Everything an AI agent can do with the Figma API.

A reference guide for building AI agents: every method, how to authenticate, and the permissions each one needs.

Endpoints28
AuthenticationToken / OAuth 2.0
Last updated23 June 2026
Orientation

How the Figma API works.

The Figma API is how an app or AI agent works with a Figma workspace: reading a file's design and nodes, rendering nodes as images, posting and reading comments, and listing the projects, components, and styles a team has published. Access is granted through a personal access token or an OAuth 2.0 grant carrying granular scopes, each naming an area and whether a call can read or write, and an agent is limited to the files and teams that token can reach. Figma can also push events to a receiver when a file changes, a version is saved, or a comment is posted.

28Endpoints
9Capability groups
18Read
10Write
15Permissions
Authentication
Figma authenticates a call two ways. A personal access token, generated by a user and sent in the X-Figma-Token header, acts as that user and since April 2025 expires in at most 90 days. OAuth 2.0 uses the authorization-code flow so an app acts on behalf of a user who grants a chosen set of scopes, with the access token sent as a bearer token. Plan access tokens, also sent in X-Figma-Token, cover organization-level calls.
Permissions
OAuth access is granted as granular scopes, each naming an area and a level, like file_content:read for a file's contents, file_comments:write to post and delete comments, file_versions:read for version history, library_content:read for published components and styles, file_dev_resources:write for dev resource links, file_variables:read and write for Enterprise variables, and webhooks:write to manage webhooks. The older files:read scope is deprecated in favor of these narrower ones, and a 403 means the token lacks the scope the call needs.
Versioning
The REST API has no dated version to pin and no version header to send; it is a single, continuously updated surface. Notable changes ship through dated release notes, and an open OpenAPI specification in the figma/rest-api-spec repository describes the whole API and is kept current. Webhooks are the one part with a version in the path, the v2 namespace.
Data model
The API is resource-oriented JSON over HTTPS at https://api.figma.com. A file is identified by a file key from its URL, and its contents are a tree of nodes that the file and node endpoints return. Around files sit comments, version history, projects and teams, published components, component sets, and styles, variables on Enterprise, and dev resource links. The image endpoints render nodes or return image fills as download URLs. Webhooks push events instead of polling.
Connect & authenticate

Connection & authentication methods.

How an app or AI agent connects to Figma determines what it can reach. There is a route for reading and writing through the REST API, a route for receiving events, and a hosted server that exposes Figma tools to agents, and each is governed by the token behind it and the permissions that token carries.

Ways to connect

REST API

The REST API answers at https://api.figma.com and returns JSON. A call authenticates with a personal or plan access token in the X-Figma-Token header, or with an OAuth 2.0 bearer token. Figma for Government uses a separate host at https://api.figma-gov.com.

Best forConnecting an app or AI agent to Figma.
Governed byThe token and the permissions it carries.
Docs ↗

Webhooks (v2)

Figma POSTs an event to a receiver URL when a chosen event happens on a file, project, or team. The passcode set when the webhook is created is included so the receiver can confirm the request came from Figma. Events include FILE_UPDATE, FILE_VERSION_UPDATE, FILE_DELETE, FILE_COMMENT, LIBRARY_PUBLISH, and DEV_MODE_STATUS_UPDATE.

Best forReceiving Figma events at an app or AI agent.
Governed byThe webhooks:write scope to create, and the passcode on each delivery.
Docs ↗

Dev Mode MCP server

Figma's first-party remote Model Context Protocol server at https://mcp.figma.com/mcp lets an agent pull design context, like variables, components, and layout, and generate code from selected frames, and it can create and modify Figma content. It authenticates through Figma's OAuth flow. The write-to-canvas capability is in beta.

Best forConnecting an AI coding agent to Figma through MCP.
Governed byThe OAuth grant and the permissions it carries.
Docs ↗
Authentication

Personal access token

A personal access token acts as the user who created it and is sent in the X-Figma-Token header. Scopes are chosen when the token is generated. Since April 2025 a personal access token can be set to expire in at most 90 days.

TokenPersonal access token (X-Figma-Token header)
Best forServer-side scripts and single-user integrations.
Docs ↗

OAuth 2.0

OAuth 2.0 uses the authorization-code flow so an app acts on behalf of a user who grants a chosen set of scopes. The access token is sent as a bearer token, and a refresh token keeps it current. This is the route for an app that connects on behalf of many users.

TokenOAuth 2.0 access token (Bearer)
Best forMulti-user apps acting on behalf of users.
Docs ↗
Capability map

What an AI agent can do in Figma.

The Figma API is split into areas an agent can act on, like file contents, rendered images, comments, projects, published components and styles, and variables. Each area has its own methods and its own permission, and some reach far more than others.

Files & images

5 endpoints

Read a file's full JSON, read specific nodes, render nodes as images, get download links for image fills, and read file metadata.

File contents include the full design, its text, and its structure.
View endpoints

Comments

6 endpoints

List comments on a file, post a new comment, delete a comment, and add or remove reactions.

Writes here post or remove real comments visible to collaborators.
View endpoints

Version history

1 endpoint

List the saved versions in a file's history.

Reads here return the named version history of a file.
View endpoints

Projects & teams

2 endpoints

List the projects in a team and the files in a project.

Reads here enumerate the files a team and project contain.
View endpoints

Components & styles

4 endpoints

Read published components, component sets, and styles by team, by file, or by key.

Reads here return published design-system assets.
View endpoints

Users

1 endpoint

Read the profile of the authenticated user.

Reads here return the calling user's name, email, and profile image.
View endpoints

Webhooks

4 endpoints

List, read, create, update, and delete webhooks that deliver file and project events.

Writes here change where Figma sends event notifications.
View endpoints

Variables

2 endpoints

Read local and published variables, and create, update, or delete variables and collections. Enterprise only.

Writes here change the variables a design system depends on.
View endpoints

Dev resources

3 endpoints

Read the dev resources linked to a file, and add, update, or remove them.

Writes here change the links attached to nodes for developers.
View endpoints
Endpoint reference

Every Figma API method.

Filter by method, access, or permission, or search any path. Select a row for version detail, rate limits, the related webhook event, and the source.

MethodEndpointWhat it doesAccessPermissionVersion

Files & images

Read a file's full JSON, read specific nodes, render nodes as images, get download links for image fills, and read file metadata.5

A Tier 1 endpoint. The deprecated files:read scope also satisfies it. The depth and ids parameters keep the response small.

Acts onfile
Permission (capability)file_content:read
VersionAvailable since the API’s base version
Webhook eventNone
Rate limitStandard limits apply

A Tier 1 endpoint. Reads only the requested nodes rather than the whole document.

Acts onfile
Permission (capability)file_content:read
VersionAvailable since the API’s base version
Webhook eventNone
Rate limitStandard limits apply

A Tier 1 endpoint. Output format and scale are set by query parameters; large renders can time out with a 500.

Acts onimage
Permission (capability)file_content:read
VersionAvailable since the API’s base version
Webhook eventNone
Rate limitStandard limits apply

Returns the original uploaded images, not rendered nodes. Uses the file_metadata:read scope.

Acts onimage fill
Permission (capability)file_metadata:read
VersionAvailable since the API’s base version
Webhook eventNone
Rate limitStandard limits apply

Added in April 2025. Returns metadata only, so it does not need file_content:read.

Acts onfile
Permission (capability)file_metadata:read
VersionIntroduced 2025-04-29
Webhook eventNone
Rate limitStandard limits apply

Comments

List comments on a file, post a new comment, delete a comment, and add or remove reactions.6

The as_md parameter returns comment bodies as markdown. The deprecated files:read scope also satisfies it.

Acts oncomment
Permission (capability)file_comments:read
VersionAvailable since the API’s base version
Webhook eventNone
Rate limitStandard limits apply

A write that posts a comment visible to collaborators. Fires the FILE_COMMENT webhook event.

Acts oncomment
Permission (capability)file_comments:write
VersionAvailable since the API’s base version
Webhook eventfile_comment
Rate limitStandard limits apply

Only the comment's author can delete it.

Acts oncomment
Permission (capability)file_comments:write
VersionAvailable since the API’s base version
Webhook eventNone
Rate limitStandard limits apply

Cursor-paginated through the cursor query parameter.

Acts onreaction
Permission (capability)file_comments:read
VersionAvailable since the API’s base version
Webhook eventNone
Rate limitStandard limits apply

The emoji is given as a shortcode in the request body.

Acts onreaction
Permission (capability)file_comments:write
VersionAvailable since the API’s base version
Webhook eventNone
Rate limitStandard limits apply

The emoji to remove is given in the emoji query parameter.

Acts onreaction
Permission (capability)file_comments:write
VersionAvailable since the API’s base version
Webhook eventNone
Rate limitStandard limits apply

Version history

List the saved versions in a file's history.1

A Tier 2 endpoint. Paginated through before and after parameters with a page_size up to 50.

Acts onversion
Permission (capability)file_versions:read
VersionAvailable since the API’s base version
Webhook eventNone
Rate limitStandard limits apply

Projects & teams

List the projects in a team and the files in a project.2

New app access to the projects endpoints requires Figma approval as of April 2025.

Acts onproject
Permission (capability)projects:read
VersionAvailable since the API’s base version
Webhook eventNone
Rate limitStandard limits apply

The branch_data parameter includes branch metadata for each file.

Acts onfile
Permission (capability)projects:read
VersionAvailable since the API’s base version
Webhook eventNone
Rate limitStandard limits apply

Components & styles

Read published components, component sets, and styles by team, by file, or by key.4

Returns only assets published to the team library. The page_size parameter is capped at 1000 as of July 2025.

Acts oncomponent
Permission (capability)team_library_content:read
VersionAvailable since the API’s base version
Webhook eventNone
Rate limitStandard limits apply

Scoped to one file rather than a whole team library.

Acts oncomponent
Permission (capability)library_content:read
VersionAvailable since the API’s base version
Webhook eventNone
Rate limitStandard limits apply

A component set groups the variants of one component.

Acts oncomponent set
Permission (capability)library_content:read
VersionAvailable since the API’s base version
Webhook eventNone
Rate limitStandard limits apply

Styles cover fill, text, effect, and grid definitions.

Acts onstyle
Permission (capability)library_content:read
VersionAvailable since the API’s base version
Webhook eventNone
Rate limitStandard limits apply

Users

Read the profile of the authenticated user.1

Returns the calling user's name, email, and profile image. A Tier 3 endpoint.

Acts onuser
Permission (capability)current_user:read
VersionAvailable since the API’s base version
Webhook eventNone
Rate limitStandard limits apply

Webhooks

List, read, create, update, and delete webhooks that deliver file and project events.4

Webhooks use the v2 namespace. The earlier team-scoped list endpoint is deprecated.

Acts onwebhook
Permission (capability)webhooks:read
VersionAvailable since the API’s base version
Webhook eventNone
Rate limitStandard limits apply

Since May 2025 a webhook can attach to a file or project, not only a team. Creating one fires a PING event.

Acts onwebhook
Permission (capability)webhooks:write
VersionAvailable since the API’s base version
Webhook eventping
Rate limitStandard limits apply

A write that changes where and when events are delivered.

Acts onwebhook
Permission (capability)webhooks:write
VersionAvailable since the API’s base version
Webhook eventNone
Rate limitStandard limits apply

Irreversible; the webhook must be recreated to resume.

Acts onwebhook
Permission (capability)webhooks:write
VersionAvailable since the API’s base version
Webhook eventNone
Rate limitStandard limits apply

Variables

Read local and published variables, and create, update, or delete variables and collections. Enterprise only.2

Available only to members of Enterprise organizations.

Acts onvariable
Permission (capability)file_variables:read
VersionAvailable since the API’s base version
Webhook eventNone
Rate limitStandard limits apply

Enterprise only. One request adds, changes, and removes variables, and returns a map from temporary ids to real ids.

Acts onvariable
Permission (capability)file_variables:write
VersionAvailable since the API’s base version
Webhook eventNone
Rate limitStandard limits apply

Dev resources

Read the dev resources linked to a file, and add, update, or remove them.3

Dev resources are external links attached to nodes for developers.

Acts ondev resource
Permission (capability)file_dev_resources:read
VersionAvailable since the API’s base version
Webhook eventNone
Rate limitStandard limits apply

Each resource links a node to an external URL.

Acts ondev resource
Permission (capability)file_dev_resources:write
VersionAvailable since the API’s base version
Webhook eventNone
Rate limitStandard limits apply

Removes a single linked resource by its id.

Acts ondev resource
Permission (capability)file_dev_resources:write
VersionAvailable since the API’s base version
Webhook eventNone
Rate limitStandard limits apply
No endpoints match those filters.
Webhooks

Webhook events.

Figma can notify an app or AI agent when something happens in a file, project, or team, like a new version being saved or a comment being posted, instead of the app repeatedly asking. Figma posts the event to a receiver URL registered for the chosen event type.

EventWhat it signalsTriggered by
PINGFires once when a webhook is created, to confirm the receiver URL is reachable./v2/webhooks
FILE_UPDATEFires when a file's contents change, at most once every 30 minutes per file while it is being edited.In-app only
FILE_VERSION_UPDATEFires when a named version is added to a file's version history.In-app only
FILE_DELETEFires when a file is deleted, sent to webhooks watching the file or its containing context.In-app only
FILE_COMMENTFires when a comment is posted on a file./v1/files/:file_key/comments
LIBRARY_PUBLISHFires when components or styles are published from a library file.In-app only
DEV_MODE_STATUS_UPDATEFires when a node's Dev Mode status changes, such as being marked ready for development. Added in May 2025.In-app only
No events match that search.
Rate limits & pagination

Rate limits, pagination & request size.

Figma limits how fast an app or AI agent can call by sorting each endpoint into one of three cost tiers, then setting a per-minute quota for that tier based on the calling user's seat and the team's plan.

Request rate

Figma sorts every endpoint into one of three cost tiers, then sets a per-minute quota for that tier from the calling user's seat type and the team's plan. Tier 1 covers the heaviest file reads, like getting a file, its nodes, or rendered images, and allows around 10 requests per minute on Starter up to 20 per minute on Organization and Enterprise for a Dev or Full seat. Tier 2 covers comments, version history, webhooks, and variables, allowing around 25 per minute on Starter up to 100 per minute on Organization and Enterprise. Tier 3 covers lighter calls like components, the current user, and activity logs, allowing around 50 per minute on Starter up to 150 per minute on Organization and Enterprise. A view or collaborate seat gets far smaller allowances. Exceeding a tier returns HTTP 429 with a Retry-After header. These tiers and limits took effect on 17 November 2025.

Pagination

Pagination depends on the endpoint. Version history uses before and after cursors with a page_size up to 50. Comment reactions and team library listings use a cursor parameter, and team component and style listings cap page_size at 1000. The file endpoints return the whole requested document or node set in one response, narrowed by the ids and depth parameters rather than paged.

Request size

There is no single documented payload size limit. A request for a very large file can be rejected with a message to filter by the ids and depth parameters, and a large image render can time out with a 500. The image endpoints return download URLs rather than embedding image bytes in the response.

Errors

Status codes & error handling.

The status codes an agent should handle, and what to do about each.

StatusCodeMeaningWhat to do
400Bad RequestA parameter is invalid or malformed, or the request body failed validation. A request for a very large file can also be rejected here with a message to filter by ids and depth.Correct the parameters, and narrow a large file request with the ids and depth query parameters.
403ForbiddenThe token is valid but not permitted: it lacks the scope the request needs, the user cannot see the resource, or the request was not made over HTTPS.Grant the missing scope, confirm the user has access, and call over HTTPS.
404Not FoundThe requested file or resource does not exist, or is not visible to the token.Confirm the file key or resource id and that the token can reach it.
429Too Many RequestsA rate limit was exceeded for the endpoint's tier. The response carries a Retry-After header and X-Figma-Rate-Limit-Type and X-Figma-Plan-Tier headers.Wait the seconds in the Retry-After header before retrying.
500Internal Server ErrorAn error on Figma's side. A large image render can time out here.Retry, and for renders request fewer or smaller nodes.
Versioning & freshness

Version history.

Figma runs a single, continuously updated REST API with no dated version to pin. Notable changes ship through release notes, and the OpenAPI specification that describes the whole surface is published and kept current.

Version history

What changed, and when

Latest versionCurrent
CurrentCurrent version
Continuously updated REST API

Figma runs a single, continuously updated REST API with no dated version to pin and no version header to send. Notable changes ship through dated release notes, and an open OpenAPI specification in the figma/rest-api-spec repository describes the whole surface and is kept current. The list below is a timeline of notable dated changes, newest first.

What changed
  • 12 June 2026: AI Usage API for Enterprise, reporting per-user, per-day AI credit usage, behind the org:ai_metering_usage_read scope.
  • 25 March 2026: oEmbed API added, following the oEmbed 1.0 specification for file and Make metadata.
  • 21 January 2026: Discovery API extended to retrieve the text of user-submitted AI prompts on Enterprise Governance+.
2025-11-18Feature update
Extended variable collections

Documented extended collections in the variables endpoints, letting a collection define variants with custom override values. Released 18 November 2025.

What changed
  • Variables endpoints document extended collections with custom override values.
2025-09-23Feature update
New OAuth publishing flow and rate-limit changes

Announced a new OAuth app publishing requirement with a 17 November 2025 deadline, consolidated the developer documentation, and adjusted the rate limits that took effect 17 November 2025. Released 23 September 2025.

What changed
  • New OAuth app publishing flow required by 17 November 2025.
  • Adjusted per-tier rate limits effective 17 November 2025.
  • Developer documentation consolidated.
2025-05-28Feature update
Webhooks v2 expanded to files and projects

Webhooks v2 gained the ability to attach to files and projects, not only teams, a new GET endpoint to list them, and a DEV_MODE_STATUS_UPDATE event. Released 28 May 2025.

What changed
  • Webhooks can attach to files and projects, not only teams.
  • Added a GET endpoint to list webhooks by context or plan.
  • Added the DEV_MODE_STATUS_UPDATE webhook event.
2025-04-29Feature update
File metadata endpoint and granular scopes

Added the GET file metadata endpoint, which returns file information without the file content under the file_metadata:read scope, and around the same time introduced the granular REST API scopes that deprecate files:read, and capped personal access tokens at a 90-day expiry. Released through late April 2025.

What changed
  • Added GET /v1/files/:key/meta under the file_metadata:read scope (29 April 2025).
  • Introduced granular scopes such as file_content:read and file_comments:read; deprecated files:read (17 April 2025).
  • Personal access tokens limited to a maximum 90-day expiry; projects endpoints require approval for new apps (28 April 2025).
2024-02-14Feature update
Open OpenAPI specification published

Figma published an open OpenAPI specification and generated TypeScript types in the figma/rest-api-spec repository, giving a canonical machine-readable description of the whole REST API. Released 14 February 2024.

What changed
  • OpenAPI specification and TypeScript types released in the open-source figma/rest-api-spec repository.

There is no version header to send; the API is a single, continuously updated surface.

Figma API changelog ↗
Questions

Figma API, answered.

Personal access token or OAuth, which should I use?+
A personal access token is the quickest route for a server-side script or a single-user integration: a user generates it, picks its scopes, and sends it in the X-Figma-Token header, and since April 2025 it expires in at most 90 days. OAuth 2.0 is the route for an app that acts on behalf of many users, since each user grants the scopes through the authorization-code flow and the app never holds a shared secret token. Both reach the same endpoints; the difference is who the token represents and how it is obtained.
What replaced the files:read scope?+
The broad files:read scope is deprecated in favor of narrower scopes introduced in April 2025. Reading a file's contents now uses file_content:read, reading its metadata uses file_metadata:read, comments use file_comments:read and file_comments:write, version history uses file_versions:read, and published assets use library_content:read or team_library_content:read. The narrower scopes let a token be limited to exactly the area it needs, so a token for reading comments cannot also read the full design.
How do the rate limits work?+
Figma puts each endpoint in one of three cost tiers and sets a per-minute quota for that tier based on the calling user's seat and the team's plan, rather than one flat limit for the whole API. Tier 1 is the heaviest file reads, Tier 2 is comments, versions, webhooks, and variables, and Tier 3 is lighter calls like components and the current user. A Dev or Full seat on a larger plan gets more per minute than a view seat on Starter. Going over returns HTTP 429 with a Retry-After header saying how many seconds to wait. These tiers took effect on 17 November 2025.
How do I receive events instead of polling?+
Webhooks deliver events without polling. A webhook is created on the v2 webhooks endpoint with the webhooks:write scope, attached to a file, project, or team, and pointed at a receiver URL for one event type, such as FILE_UPDATE, FILE_VERSION_UPDATE, FILE_COMMENT, LIBRARY_PUBLISH, or DEV_MODE_STATUS_UPDATE. Figma POSTs the event when it fires, and a PING is sent once on creation. The passcode set on the webhook is included on each delivery so the receiver can confirm it came from Figma.
Does Figma have an official MCP server?+
Yes. Figma's first-party Dev Mode MCP server lets an AI coding agent pull design context, like variables, components, and layout, generate code from selected frames, and create or modify Figma content. The recommended remote server answers at https://mcp.figma.com/mcp and authenticates through Figma's OAuth flow, so it works without the desktop app. The write-to-canvas capability is in beta. It is separate from the REST API and aimed at design-to-code work.
Why do the variables endpoints return a permission error?+
The variables endpoints, both reading with file_variables:read and writing with file_variables:write, are available only to members of Enterprise organizations. A token outside an Enterprise plan, or one missing the variables scope, gets a 403. The write endpoint also enforces limits such as up to 40 modes per collection, up to 5000 variables per collection, and unique variable names within a collection.
Related

More productivity API guides for agents

What is Bollard AI?

Control what every AI agent can do in Figma.

Bollard AI sits between a team's AI agents and Figma. Grant each agent exactly the access it needs, read or write, resource by resource, and every call is checked and logged.

  • Set read, write, or full access per agent, never a shared Figma token.
  • Denied by default, so an agent reaches only what has been explicitly allowed.
  • Every call recorded in plain English: who, what, where, and the decision.
Figma
Design Agent
Read file contents ResourceOffReadFull use
Post comments ActionOffReadFull use
Manage webhooks ResourceOffReadFull use
Per-agent access, set in Bollard AI, not in Figma