Canva Incident Response
Overview
Contain impact before debugging deeply. Distinguish provider status, application release/config, tenant authorization, endpoint throttling, async-job backlog, and preview drift.
Prerequisites
- Incident ID, severity policy, affected operations, and UTC window
- Current deployment/config revisions and last known good
- Approved test user, rollback owner, and communications channel
Instructions
Step 1: Declare and bound
Record start time, reporter, user-visible symptom, affected tenants/operations, suspected data exposure, and current severity without copying customer content.
Step 2: Contain
Pause only unsafe mutations, refresh races, or affected queues. Preserve existing job identity and keep safe read-only paths available when policy permits.
Step 3: Check broad signals
Use Read and Grep to compare deployment/config changes, error/status trends, queue age, authorization failures, and Canva's official status/changelog.
Step 4: Run a minimal probe
Use an approved test user for one non-mutating endpoint. Never infer global provider health from a single production user.
Step 5: Mitigate and reconcile
Roll back the responsible release/config, reduce endpoint concurrency, disable a changed preview path, or reauthorize only affected users based on evidence. Reconcile queued jobs before resuming.
Step 6: Close with proof
Use Write or Edit to record timeline, decisions, impact, data assessment, recovery evidence, remaining jobs, rollback result, and preventive owner.
Authentication
Canva Connect calls use Bearer access tokens obtained by a backend through OAuth 2.0 Authorization Code with SHA-256 PKCE. Request explicit least-privilege scopes, keep client secrets and tokens out of browser-visible state, and serialize refresh so the replacement single-use refresh token is stored atomically.
Tool Discipline
Use Read and Grep for discovery and evidence. Use Write or Edit only for the approved artifact, code, configuration, test, or receipt described by this workflow; do not make an unapproved Canva-side change.
Output
- Scoped decision or implementation artifact
- Redacted operation and validation receipt
- Failure, rollback, and follow-up ownership record
Examples
After a release, one tenant sees export failures while other reads succeed. The operator pauses that tenant's export queue, rolls back the adapter, reconciles existing jobs, and avoids declaring a Canva-wide outage.
Error Handling
| Failure | Response |
|---|---|
| Provider and app evidence conflict | Keep both hypotheses open and collect another independent signal |
| Potential credential exposure | Contain and rotate through the credential owner immediately |
| Queued writes are ambiguous | Do not resume until each operation is reconciled |
| Rollback does not recover | Escalate with the redacted failure bundle |