Figma

DESIGN · FILES & DOCS

Scopes that draw scrutiny

• files:read Deprecated, and Figma describes it as an extremely broad legacy scope. The replacement is a dozen narrow scopes such as file_content:read, file_metadata:read and file_versions:read.
• file_variables:read / file_variables:write Enterprise only. Variables are the design system’s tokens, so write access here changes every file that consumes them.
• org:activity_log_read Enterprise only and requires an organization admin: "Read organization activity logs", which is the audit trail of everyone in the org.
• org:developer_log_read / org:discovery_read Enterprise with the Governance add-on and an organization admin. Developer logs and text event data are the widest observability grants Figma offers.
• webhooks:write Creates and manages webhooks, so a token holding it can start streaming file events to an endpoint of its own choosing.

Rate limits

• Limits depend on the user’s seat type (View, Collab, Dev, Full), the endpoint tier, and the plan of the resource being accessed (Starter, Professional, Organization, Enterprise).
• Tier 1 is files and images, tier 2 comments, folders, projects and variables, tier 3 metadata, components, logs and users — tier 1 is the scarcest.
• Figma’s worked example: a personal access token fetching file content on a Starter plan is limited to up to 6 requests per month, regardless of the seat held elsewhere.
• For OAuth apps, limits are tracked per user, per plan, per app, so each app gets its own budget for the same user.
• 429 responses carry Retry-After in seconds and X-Figma-Rate-Limit-Type, which is `low` for Collab and View seats and `high` for Dev and Full.

Who has to approve

The org:* scopes are Enterprise-only and additionally require an organization admin; org:developer_log_read and org:discovery_read also need the Governance add-on. Everything else is authorized by the individual user, and a personal access token is created by that user in their own Security settings.

Worth knowing

• Because the limit follows the resource’s plan, an integration tested against an Enterprise file can become effectively unusable against a client’s Starter file with no code change.
• The legacy scopes files:read, projects:read and project_metadata:read are deprecated in favour of folders:read and folder_metadata:read, so a long-lived app is holding names Figma is moving away from.
• A personal access token has its expiration and its scopes chosen at creation time and is shown exactly once, so rotation is a manual re-authorization rather than an API call.
• X-Figma-Rate-Limit-Type tells you which seat bucket you are in, which is the only way to distinguish "this user is on a cheap seat" from "this app is too busy".

Put Figma behind one governed endpoint.

Same permissions, same audit trail, whatever else you connect next.