Canvas LMS Export & Backup

Back up the Canvas LMS content you are authorized to access through the official, read-only Canvas REST API. This Actor exports structured records to an Apify dataset, writes a detailed audit manifest to the private key-value store, and can optionally download course files.

Use it to preserve coursework before account closure, back up teaching material, audit a migration, or build an authorized Canvas data pipeline without maintaining your own integration.

What you can export

• Course metadata, term information, and syllabus
• Modules and module items
• Pages and page bodies
• File metadata and optional file bodies
• Assignments, descriptions, and rubrics
• Discussion topics and visible entries or replies
• Announcements
• Classic quizzes and visible questions
• Enrollments
• Submissions, grades, comments, rubric assessments, and submission history

Canvas always applies the permissions of the supplied token. The Actor does not bypass authentication, availability dates, course permissions, or institutional controls.

Quick start

1. In Canvas, open Account → Settings → Approved Integrations → New Access Token.
2. Create a short-lived token with the minimum permissions needed for your archive.
3. Enter your institution's Canvas URL without /api/v1.
4. Add one or more course IDs, or leave the list empty to discover visible courses.
5. Select the resources and run the Actor.

Example:

{
  "canvasBaseUrl": "https://school.instructure.com",
  "apiToken": "YOUR_SCOPED_CANVAS_TOKEN",
  "courseIds": ["12345"],
  "resources": [
    "modules",
    "pages",
    "files",
    "assignments",
    "discussions",
    "announcements",
    "quizzes"
  ],
  "downloadFiles": false,
  "maxCourses": 10
}

For instructor- or administrator-authorized personal data:

{
  "canvasBaseUrl": "https://school.instructure.com",
  "apiToken": "YOUR_SCOPED_CANVAS_TOKEN",
  "courseIds": ["12345"],
  "resources": ["assignments", "enrollments", "submissions"],
  "submissionScope": "all",
  "acknowledgeSensitiveData": true
}

Selecting submissionScope: "all" never grants additional Canvas permissions. It only requests records already visible to the authenticated user.

Results

The default dataset contains:

• one course record per archived course;
• one record per visible module, page, file, assignment, discussion, announcement, quiz, enrollment, or submission;
• one final run-summary record.

The private key-value store contains:

• ARCHIVE_MANIFEST: totals and completion status for every course/resource pair;
• FILE_*: optional binary file bodies when downloadFiles is enabled.

The run can succeed with partial resource errors. For example, a student token may be allowed to read assignments but receive 403 for the course file index. Check ARCHIVE_MANIFEST to distinguish completed, empty, and permission-restricted resources.

Security and privacy

• apiToken is a secret input encrypted by Apify.
• The token is sent only to the configured Canvas origin.
• The token is never written to datasets, manifests, or logs.
• Cross-origin file downloads never receive the Canvas authorization header.
• Signed URL query parameters are removed from structured output by default.
• Literal localhost and private-network targets are rejected.
• File size, course count, record count, concurrency, timeout, and retry limits are configurable.
• Enrollments and submissions require explicit sensitive-data acknowledgment.

Use short-lived, scoped tokens and revoke them after one-off archives. Keep datasets and key-value stores private, use appropriate retention settings, and follow your institution's policy plus applicable privacy law such as LGPD, GDPR, or FERPA.

File downloads

By default, the Actor exports file metadata only. Enable downloadFiles to save authorized file bodies to the run's private key-value store. maxFileSizeMb limits each download and oversized files are reported as skipped in the manifest.

For large institutional archives, prefer customer-owned object storage and short Apify retention periods.

Common questions

Why did a resource return 403 or 404?

Canvas permissions differ by role, course, institution, and resource type. A partial failure normally means that the supplied account cannot access that endpoint. Other authorized resources continue exporting unless failOnResourceError is enabled.

Does this create an .imscc Common Cartridge?

Not yet. Canvas creates Common Cartridge exports through a write operation and an asynchronous export job. This Actor intentionally remains API read-only.

Are New Quizzes included?

Classic quiz questions are exported when visible. New Quizzes use a separate API and are not included in this release.

Can it restore a course?

This release exports and audits data; it does not write back to Canvas.

Current limitations

• LTI tools, externally hosted videos, publisher content, and data hidden from the token cannot be archived.
• File bodies are separate key-value records rather than one ZIP file.
• Runs do not yet checkpoint and resume across platform migrations.
• Institutional Canvas administrators can restrict personal access tokens entirely.

Authorization

Use this Actor only with accounts and data you are authorized to access. You are responsible for institutional approval, retention, sharing, and regulatory compliance.