Visibility of files on Canvas are controlled by two booleans: locked and hidden like so:
Both set to false - published.
locked == true && hidden == false - unpublished
locked == false && hidden == true - restricted
If you set both to true via an API call the system seems to auto-resolve to locked==false && hidden==true, however, it can seemingly become unsynced from what you'll see from the Canvas website. As in I can see the file in Canvas as unpublished when a GET call will say it should be restricted.
Is anyone aware of this problem and why it behaves this way?