Canvas Access

Canvas access requires both of these conditions:

• The caller is an admin of the Space.
• Canvas is enabled for the Space. See How to Check Whether Canvas Is Available in a Space.

If either condition is not met, Canvas behaves as if it does not exist. Running Flows from a Canvas has one more condition; see Canvas Flow Literal Runs.

Disabled Canvas

When Canvas is not enabled for a Space, Canvas requests return NOT_FOUND with no message. The response is never FORBIDDEN, so a disabled Canvas looks the same as a Canvas that does not exist.

Authorization

Every Canvas operation requires:

1. A signed-in Ligantic user. Without one, the request returns UNAUTHORIZED.
2. Canvas enabled for the Space. Otherwise, the request returns NOT_FOUND.
3. The Space admin role. Listing and creating Canvases check this role: Space members without it get FORBIDDEN, and callers outside the Space get NOT_FOUND. Operations on a specific Canvas or version check this role: every denial is the same NOT_FOUND as a Canvas that does not exist.

Non-admin callers cannot list Canvases, read a Canvas, read a historical version, mutate a Canvas, or act on review candidates.

Canvas Pages

Canvas pages and the Canvas upload endpoint return 404 Not found to callers who are not Space admins, or when Canvas is not enabled for the Space.

Space Home Redirect

For a Space admin in a Space where Canvas is enabled, opening the Space (/spaces/:spaceId) redirects to a Canvas. The Canvas is chosen in this order:

1. The Canvas you last opened in that Space, if it is still active.
2. The Space's pinned Canvas.
3. The most recently updated active Canvas, using the creation time when a Canvas has no update time.

If the Space has no active Canvas, no redirect occurs.

Opening a Canvas records it as your selection for that Space.

Space Export and Import

Canvas data survives a Space export and import whether or not Canvas is enabled for the source or destination Space. See Canvas Space Transfer.