What specific Canva validation rules trigger generic HTTP 400 errors in App deployment logs?

After a Canva App manifest passes syntax validation, generic HTTP 400 errors in deployment logs typically originate from runtime payload or permission checks rather than syntax issues.

Likely validation rules triggering the error:

• Payload size exceeding undisclosed platform limits <unknown limit>
• Content‑type header mismatch (e.g., missing application/json or multipart/form-data)
• Sandbox or permission rule mismatches (invalid, missing, or outdated grant configurations)
• App bundle structure issues (invalid entry‑point file, missing required assets)

Confirmed facts (from public documentation and platform behavior):

Canva’s public error‑code reference lists manifest‑level codes but omits many runtime exception strings, leaving developers to infer causes from free‑form messages. Error texts in deployment logs are not mapped to sub‑codes or internal identifiers, and validation rules may change between platform updates.

Verification steps (minimal, scoped):

1. Compare the deployment payload size and Content-Type header against Canva’s API specification if available.
2. Inspect the app manifest for schema compliance; remove or correct fields not permitted in the current platform version.
3. Re‑attempt deployment with a minimal manifest to isolate whether the error persists, indicating a runtime versus syntax issue.

If you can share the exact log snippet, deployment payload size, or the specific manifest fields recently modified, I can narrow the cause further.