discovery and evidence. Use Write or Edit only for the approved artifact, code, configuration, test, or receipt described by this workflow; do not make an unapproved Canva-side change.

Output

• Scoped decision or implementation artifact
• Redacted operation and validation receipt
• Failure, rollback, and follow-up ownership record

Examples

A production export intermittently remains in progress. The operator correlates the same job ID with deployment and provider evidence, pauses new submissions, and escalates without attaching the design or token.

Error Handling

Failure	Response
No stable operation ID	Stop mutation and recover the application ledger first
OAuth state unclear	Route to the credential owner; do not test by printing or exchanging secrets
Preview contract changed	Disable the preview path and compare current first-party docs
Support asks for sensitive data	Redact or decline and provide opaque references instead

Resources

• First-party source notes
• Error responses
• API request model