API Reference

All routes are under /api/cursor-canvas. Ownership is the current session user (including anonymous users, cookie sessionId). This browser can list, update, and delete its own records.

POST /api/cursor-canvas

Store source and return a short share URL.

Request:

{
  "source": "import { H1 } from \"cursor/canvas\";\nexport default function App() { return <H1>Hi</H1>; }",
  "title": "Optional",
  "access": "public",
  "password": "optional-when-access-is-password",
  "expiresAt": "2026-12-31T23:59:59.000Z"
}

Response:

{
  "canvasId": "cv_a1b2c3d4e5f6",
  "shareUrl": "https://example.com/cursor-canvas/cv_a1b2c3d4e5f6",
  "title": "Optional",
  "sourceMd5": "5d41402abc4b2a76b9719d911017c592",
  "reused": false,
  "createdAt": "2026-08-31T08:00:00.000Z",
  "access": "public",
  "hasPassword": false,
  "expiresAt": null
}

reused is true when this owner already published the same MD5. Access, password, and expiry on that request replace the previous settings.

GET /api/cursor-canvas/:canvasId

Load source for a share page. Query password when the link is protected. The author session skips the password and can still open expired links.

{
  "canvasId": "cv_a1b2c3d4e5f6",
  "title": "Optional",
  "source": "import { H1 } from \"cursor/canvas\";\nexport default function App() { return <H1>Hi</H1>; }",
  "viewCount": 3,
  "createdAt": "2026-08-31T08:00:00.000Z",
  "access": "public",
  "requiresPassword": false,
  "canOpenEditor": true,
  "expiresAt": null
}

• canOpenEditor is true only for the author. The share page uses this to show Open editor.
• requiresPassword is true and source is empty until the correct password is sent.
• Expired public viewers receive 410. Wrong password receives 401.

PATCH /api/cursor-canvas/:canvasId

Update source and share options for a canvas owned by the current session user. Open editor loads this canvas into the editor; saving calls this endpoint so the same short link (canvasId) stays valid.

Request body matches POST, except password is optional: omit it to keep the current password when access is password. Switching to public clears the password. Missing session user returns 401. A non-owner returns 403.

GET /api/cursor-canvas/mine

List canvases bound to the current session user. Returns [] when there is no session user.

DELETE /api/cursor-canvas/:canvasId

Delete a canvas created by the current session user. Returns 204. Requires a session user; otherwise 401.

Example canvas for source

import { H1, Stack, Text } from "cursor/canvas";

export default function Hello() {
  return (
    <Stack gap={12}>
      <H1>Hello, Canvas</H1>
      <Text tone="secondary">
        Live preview rendered in the browser from cursor/canvas.
      </Text>
    </Stack>
  );
}