To improve consistency, observability, and security across Instructure developer platforms, we are announcing two upcoming API changes.
Per the Instructure API policy, both changes will take effect 90 days after this announcement, at 2026-07-13.
These updates affect:
- Canvas Live Events
- Data Access Platform (DAP) Query API
Please review the changes below and update your integrations if necessary.
1. Canvas Live Events: Content-Type change for JWT-signed eventsWhen Canvas Live Events are configured to use JWT signing for HTTP delivery, the Content-Type header will change.
Current behavior
Content-Type: application/json
New behavior (when JWT signing is enabled)
Content-Type: application/jwt
This change reflects the actual payload format when JWT signing is enabled.
Why this change?
When JWT signing is used, the payload is no longer a plain JSON body but a JWT token containing the event data. Updating the header makes the response type accurate and easier for receiving systems to process correctly.
What you may need to change
If your system validates or routes events based on the Content-Type header, ensure it supports:
application/jwt
The event payload and JWT structure themselves are not changing.
Documentation: Canvas Live Events setup
2. User-Agent header requirement expanding to additional APIsIn September 2025 we announced enforcement of the User-Agent header for Canvas API requests.
We are now extending this requirement to additional developer-facing APIs.
The following APIs will require a valid User-Agent header:
Documentation:
Exception:
If you are a DAP CLI or DAP Client Library user then you are covered by the User Agent requirement because they already send User Agent headers.
What happens if a User-Agent header is missing?
Requests that do not include a valid User-Agent header will receive a 403 response.
Example:
HTTP 403
{
"error": "Forbidden",
"message": "You are not authorized to access this site because you have not provided a valid user agent."
}
Why we require User-Agent headers
User-Agent headers help us:
- Identify and troubleshoot problematic integrations
- Contact developers if an integration causes service issues
- Improve platform observability and reliability
- Maintain fair and stable platform usage
Recommended format
We recommend using a descriptive format such as:
User-Agent: MyApp/1.2 (company-name; support@company.com)
TimelineThese changes will go into effect 90 days after this announcement, in accordance with the Instructure API policy.
After the enforcement date:
- Live Events with JWT signing will return Content-Type: application/jwt
- DAP APIs will require a User-Agent header
What you should do nowDevelopers should:
- Ensure their Live Events receivers support application/jwt
- Add a valid User-Agent header to all API requests if they are missing
- Verify automated jobs, SDKs, and scripts include this header
Questions or feedbackIf you have questions, please reach out in the developer community or contact the Instructure developer relations team.
