Figma

Twin of the Figma REST API.


Covers	`api.figma.com`
Auth	Personal access tokens, OAuth
Webhooks	Yes
Operations	53

Coverage

Identity, the team and project catalog, file reads over a real document tree, node subtrees, image renders and fills, comments and reactions, version history, the published library, dev resources and v2 webhooks. The OAuth issuer lives on the same base at Figma’s own /oauth, /v1/oauth/token and /v1/oauth/refresh.

Figma’s REST API cannot create files, publish library assets or save versions, so neither can the twin. Comments, reactions, dev resources and webhooks are the whole write surface.

Credentials

A personal access token goes in X-Figma-Token and an OAuth access token in Authorization: Bearer. Any well-formed token of either kind authenticates by default, so your existing figd_… token needs no change. Set auth.mode to enforced to accept only what the world knows. See Credentials.

A figd_ token presented as a Bearer is always refused, exactly as the vendor refuses it. Routes are scope-gated, and a token missing one gets a 403 naming the scope it wanted.

Vendor specific details

One API, two error envelopes. Files, comments, versions, images and library items answer {"status", "err"}. Teams, projects, webhooks and dev resources answer {"error": true, "status", "message", "i18n"}.
An unknown file key is a 404 on the personal-token lane and a 403 on the OAuth lane. When both headers are present, the bearer decides the lane.
Node ids use colons, 1:2, not the dashed form in Figma’s own URLs. A malformed one is a 400 before any lookup, and an absent ids is refused before the credential is read.
Version history pagination returns absolute, unencoded URLs with literal spaces in the timestamp, and before is inclusive, so following prev_page re-serves the row you were on.

Its own notes

Once a sandbox is running, this twin serves its own operating notes at {control_url}/veris/manual: the credentials it accepts, the API versions it serves, and the fault statuses you can arm against it. They are generated from the same source as its behaviour, so they cannot drift.