Penpot

DESIGN · FILES & DOCS

Projects, files, pages, and comment threads in their own design teams.

Acts as the person, not as itself

Each user connects their own account. Every call carries both identities — the agent and the person it is acting for — so the agent can never reach past what that individual can already do.

Credentials never touch the agent

Tokens live in the vault and attach server-side at call time. The agent holds a session, not a secret, and revoking access does not mean rotating a key.

Every call on the record

Who asked, which agent acted, which action ran, and the verdict that let it through — one audit trail across every integration, not one per vendor.

What an agent can do

Each action is granted on its own. An agent allowed to read is not thereby allowed to write, and the scope beside each row is what the acting user must have connected for it to run at all.

penpot_post_add_team_to_organizationWRITE

Add team to organization via POST /api/main/methods/add-team-to-organization

api

penpot_post_all_org_members_in_teamREAD

All org members in team via POST /api/main/methods/all-org-members-in-team

api

penpot_post_all_team_members_in_orgsREAD

All team members in orgs via POST /api/main/methods/all-team-members-in-orgs

api

penpot_post_check_nitrate_ssoREAD

Check if a user needs to login into the organization SSO. Returns {:authorized true} when SSO is not active for the team. Returns {:authorized false :redirect-uri <url>} when SSO is active; the client must redirect there. The OIDC provider itself handles re-authentication transparently if the user already has an active SSO session. via POST /api/main/methods/check-nitrate-sso

api

penpot_post_check_org_membersREAD

Check org members via POST /api/main/methods/check-org-members

api

penpot_post_check_team_external_invitationsREAD

Check team external invitations via POST /api/main/methods/check-team-external-invitations

api

penpot_post_clone_file_media_objectWRITE

Clone file media object via POST /api/main/methods/clone-file-media-object

api

penpot_post_clone_templateWRITE

Clone into the specified project the template by its id. via POST /api/main/methods/clone-template

api

penpot_post_create_commentWRITE

Create comment via POST /api/main/methods/create-comment

api

penpot_post_create_comment_threadWRITE

Create comment thread via POST /api/main/methods/create-comment-thread

api

penpot_post_create_fileWRITE

Create file via POST /api/main/methods/create-file

api

penpot_post_create_file_media_object_from_urlWRITE

Create file media object from url via POST /api/main/methods/create-file-media-object-from-url

api

penpot_post_create_file_snapshotWRITE

Create file snapshot via POST /api/main/methods/create-file-snapshot

api

penpot_post_create_font_variantWRITE

Upload a font variant. Font data may be provided either as a Transit-encoded `:data` map (keyed by mime-type) for small fonts, or as an `:uploads` map (keyed by mime-type, values are upload-session UUIDs from the chunked-upload API) for large fonts. Exactly one of the two must be present. via POST /api/main/methods/create-font-variant

api

penpot_post_create_projectWRITE

Create project via POST /api/main/methods/create-project

api

penpot_post_create_share_linkWRITE

Creates a share-link object. Share links are resources that allows external users access to specific pages of a file with specific permissions (who-comment and who-inspect). via POST /api/main/methods/create-share-link

api

penpot_post_create_teamWRITE

Create team via POST /api/main/methods/create-team

api

penpot_post_create_team_access_requestWRITE

A rpc call that allow to request for an invitations to join the team. via POST /api/main/methods/create-team-access-request

api

penpot_post_create_team_invitationsWRITE

A rpc call that allows to send single or multiple invitations to join the team. Supports two parameter formats: 1. emails (set) + role (single role for all emails) 2. invitations (vector of {:email :role} maps for individual roles) via POST /api/main/methods/create-team-invitations

api

penpot_post_create_team_with_invitationsWRITE

Create team with invitations via POST /api/main/methods/create-team-with-invitations

api

penpot_post_create_webhookWRITE

Create webhook via POST /api/main/methods/create-webhook

api

penpot_post_delete_commentWRITE

Delete comment via POST /api/main/methods/delete-comment

api

penpot_post_delete_comment_threadWRITE

Delete comment thread via POST /api/main/methods/delete-comment-thread

api

penpot_post_delete_fileWRITE

Delete file via POST /api/main/methods/delete-file

api

penpot_post_delete_file_object_thumbnailWRITE

Delete file object thumbnail via POST /api/main/methods/delete-file-object-thumbnail

api

penpot_post_delete_file_object_thumbnailsWRITE

Delete file object thumbnails via POST /api/main/methods/delete-file-object-thumbnails

api

penpot_post_delete_file_snapshotWRITE

Delete file snapshot via POST /api/main/methods/delete-file-snapshot

api

penpot_post_delete_fontWRITE

Delete font via POST /api/main/methods/delete-font

api

penpot_post_delete_font_variantWRITE

Delete font variant via POST /api/main/methods/delete-font-variant

api

penpot_post_delete_profile_photoWRITE

Delete profile photo via POST /api/main/methods/delete-profile-photo

api

penpot_post_delete_projectWRITE

Delete project via POST /api/main/methods/delete-project

api

penpot_post_delete_share_linkWRITE

Delete share link via POST /api/main/methods/delete-share-link

api

penpot_post_delete_teamWRITE

Delete team via POST /api/main/methods/delete-team

api

penpot_post_delete_team_invitationWRITE

Delete team invitation via POST /api/main/methods/delete-team-invitation

api

penpot_post_delete_team_memberWRITE

Delete team member via POST /api/main/methods/delete-team-member

api

penpot_post_delete_webhookWRITE

Delete webhook via POST /api/main/methods/delete-webhook

api

penpot_post_duplicate_fileWRITE

Duplicate a single file in the same team. via POST /api/main/methods/duplicate-file

api

penpot_post_duplicate_projectWRITE

Duplicate an entire project with all the files via POST /api/main/methods/duplicate-project

api

penpot_post_get_all_projectsREAD

Get all projects via POST /api/main/methods/get-all-projects

api

penpot_post_get_comment_threadREAD

Get comment thread via POST /api/main/methods/get-comment-thread

api

penpot_post_get_comment_threadsREAD

Get comment threads via POST /api/main/methods/get-comment-threads

api

penpot_post_get_commentsREAD

Get comments via POST /api/main/methods/get-comments

api

penpot_post_get_error_reportREAD

Get error report via POST /api/main/methods/get-error-report

api

penpot_post_get_error_reportsREAD

Get error reports via POST /api/main/methods/get-error-reports

api

penpot_post_get_fileREAD

Retrieve a file by its ID. Only authenticated users. via POST /api/main/methods/get-file

api

penpot_post_get_file_data_for_thumbnailREAD

Retrieves the data for generate the thumbnail of the file. Used mainly for render thumbnails on dashboard. via POST /api/main/methods/get-file-data-for-thumbnail

api

penpot_post_get_file_fragmentREAD

Retrieve a file fragment by its ID. Only authenticated users. via POST /api/main/methods/get-file-fragment

api

penpot_post_get_file_infoREAD

Retrieve minimal file info by its ID. via POST /api/main/methods/get-file-info

api

penpot_post_get_file_librariesREAD

Get libraries used by the specified file. via POST /api/main/methods/get-file-libraries

api

penpot_post_get_file_object_thumbnailsREAD

Retrieve a file object thumbnails. via POST /api/main/methods/get-file-object-thumbnails

api

penpot_post_get_file_snapshotREAD

Retrieve a file bundle with data from a specific snapshot for read-only preview. Does not modify any database state. via POST /api/main/methods/get-file-snapshot

api

penpot_post_get_file_snapshotsREAD

Get file snapshots via POST /api/main/methods/get-file-snapshots

api

penpot_post_get_file_statsREAD

Return aggregate statistics for a single file: page count, shape counts by type, component/color/typography counts, and inbound and outbound library reference counts. Cheap alternative to `get-file` when only metrics are needed. via POST /api/main/methods/get-file-stats

api

penpot_post_get_file_summaryREAD

Retrieve a file summary by its ID. Only authenticated users. via POST /api/main/methods/get-file-summary

api

penpot_post_get_font_variantsREAD

Get font variants via POST /api/main/methods/get-font-variants

api

penpot_post_get_leave_org_summaryREAD

Get leave org summary via POST /api/main/methods/get-leave-org-summary

api

penpot_post_get_library_file_referencesREAD

Returns all the file references that use specified file (library) id. via POST /api/main/methods/get-library-file-references

api

penpot_post_get_library_usageREAD

Gets the number of files that use the specified library. via POST /api/main/methods/get-library-usage

api

penpot_post_get_nitrate_connectivityREAD

Get nitrate connectivity via POST /api/main/methods/get-nitrate-connectivity

api

penpot_post_get_owned_teamsREAD

Get owned teams via POST /api/main/methods/get-owned-teams

api

penpot_post_get_pageREAD

Retrieves the page data from file and returns it. If no page-id is specified, the first page will be returned. If object-id is specified, only that object and its children will be returned in the page objects data structure. If you specify the object-id, the page-id parameter becomes mandatory. Mainly used for rendering purposes on the exporter. It does not accepts client features. via POST /api/main/methods/get-page

api

penpot_post_get_profileREAD

Get profile via POST /api/main/methods/get-profile

api

penpot_post_get_profiles_for_file_commentsREAD

Retrieves a list of profiles with limited set of properties of all participants on comment threads of the file. via POST /api/main/methods/get-profiles-for-file-comments

api

penpot_post_get_projectREAD

Get project via POST /api/main/methods/get-project

api

penpot_post_get_project_filesREAD

Get all files for the specified project. via POST /api/main/methods/get-project-files

api

penpot_post_get_projectsREAD

Get projects via POST /api/main/methods/get-projects

api

penpot_post_get_sso_providerREAD

Get sso provider via POST /api/main/methods/get-sso-provider

api

penpot_post_get_subscription_warningREAD

Get subscription warning via POST /api/main/methods/get-subscription-warning

api

penpot_post_get_teamREAD

Get team via POST /api/main/methods/get-team

api

penpot_post_get_team_deleted_filesREAD

Get team deleted files via POST /api/main/methods/get-team-deleted-files

api

penpot_post_get_team_infoREAD

Retrieve minimal team info by its ID. via POST /api/main/methods/get-team-info

api

penpot_post_get_team_invitation_tokenREAD

Get team invitation token via POST /api/main/methods/get-team-invitation-token

api

penpot_post_get_team_invitationsREAD

Get team invitations via POST /api/main/methods/get-team-invitations

api

penpot_post_get_team_membersREAD

Get team members via POST /api/main/methods/get-team-members

api

penpot_post_get_team_recent_filesREAD

Get team recent files via POST /api/main/methods/get-team-recent-files

api

penpot_post_get_team_shared_filesREAD

Get all file (libraries) for the specified team. via POST /api/main/methods/get-team-shared-files

api

penpot_post_get_team_statsREAD

Get team stats via POST /api/main/methods/get-team-stats

api

penpot_post_get_team_usersREAD

Get team users by team-id or by file-id via POST /api/main/methods/get-team-users

api

penpot_post_get_teamsREAD

Get teams via POST /api/main/methods/get-teams

api

penpot_post_get_unread_comment_threadsREAD

Get unread comment threads via POST /api/main/methods/get-unread-comment-threads

api

penpot_post_get_view_only_bundleREAD

Get view only bundle via POST /api/main/methods/get-view-only-bundle

api

penpot_post_get_webhooksREAD

Get webhooks via POST /api/main/methods/get-webhooks

api

penpot_post_has_file_librariesREAD

Checks if the file has libraries. Returns a boolean via POST /api/main/methods/has-file-libraries

api

penpot_post_ignore_file_library_sync_statusWRITE

Ignore updates in linked files via POST /api/main/methods/ignore-file-library-sync-status

api

penpot_post_leave_orgWRITE

Leave org via POST /api/main/methods/leave-org

api

penpot_post_leave_teamWRITE

Leave team via POST /api/main/methods/leave-team

api

penpot_post_link_file_to_libraryWRITE

Link a file to a library. Returns the recursive list of libraries used by that library via POST /api/main/methods/link-file-to-library

api

penpot_post_lock_file_snapshotWRITE

Lock file snapshot via POST /api/main/methods/lock-file-snapshot

api

penpot_post_mark_all_threads_as_readWRITE

Mark all threads as read via POST /api/main/methods/mark-all-threads-as-read

api

penpot_post_move_filesWRITE

Move a set of files from one project to other. via POST /api/main/methods/move-files

api

penpot_post_move_projectWRITE

Move projects between teams via POST /api/main/methods/move-project

api

penpot_post_permanently_delete_team_filesWRITE

Mark the specified files to be deleted immediatelly on the specified team. The team-id on params will be used to filter and check writable permissons on team. via POST /api/main/methods/permanently-delete-team-files

api

penpot_post_push_audit_eventsWRITE

Push audit events via POST /api/main/methods/push-audit-events

api

penpot_post_redeem_nitrate_activation_codeWRITE

Redeem nitrate activation code via POST /api/main/methods/redeem-nitrate-activation-code

api

penpot_post_remove_team_from_orgWRITE

Remove team from org via POST /api/main/methods/remove-team-from-org

api

penpot_post_rename_fileWRITE

Rename file via POST /api/main/methods/rename-file

api

penpot_post_rename_projectWRITE

Rename project via POST /api/main/methods/rename-project

api

penpot_post_restore_deleted_team_filesWRITE

Removes the deletion mark from the specified files (and respective projects) on the specified team. via POST /api/main/methods/restore-deleted-team-files

api

penpot_post_restore_file_snapshotWRITE

Restore file snapshot via POST /api/main/methods/restore-file-snapshot

api

penpot_post_search_filesREAD

Search files via POST /api/main/methods/search-files

api

penpot_post_send_user_feedbackWRITE

Send user feedback via POST /api/main/methods/send-user-feedback

api

penpot_post_set_file_sharedWRITE

Set file shared via POST /api/main/methods/set-file-shared

api

penpot_post_unlink_file_from_libraryWRITE

Unlink file from library via POST /api/main/methods/unlink-file-from-library

api

penpot_post_unlock_file_snapshotWRITE

Unlock file snapshot via POST /api/main/methods/unlock-file-snapshot

api

penpot_post_update_commentWRITE

Update comment via POST /api/main/methods/update-comment

api

penpot_post_update_comment_threadWRITE

Update comment thread via POST /api/main/methods/update-comment-thread

api

penpot_post_update_comment_thread_frameWRITE

Update comment thread frame via POST /api/main/methods/update-comment-thread-frame

api

penpot_post_update_comment_thread_positionWRITE

Update comment thread position via POST /api/main/methods/update-comment-thread-position

api

penpot_post_update_comment_thread_statusWRITE

Update comment thread status via POST /api/main/methods/update-comment-thread-status

api

penpot_post_update_fileWRITE

Update file via POST /api/main/methods/update-file The `changes` / `changesWithMetadata` schemas are deliberately opaque here: each entry is one operation of Penpot's own file-change vocabulary, whose full union lives in Penpot's OpenAPI document rather than in this tool listing.

api

penpot_post_update_file_library_sync_statusWRITE

Update the synchronization status of a file->library link via POST /api/main/methods/update-file-library-sync-status

api

penpot_post_update_file_snapshotWRITE

Update file snapshot via POST /api/main/methods/update-file-snapshot

api

penpot_post_update_fontWRITE

Update font via POST /api/main/methods/update-font

api

penpot_post_update_profileWRITE

Update profile via POST /api/main/methods/update-profile