Can we just change the default email?
Currently managing emails for your users is quite annoying.
Maybe you have tried changing the email of the user using the 'users' API endpoint. However, this will just create a new communication channel (This is how Canvas manages emails) and sets it as unverified. It won't even remove the old email of the user.
So now you will have an old email that still gets notifications and a new email that won't receive anything unless the user goes to their profile and triggers the email validation.
The painful workaround with the current APIs
You cannot update the communication channel so your only option is to create a new one and remove the old one.
Create a new communication channel
If we do this we can (As an admin) skip the validation step so that it is created as a validated email.
Copy the communication channel preferences
Now we must copy over the user's notification preferences from the old communication channel to the new one. The only way to do this is to tell the Canvas API that you are 'acting as' the user but it can be done.
Remove the old communication channel
Finally, we can delete the old communication channel but there is one more consideration to take into mind.
If you have the 'Users can delete their institution-assigned email address' option deselected then any communication channel (email) that was set via a SIS import is locked. Not even an admin can delete the communication channel. The only way to get around this is to do another SIS import to change which email is the locked one.
Not only is this process very complicated just so you can update an email but if you will have to use SIS imports to manage those locked channels.
A better solution
What we need is a simple endpoint that root admins can use.
This endpoint should be able to do the following against an existing communication channel:
- Validate the communication channel (‘unconfirmed’ => ‘active’)
- Change the email address
- Set the ‘lock’ like the SIS import does
Another thing to note. If you do create a user through the API then the 'Users can delete their institution-assigned email address' actually does nothing since the email only gets this 'lock' as part of a SIS import.
