For Canvas administrators
What it reads, and what it cannot do
Waypoint is a read-only application that shows a student their own Canvas workload: what is due, what each piece is worth as a share of the final grade, which graded discussions they have not posted in, and what their marker wrote. It is asking for an OAuth2 developer key so students can sign in with their existing credentials.
The request reduces risk rather than adding it
The alternative is not “nothing”. It is what any student can already do today, with any tool, without asking anyone: generate a personal access token and paste it into a third-party application.
A personal access token
- Carries the student’s full permissions, including write
- Can submit, reply to, and delete work
- Does not expire unless the student revokes it
- Invisible to you — you cannot see who holds one
A developer key
- Read-only scopes, listed in full below
- No write capability of any kind
- Refresh tokens you can revoke centrally
- Visible in your admin console, per application
Every scope it requests
All 12 are GET. This table is generated from the list the application actually sends, so it cannot describe a permission the software does not ask for, or omit one it does.
| Scope | What it is for |
|---|---|
| url:GET|/api/v1/users/self/profile | Your name, so the page can address you. |
| url:GET|/api/v1/courses | Which courses you are enrolled in. |
| url:GET|/api/v1/courses/:course_id/assignments | What is set, when it is due, and what it is graded on. |
| url:GET|/api/v1/courses/:course_id/assignment_groups | Category weights, so a mark can be turned into a share of the final grade. |
| url:GET|/api/v1/courses/:course_id/discussion_topics | Which discussions are running and when they were last active. |
| url:GET|/api/v1/courses/:course_id/discussion_topics/:topic_id/view | Who has posted in a graded discussion, and who has not. |
| url:GET|/api/v1/courses/:course_id/students/submissions | Your own marks, your marker's comments, and the filled-in rubric. |
| url:GET|/api/v1/courses/:course_id/users | The name of the person teaching the course. |
| url:GET|/api/v1/users/self/groups | Which project groups you are in. |
| url:GET|/api/v1/groups/:group_id/users | Who else is in them. |
| url:GET|/api/v1/users/self/communication_channels | Which Canvas notifications reach you, to tell you which are delayed. |
| url:GET|/api/v1/users/self/communication_channels/:communication_channel_id/notification_preferences | The frequency set on each one. Read only when the student presses a button. |
What it cannot do
- Submit an assignmentThere is no POST anywhere in the Canvas client.
- Post or reply to a discussionSame. The capability was never written.
- Change a grade or a due dateNo write scope is requested, and no write code exists.
- Read another student's grades or submissionsThe submissions endpoint is called with student_ids[]=self and nothing else.
- Reach anything account-levelNo admin scopes, no SIS access, no reporting endpoints.
What it sees of other students
Two things, both already visible to that student inside Canvas, and neither stored.
- Posts in a graded discussionRead to show who has contributed and who has not, which is the point of a participation grade. The same thread is readable by the whole class in Canvas.
- Names and avatars of groupmatesThe roster of a group the student is already a member of. No grades, no submissions, no contact details beyond what Canvas shows them.
What is stored
Coursework, assignment text, discussion posts and grades are read to compute what appears on the student’s screen and are not written down. The full policy is on the privacy page.
- Canvas user id and display nameTo recognise a returning student.
- The institution's Canvas hostnameTo know which Canvas to talk to.
- Email addressOnly if Canvas shares it, and only for notifications the student switches on.
- Notification preferences and time zoneSettings the student chooses.
- Refresh tokenEncrypted at rest. Access tokens are used and discarded.
- Group messages, tasks and filesCreated inside Waypoint by students. These do not exist in Canvas.
Talking to us
A licence covers every student at the institution and is billed once. If you administer Canvas at a university and want the redirect URI, the client requirements, or a call, get in touch.
Waypoint is not affiliated with Instructure or Canvas.