Canny

PROJECT MANAGEMENT · TASKS

Boards, posts, votes, comments, and changelog entries in the account they connected.

Connecting Canny in practice

Canny takes its secret as a POST body parameter named apiKey rather than a header, so the credential is embedded in the body of every call including reads, and the allowance is set by the customer’s plan: 5 requests per second on Free against 20 on Business.

Scopes that draw scrutiny

apiKey (account-wide secret) Canny has no scopes or per-board keys. The documentation says "This key is secret! Store it on your server and don’t share it", and it reaches the whole company account.

Rate limits

Business: 20 requests per second, 600 per minute, 15,000 per hour.
Core, Starter, Growth and Pro: 10 requests per second, 300 per minute, 5,000 per hour.
Free: 5 requests per second, 100 per minute, 1,000 per hour.
Headers: X-RateLimit-Limit, X-RateLimit-Remaining, X-RateLimit-Reset (seconds since the epoch), plus Retry-After when limited.

Worth knowing

Sending the secret as a POST parameter means it lands in request bodies rather than headers, so body logging and request replay tooling have to be audited, not just header redaction.
Pagination is inconsistent by design: some endpoints are cursor-based and others use skip and limit, so a generic paginator has to be written per endpoint.
The limits are per key and the key is account-wide, so several automations sharing one Canny key share one budget and throttle each other.
Because the tier decides the ceiling, the same integration runs four times slower for a Free customer than a Business one and needs a limit discovered from X-RateLimit-Limit rather than hard-coded.

Checked against Canny API reference (2026-09-29), Canny API rate limits (2026-09-29)

Acts as the person, not as itself

Each user connects their own account. Every call carries both identities — the agent and the person it is acting for — so the agent can never reach past what that individual can already do.

Credentials never touch the agent

Tokens live in the vault and attach server-side at call time. The agent holds a session, not a secret, and revoking access does not mean rotating a key.

Every call on the record

Who asked, which agent acted, which action ran, and the verdict that let it through — one audit trail across every integration, not one per vendor.

What an agent can do

Each action is granted on its own. An agent allowed to read is not thereby allowed to write, and the scope beside each row is what the acting user must have connected for it to run at all.

canny_post_ai_enqueueWRITE

Queues text input for Autopilot, Canny's AI-powered set of tools that detect, extract and deduplicate customer feedback. Requires a Canny account with Autopilot, and SPENDS ONE AUTOPILOT CREDIT PER REQUEST via POST /api/v1/ai/enqueue

api

canny_post_boards_listREAD

Returns a list of all boards associated with your company, in no particular order via POST /api/v1/boards/list

api

canny_post_boards_retrieveREAD

Retrieves the details of an existing board, specified by its id via POST /api/v1/boards/retrieve

api

canny_post_categories_createWRITE

Creates a new category via POST /api/v1/categories/create

api

canny_post_categories_deleteWRITE

Deletes a category If the category does not have sub categories via POST /api/v1/categories/delete

api

canny_post_categories_listREAD

Returns a list of categories. Include parameters to specify board and pagination. Sorted by newest via POST /api/v1/categories/list

api

canny_post_categories_retrieveREAD

Retrieves the details of an existing category, specified by its id via POST /api/v1/categories/retrieve

api

canny_post_comments_createWRITE

Creates a new portal comment. You may also want to use the Create or update user endpoint to make sure the comment author's account exists (and fetch their id) via POST /api/v1/comments/create

api

canny_post_comments_deleteWRITE

Deletes a portal comment via POST /api/v1/comments/delete

api

canny_post_comments_listREAD

Returns a list of portal comments. Include parameters to specify post, board, and pagination. Sorted by newest via POST /api/v2/comments/list

api

canny_post_comments_retrieveREAD

Retrieves the details of an existing portal comment, specified by its id via POST /api/v1/comments/retrieve

api

canny_post_companies_deleteWRITE

Deletes a company via POST /api/v1/companies/delete

api

canny_post_companies_listREAD

Returns a list of all companies associated with your company, ordered by created date via POST /api/v2/companies/list

api

canny_post_companies_updateWRITE

Given a company ID, this endpoint updates the company with the data supplied. If you have company syncing integrations in place (e.g., Hubspot, Salesforce, SSO Tokens, Canny Identify, ...), the fields updated with this endpoint might be overwritten. Companies are CREATED by associating them to a user via Create or update user, not here via POST /api/v1/companies/update. UPDATES ONLY: an unknown id answers 400 "company does not exist". A company is CREATED by naming it in the `companies` argument of Create or update user.

api

canny_post_entries_createWRITE

Creates and (optionally) publishes a new changelog entry via POST /api/v1/entries/create

api

canny_post_entries_listREAD

Returns a list of changelog entries via POST /api/v1/entries/list

api

canny_post_groups_listREAD

Returns a paginated list of groups for your company via POST /api/v1/groups/list

api

canny_post_groups_retrieveREAD

Retrieves the details of an existing group, specified by its id or urlName via POST /api/v1/groups/retrieve. Supply `id` OR `urlName`: with neither, Canny answers 400 "id or urlName is required".

api

canny_post_ideas_deleteWRITE

Deletes an existing idea via POST /api/v1/ideas/delete

api

canny_post_ideas_listREAD

Returns a list of ideas. Include parameters to specify pagination, filtering, and sorting via POST /api/v1/ideas/list

api

canny_post_ideas_mergeWRITE

Merges one idea into another idea via POST /api/v1/ideas/merge

api

canny_post_ideas_retrieveREAD

Retrieves the details of an existing idea, specified by its id or urlName via POST /api/v1/ideas/retrieve. Supply `id` OR `urlName`: with neither, Canny answers 400 "id or urlName is required".

api

canny_post_insights_listREAD

Returns a paginated list of insights for your company via POST /api/v1/insights/list

api

canny_post_insights_retrieveREAD

Retrieves the details of an existing insight. You must specify the insight's unique identifier from Canny via POST /api/v1/insights/retrieve

api

canny_post_opportunities_listREAD

Returns a list of opportunities linked to your Canny posts via POST /api/v1/opportunities/list

api

canny_post_posts_add_tagWRITE

Adds a tag to a post. Both post and tag are specified by their unique id via POST /api/v1/posts/add_tag

api

canny_post_posts_change_boardWRITE

Moves a post to another board via POST /api/v1/posts/change_board

api

canny_post_posts_change_categoryWRITE

Changes a post's category specified by its id via POST /api/v1/posts/change_category

api

canny_post_posts_change_statusWRITE

Changes a post's status (eg. to 'planned'), specified by its id via POST /api/v1/posts/change_status

api

canny_post_posts_createWRITE

Creates a new post. You may also want to use the Create or update user endpoint to make sure the post author's account exists (and fetch their id) via POST /api/v1/posts/create

api

canny_post_posts_deleteWRITE

Deletes an existing post via POST /api/v1/posts/delete

api

canny_post_posts_link_jiraWRITE

Links a Jira issue to a Canny post. Requires the Jira integration to be installed and configured via POST /api/v1/posts/link_jira. PLAN-GATED: this Canny account answers 400 "plan does not support" (measured 2026-09-18). It needs a Canny plan with the Jira integration.

api

canny_post_posts_listREAD

Returns a list of posts. Include parameters to specify board, pagination, filtering, and sorting via POST /api/v1/posts/list

api

canny_post_posts_mergeWRITE

Merges one post into another post via POST /api/v1/posts/merge

api

canny_post_posts_remove_tagWRITE

Removes a tag from a post. Both post and tag are specified by their unique id via POST /api/v1/posts/remove_tag

api

canny_post_posts_retrieveREAD

Retrieves the details of an existing post, specified by its id or urlName via POST /api/v1/posts/retrieve. Supply EXACTLY ONE of `id` or `urlName` (and `boardID` alongside `urlName`): with neither, Canny answers 400 "exactly one of \"id\" and \"urlName\" must supplied".

api

canny_post_posts_unlink_jiraWRITE

Unlinks a Jira issue from a Canny post. Requires the Jira integration to be installed and configured via POST /api/v1/posts/unlink_jira. PLAN-GATED: this Canny account answers 400 "plan does not support" (measured 2026-09-18). It needs a Canny plan with the Jira integration.

api

canny_post_posts_updateWRITE

Updates an existing post via POST /api/v1/posts/update

api

canny_post_status_changes_listREAD

Returns a list of status changes. Include parameters to specify board and pagination. Sorted by newest via POST /api/v2/status_changes/list

api

canny_post_tags_createWRITE

Creates a new tag via POST /api/v1/tags/create

api

canny_post_tags_listREAD

Returns a list of tags. Include parameters to specify board and pagination. Sorted by newest via POST /api/v1/tags/list

api

canny_post_tags_retrieveREAD

Retrieves the details of an existing tag, specified by its id via POST /api/v1/tags/retrieve

api

canny_post_users_create_or_updateWRITE

If the user does not exist, one is created, and its id is returned. If the user does exist, they will be updated with the data supplied. Why is this endpoint useful? If you're going to use an object creation API endpoint (such as create post), you may have to create the author's account before creating the post. Note: the email, name and avatarURL properties of admin users cannot be modified through the Canny API. A Canny admin will need to login to Canny to update this information manually. Note: one of email, userID or id must be provided to update a user via POST /api/v1/users/create_or_update. As well as `name`, supply ONE of `userID`, `id` or `email` to identify the user: with none, Canny answers 400 "userID, id or email must be provided".

api

canny_post_users_deleteWRITE

Deletes a user. Also deletes all of their comments and votes. If their posts have other comments/votes, then they'll be removed as an author. If there are no other comments/votes, the post will be removed via POST /api/v1/users/delete

api

canny_post_users_listREAD

List the end-users within your workspace via POST /api/v2/users/list

api

canny_post_users_remove_user_from_companyWRITE

Removes the user from a company that they were previously associated with. Why is this endpoint useful? If a user of your application has moved from one organization to another or if a user is no longer a part of an organization. Please note that removing a user from a company will result in their votes no longer being associated with the company's spend via POST /api/v1/users/remove_user_from_company

api

canny_post_users_retrieveREAD

Retrieves the details of an existing user. You must specify exactly one of: their Canny id, their id in your application, or their email. These fields are all unique per user. You can only retrieve them based on their id in your application if the user was authenticated via single sign-on or created via API via POST /api/v1/users/retrieve. Supply ONE of `id`, `userID` or `email`: with none, Canny answers 400 "no identifier specified".

api

canny_post_votes_createWRITE

Creates a new vote. You may also want to use the Create or update user endpoint to make sure the voter's account exists (and fetch their id) via POST /api/v1/votes/create

api

canny_post_votes_deleteWRITE

Deletes a vote via POST /api/v1/votes/delete

api

canny_post_votes_listREAD

Returns a list of votes. Include parameters to specify post, board, and pagination. Sorted by newest via POST /api/v2/votes/list

api

canny_post_votes_retrieveREAD

Retrieves the details of an existing vote, specified by its id via POST /api/v1/votes/retrieve

api