DESIGN · FILES & DOCS
Files, comments, components, and versions the designer can already open.
Each user connects their own account. Every call carries both identities — the agent and the person it is acting for — so the agent can never reach past what that individual can already do.
Tokens live in the vault and attach server-side at call time. The agent holds a session, not a secret, and revoking access does not mean rotating a key.
Who asked, which agent acted, which action ran, and the verdict that let it through — one audit trail across every integration, not one per vendor.
Each action is granted on its own. An agent allowed to read is not thereby allowed to write, and the scope beside each row is what the acting user must have connected for it to run at all.
figma_delete_v1_files_by_file_key_comments_by_comment_idWRITEDelete comment via DELETE /v1/files/{file_key}/comments/{comment_id}
figma_delete_v1_files_by_file_key_comments_by_comment_id_reactionsWRITEDelete comment reaction via DELETE /v1/files/{file_key}/comments/{comment_id}/reactions
figma_delete_v1_files_by_file_key_dev_resources_by_dev_resource_idWRITEDelete dev resource via DELETE /v1/files/{file_key}/dev_resources/{dev_resource_id}
figma_delete_v2_webhooks_by_webhook_idWRITEDelete webhook via DELETE /v2/webhooks/{webhook_id}
figma_get_v1_component_sets_by_keyREADGet component set via GET /v1/component_sets/{key}
figma_get_v1_components_by_keyREADGet component via GET /v1/components/{key}
figma_get_v1_files_by_file_keyREADGet file via GET /v1/files/{file_key}
figma_get_v1_files_by_file_key_commentsREADGet comments via GET /v1/files/{file_key}/comments
figma_get_v1_files_by_file_key_comments_by_comment_id_reactionsREADGet comment reactions via GET /v1/files/{file_key}/comments/{comment_id}/reactions
figma_get_v1_files_by_file_key_component_setsREADGet file component sets via GET /v1/files/{file_key}/component_sets
figma_get_v1_files_by_file_key_componentsREADGet file components via GET /v1/files/{file_key}/components
figma_get_v1_files_by_file_key_dev_resourcesREADGet dev resources via GET /v1/files/{file_key}/dev_resources
figma_get_v1_files_by_file_key_imagesREADGet image fills via GET /v1/files/{file_key}/images
figma_get_v1_files_by_file_key_metaREADGet file meta via GET /v1/files/{file_key}/meta
figma_get_v1_files_by_file_key_nodesREADGet file nodes via GET /v1/files/{file_key}/nodes
figma_get_v1_files_by_file_key_stylesREADGet file styles via GET /v1/files/{file_key}/styles
figma_get_v1_files_by_file_key_versionsREADGet file versions via GET /v1/files/{file_key}/versions
figma_get_v1_images_by_file_keyREADGet images via GET /v1/images/{file_key}
figma_get_v1_meREADGet me via GET /v1/me
figma_get_v1_oembedREADGet o embed via GET /v1/oembed
figma_get_v1_styles_by_keyREADGet style via GET /v1/styles/{key}
figma_get_v1_teams_by_team_id_component_setsREADGet team component sets via GET /v1/teams/{team_id}/component_sets
figma_get_v1_teams_by_team_id_componentsREADGet team components via GET /v1/teams/{team_id}/components
figma_get_v1_teams_by_team_id_stylesREADGet team styles via GET /v1/teams/{team_id}/styles
figma_get_v2_folders_by_folder_id_filesREADGet folder files via GET /v2/folders/{folder_id}/files
figma_get_v2_folders_by_folder_id_foldersREADGet folder folders via GET /v2/folders/{folder_id}/folders
figma_get_v2_folders_by_folder_id_metaREADGet folder meta via GET /v2/folders/{folder_id}/meta
figma_get_v2_teams_by_team_id_foldersREADGet team folders via GET /v2/teams/{team_id}/folders
figma_get_v2_teams_by_team_id_webhooksREADGet team webhooks via GET /v2/teams/{team_id}/webhooks
figma_get_v2_webhooksREADGet webhooks via GET /v2/webhooks
figma_get_v2_webhooks_by_webhook_idREADGet webhook via GET /v2/webhooks/{webhook_id}
figma_get_v2_webhooks_by_webhook_id_requestsREADGet webhook requests via GET /v2/webhooks/{webhook_id}/requests
figma_post_v1_dev_resourcesWRITEPost dev resources via POST /v1/dev_resources
figma_post_v1_files_by_file_key_commentsWRITEPost comment via POST /v1/files/{file_key}/comments
figma_post_v1_files_by_file_key_comments_by_comment_id_reactionsWRITEPost comment reaction via POST /v1/files/{file_key}/comments/{comment_id}/reactions
figma_post_v2_webhooksWRITEPost webhook via POST /v2/webhooks
figma_put_v1_dev_resourcesWRITEPut dev resources via PUT /v1/dev_resources
figma_put_v2_webhooks_by_webhook_idWRITEPut webhook via PUT /v2/webhooks/{webhook_id}
Put Figma behind one governed endpoint.
Same permissions, same audit trail, whatever else you connect next.