Building Canvas courses via the API

Canvas has no "create a whole course" endpoint. A course is assembled from a dozen independent resources, each with its own publish state, and the API will happily let you build something that looks complete in the admin view and is entirely invisible to students. Most of the difficulty in this task is ordering, publish state, and idempotency — not the individual HTTP calls.

Before touching the API

Three things to establish first, because getting them wrong is expensive:

1. Which instance and whose token. Read CANVAS_API_URL (e.g. https://school.instructure.com) and CANVAS_API_TOKEN from the environment. Never put a token in a file you write, in a command line that lands in shell history, or in anything you show back to the user. If they paste a token into the conversation, use it from an env var you set and mention that they should rotate it afterwards.