Which connector?: Canvas by Instructure

Additional details: Support ticket # 400637 outlines that, when Developer Key scopes are enforced, the setup fails regardless of what scopes are selected. This is caused by a literal scope being requested that is not available in the list of enforceable scopes in Canvas key setup (accounts/self/sub-accounts). 

Response from Instructure support:

Hello Chris,

Thanks for following up with those additional details and context regarding your Fivetran connector.

To clarify how Developer Key scope enforcement operates in Canvas:

• Scope Definitions vs. Runtime Aliases: Canvas API scopes are strictly defined by their formal API route pattern, which uses parameterized placeholders (e.g., :account_id). The enforceable scope for this endpoint is /api/v1/accounts/:account_id/sub_accounts. While self works in live requests as a runtime alias representing the current root account ID, it is not a standalone scope key in Canvas.
• Why /self Appears in Other Scope Lists: Endpoints that explicitly display /self in the Canvas Developer Key scope checklist are distinct API routes where self is hardcoded into the route definition itself (such as user-centric endpoints like /api/v1/users/self). These are separate route definitions and are not interchangeable values or generalized aliases across other endpoints.
• Enforcing Scopes for the Integration: Selecting /api/v1/accounts/:account_id/sub_accounts in your Developer Key scope enforcement settings covers API calls made to /api/v1/accounts/self/sub_accounts.

If Fivetran is passing literal endpoint paths in the scopes parameter during the OAuth authorization request rather than the official route scope key, Canvas will reject it because /api/v1/accounts/self/sub_accounts is not a registered scope name. The OAuth request must request the scope matching the parameterized route string (/api/v1/accounts/:account_id/sub_accounts).

---

This is an active revenue blocker for us, as clients are not comfortable allowing all scopes for the integration.