API tokens are essentially access credentials and should be considered as sensitive information. This means that they should be stored in a secure manner (see Technology Services – Protecting Confidential Information).

Sharing this token with other individuals or third-party vendors will provide access to Canvas course data which can create security risks and may not be in compliance with Standard Administrative Procedure 29.01.03.M0.02 Information Resources – Acceptable Use. Any existing access with third-party vendors should be deleted immediately and any external integrations should adhere to the university’s third-party tool request process within Canvas.

Some potential security and privacy concerns include:

- Protected data such as educational records (ex: student grades protected by the Family and Educational Rights Privacy Act (FERPA))
- Intellectual property and content scraping/curation (ex: any course content or activities created by an instructor of record; third-parties curating course artifacts in bad faith for extortion/blackmail)
- Academic integrity/honor violations (ex: course content being copied by an artificial intelligence (AI) bot to share with students outside of the course or the development of AI tutoring systems)

The teams that support Texas A&M University’s Digital Learning Environment:

- Maintain the API request portal
- Evaluate all requests to ensure compliance with guidelines and policies
- Review all current tokens between each long semester
- Terminate any tokens that are out of compliance
- Do not provide API coding/development support.

1. Submit a ticket through the TeamDynamix Service Catalog to Teaching and Learning – Learning Management – LMS Administrative.
2. Select LMS API Request under Type of Help.
3. Fill out all required information in the form
   1. Purpose
      1. Please provide clear, detailed information to facilitate the evaluation process that covers all expected usage including any specific scopes and what types of data will be accessed/written.
   2. Risk Mitigation
      1. How will tokens be securely stored?
      2. How will sensitive data be protected in transit and rest?
         1. Note: External data stores are not permissible.
   3. Review and acknowledge TAMU AI Regulation 29.01.05
   4. Pick a timeline for access (up to six months; renewable)
   5. Complete attestation to not connect Canvas with external vendors. Note: users will be held accountable for use and state law.
   6. Description is available for any additional context or information pertaining to the request.
4. Submit the request form

5. Canvas administrators will review the ticket and follow up with any questions through the ticketing system.
6. Following review, Canvas administrators will communicate the status:

1. If approved, the Office for Learning Technology Services will create the token and communicate next steps.
2. If not approved, the Center for Teaching Excellence will provide a rationale.